{ "schema_version": "ews-audit-output/v3", "binary_version": "0.3.0-rc.2", "tenant_html_version": "ews-tenant-evidence-html/v3", "run_fingerprint": "e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077", "prototype_label": "PROTOTYPE", "synthetic": true, "portfolio_status": "COMPLETE", "tenant_key": "fictional-alpha", "as_of_utc": "2026-08-10T12:00:00Z", "report_window_days": [ 90 ], "coverage_limitations": [ "ALLOWLIST_ORIGIN_NOT_OBSERVABLE", "DELEGATED_OUT_OF_SCOPE", "GRAPH_EVENTUAL_CONSISTENCY", "IDENTITY_NOT_VERIFIED", "MAILBOX_IMPACT_UNMAPPED", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "NO_LIVE_AUTHORIZATION_CHECK", "POLICY_SOURCE_TIME_BOUND", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED", "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION" ], "sources": [ { "source_evidence_id": "src-decisions", "kind": "decisions", "sha256": "45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-decisions", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "NORMALIZED_MANUAL", "scope": "REVIEWED_DECISIONS", "limitations": [] } }, { "source_evidence_id": "src-fictional-alpha-collector", "kind": "collector_manifest", "sha256": "42dc2c595dccbdb5b38153d98ab980aac7c60ef4fdcbaf3f2c247f1edf96886c", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-collector", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "MICROSOFT_365_POWERSHELL_COLLECTOR", "scope": "COMPLETE_AUDIT_COLLECTION", "limitations": [ "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED" ] } }, { "source_evidence_id": "src-fictional-alpha-config", "kind": "organization_config_v2", "sha256": "4751de9de09299b2767bd501326d6a4b94d0fb646d2c2ed17cf319353874eef3", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-config", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "EXCHANGE_ONLINE_POWERSHELL", "scope": "ORGANIZATION_EWS_POLICY", "limitations": [] } }, { "source_evidence_id": "src-fictional-alpha-mailbox", "kind": "mailbox_override_summary", "sha256": "1a0469507a52654d82039a01b9c558c46ee7edf6f0722b804918f89a011564fa", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-mailbox-summary", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "EXCHANGE_ONLINE_POWERSHELL", "scope": "MAILBOX_EWS_OVERRIDE_AGGREGATE", "limitations": [ "MAILBOX_IMPACT_UNMAPPED" ] } }, { "source_evidence_id": "src-fictional-alpha-permissions", "kind": "permission_evidence", "sha256": "21181dd921b109fbcdd2e06eca94163d4f292ac29399608639165110e639c189", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-permissions", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "MICROSOFT_GRAPH", "scope": "EWS_PERMISSION_EVIDENCE", "limitations": [ "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED" ] } }, { "source_evidence_id": "src-fictional-alpha-usage", "kind": "usage", "sha256": "4272adf23dde9b7d74aea146226304bba30818f3203625bf153b1506751b2d5e", "captured_at_utc": "2026-08-10T11:30:00Z", "evidence": { "status": "OBSERVED_COMPLETE", "source_ref": "fictional-usage", "captured_at_utc": "2026-08-10T11:30:00Z", "method": "NORMALIZED_MANUAL", "scope": "EWS_USAGE_WINDOW", "limitations": [ "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION" ] } } ], "applications": [ { "application_id": "00000000-0000-4000-8000-000000000011", "display_name": null, "owner_claims": { "observed_owner": { "status": "NOT_OBSERVED", "value": null, "source_evidence_ids": [], "source_refs": [], "limitations": [] }, "ownership_verification": { "status": "NOT_VERIFIED", "value": null, "source_evidence_ids": [], "source_refs": [], "limitations": [] }, "ews_usage_claim": { "status": "OBSERVED_IN_WINDOW", "value": "90", "source_evidence_ids": [ "src-fictional-alpha-usage" ], "source_refs": [], "limitations": [ "USAGE_WINDOW_ONLY" ] }, "allowlist_recommendation": { "status": "REVIEWED_KEEP", "value": "keep", "source_evidence_ids": [ "src-fictional-alpha-usage" ], "source_refs": [], "limitations": [] } }, "evidence_ids": [ "src-decisions", "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ] }, { "application_id": "00000000-0000-4000-8000-000000000012", "display_name": null, "owner_claims": { "observed_owner": { "status": "NOT_OBSERVED", "value": null, "source_evidence_ids": [], "source_refs": [], "limitations": [] }, "ownership_verification": { "status": "NOT_VERIFIED", "value": null, "source_evidence_ids": [], "source_refs": [], "limitations": [] }, "ews_usage_claim": { "status": "NOT_OBSERVED_IN_WINDOW", "value": "90", "source_evidence_ids": [ "src-fictional-alpha-usage" ], "source_refs": [], "limitations": [ "USAGE_WINDOW_ONLY" ] }, "allowlist_recommendation": { "status": "UNREVIEWED", "value": null, "source_evidence_ids": [], "source_refs": [], "limitations": [] } }, "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ] } ], "usage": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "soap_action": "GetItem", "report_window_days": 90, "source_evidence_id": "src-fictional-alpha-usage", "call_volume": 7, "last_activity_utc": "2026-08-10T10:00:00Z", "source_row_numbers": [ 1 ] } ], "permission_reconciliation": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "usage_state": "OBSERVED_IN_WINDOW", "app_only_right_state": "OBSERVED", "delegated_tenantwide_state": "UNKNOWN", "delegated_principal_state": "UNKNOWN", "principal_grant_count": 0, "quadrant": "USES_WITH_OBSERVED_RIGHT", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ], "limitations": [ "ALLOWLIST_ORIGIN_NOT_OBSERVABLE", "DELEGATED_OUT_OF_SCOPE", "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED", "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "usage_state": "NOT_OBSERVED_IN_WINDOW", "app_only_right_state": "OBSERVED", "delegated_tenantwide_state": "UNKNOWN", "delegated_principal_state": "UNKNOWN", "principal_grant_count": 0, "quadrant": "RIGHT_WITHOUT_OBSERVED_USAGE", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ], "limitations": [ "ALLOWLIST_ORIGIN_NOT_OBSERVABLE", "DELEGATED_OUT_OF_SCOPE", "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED", "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION" ] } ], "organization_policy_model": [ { "policy_model_version": "ews-policy-model/v1", "policy_phase": "ENFORCEMENT_TARGET", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "ews_enabled_state": "TRUE", "app_id_list_state": "POPULATED", "membership": "PRESENT", "modeled_outcome": "MODELED_ALLOWED", "rule_id": "ENF-TRUE-LISTED", "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox" ], "limitations": [ "MAILBOX_IMPACT_UNMAPPED", "NO_LIVE_AUTHORIZATION_CHECK", "POLICY_SOURCE_TIME_BOUND" ] }, { "policy_model_version": "ews-policy-model/v1", "policy_phase": "ENFORCEMENT_TARGET", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "ews_enabled_state": "TRUE", "app_id_list_state": "POPULATED", "membership": "ABSENT", "modeled_outcome": "MODELED_BLOCKED", "rule_id": "ENF-TRUE-UNLISTED", "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox" ], "limitations": [ "MAILBOX_IMPACT_UNMAPPED", "POLICY_SOURCE_TIME_BOUND" ] }, { "policy_model_version": "ews-policy-model/v1", "policy_phase": "PRE_ENFORCEMENT", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "ews_enabled_state": "TRUE", "app_id_list_state": "POPULATED", "membership": "PRESENT", "modeled_outcome": "MODELED_ALLOWED", "rule_id": "PRE-TRUE-LISTED", "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox" ], "limitations": [ "MAILBOX_IMPACT_UNMAPPED", "NO_LIVE_AUTHORIZATION_CHECK", "POLICY_SOURCE_TIME_BOUND" ] }, { "policy_model_version": "ews-policy-model/v1", "policy_phase": "PRE_ENFORCEMENT", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "ews_enabled_state": "TRUE", "app_id_list_state": "POPULATED", "membership": "ABSENT", "modeled_outcome": "MODELED_BLOCKED", "rule_id": "PRE-TRUE-UNLISTED", "source_ref": "MS-EXCHANGE-EWS-ALLOWLIST-2026-06-29", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox" ], "limitations": [ "MAILBOX_IMPACT_UNMAPPED", "POLICY_SOURCE_TIME_BOUND" ] } ], "mailbox_override_summary": { "tenant_key": "fictional-alpha", "evidence_status": "OBSERVED_COMPLETE", "true_count": 1, "false_count": 2, "null_count": 3, "total_count": 6, "limitations": [ "MAILBOX_IMPACT_UNMAPPED" ] }, "findings": [ { "finding_id": "finding-fictional-alpha-00000000-0000-4000-8000-000000000011-observed_allowlisted", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "state": "OBSERVED_ALLOWLISTED", "severity": "INFO", "explanation_code": "R_OBSERVED_ALLOWLISTED", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ], "limitations": [ "ALLOWLIST_ORIGIN_NOT_OBSERVABLE", "DELEGATED_OUT_OF_SCOPE", "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED", "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION", "W_OWNER_UNKNOWN" ] }, { "finding_id": "finding-fictional-alpha-00000000-0000-4000-8000-000000000012-observed_not_allowlisted", "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "state": "OBSERVED_NOT_ALLOWLISTED", "severity": "REVIEW", "explanation_code": "R_OBSERVED_NOT_ALLOWLISTED", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ], "limitations": [ "ALLOWLIST_ORIGIN_NOT_OBSERVABLE", "DELEGATED_OUT_OF_SCOPE", "GRAPH_EVENTUAL_CONSISTENCY", "NON_TRANSACTIONAL_CROSS_SERVICE_SNAPSHOT", "SDK_ALL_TRAVERSAL_NOT_INDEPENDENTLY_VERIFIED", "USAGE_WINDOW_ONLY", "WEEKLY_AGGREGATION", "W_OWNER_UNKNOWN" ] } ], "decisions": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "decision": "keep", "rationale": "fictional-alpha-reviewed", "owner_alias": "fictional-owner-alpha", "target_date": "2026-09-01", "review_status": "REVIEWED", "reviewed_by_alias": "fictional-reviewer-alpha", "evidence_ids": [ "src-fictional-alpha-usage" ] } ], "configuration_proposals": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "current_snapshot_sha256": "4751de9de09299b2767bd501326d6a4b94d0fb646d2c2ed17cf319353874eef3", "current_full_app_id_set": [ "00000000-0000-4000-8000-000000000011" ], "target_state": "NO_TARGET", "prospective_full_app_id_set": [], "add_delta": [], "remove_delta": [], "current_membership": "PRESENT", "candidate_membership": "UNCHANGED", "desired_membership": "UNSPECIFIED", "eligibility": "BLOCKED", "decision": "keep", "decision_review_status": "REVIEWED", "blocking_codes": [ "TENANT_TARGET_INCOMPLETE" ], "warning_codes": [ "CURRENT_ALLOWLIST_ORIGIN_UNVERIFIED", "FULL_REPLACE_REVIEW_REQUIRED", "MAILBOX_IMPACT_UNMAPPED", "RIGHTS_EVIDENCE_INCOMPLETE" ], "precondition_codes": [ "ALL_DECISIONS_REVIEWED", "CURRENT_SNAPSHOT_HASH_MATCH", "ENFORCEMENT_TARGET_ALLOWED", "FULL_REPLACE_REVIEW_ACK_REQUIRED" ], "review_checklist_codes": [ "AUTHORIZE_CHANGE_OUTSIDE_PRODUCT", "REVIEW_ADD_DELTA", "REVIEW_CURRENT_FULL_SET", "REVIEW_LEGACY_POLICY", "REVIEW_MAILBOX_LIMITATIONS", "REVIEW_REMOVE_DELTA" ], "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "current_snapshot_sha256": "4751de9de09299b2767bd501326d6a4b94d0fb646d2c2ed17cf319353874eef3", "current_full_app_id_set": [ "00000000-0000-4000-8000-000000000011" ], "target_state": "NO_TARGET", "prospective_full_app_id_set": [], "add_delta": [], "remove_delta": [], "current_membership": "ABSENT", "candidate_membership": "UNSPECIFIED", "desired_membership": "UNSPECIFIED", "eligibility": "BLOCKED", "decision": "", "decision_review_status": "", "blocking_codes": [ "DECISION_NOT_REVIEWED" ], "warning_codes": [ "CURRENT_ALLOWLIST_ORIGIN_UNVERIFIED", "FULL_REPLACE_REVIEW_REQUIRED", "MAILBOX_IMPACT_UNMAPPED", "RIGHTS_EVIDENCE_INCOMPLETE", "USAGE_WINDOW_ONLY" ], "precondition_codes": [ "ALL_DECISIONS_REVIEWED", "CURRENT_SNAPSHOT_HASH_MATCH", "ENFORCEMENT_TARGET_ALLOWED", "FULL_REPLACE_REVIEW_ACK_REQUIRED" ], "review_checklist_codes": [ "AUTHORIZE_CHANGE_OUTSIDE_PRODUCT", "REVIEW_ADD_DELTA", "REVIEW_CURRENT_FULL_SET", "REVIEW_LEGACY_POLICY", "REVIEW_MAILBOX_LIMITATIONS", "REVIEW_REMOVE_DELTA" ], "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-mailbox", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ] } ], "unknown_evidence": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "dimension": "DELEGATED_PRINCIPAL_RIGHT", "evidence_status": "NOT_COLLECTED", "reason_code": "DELEGATED_OUT_OF_SCOPE", "source_ref": "fictional-permissions", "limitations": [ "DELEGATED_OUT_OF_SCOPE" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "dimension": "DELEGATED_TENANTWIDE_RIGHT", "evidence_status": "NOT_COLLECTED", "reason_code": "DELEGATED_OUT_OF_SCOPE", "source_ref": "fictional-permissions", "limitations": [ "DELEGATED_OUT_OF_SCOPE" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "dimension": "OWNER_IDENTITY", "evidence_status": "NOT_COLLECTED", "reason_code": "IDENTITY_NOT_VERIFIED", "source_ref": "APPLICATION_CONTEXT", "limitations": [ "IDENTITY_NOT_VERIFIED" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "dimension": "DELEGATED_PRINCIPAL_RIGHT", "evidence_status": "NOT_COLLECTED", "reason_code": "DELEGATED_OUT_OF_SCOPE", "source_ref": "fictional-permissions", "limitations": [ "DELEGATED_OUT_OF_SCOPE" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "dimension": "DELEGATED_TENANTWIDE_RIGHT", "evidence_status": "NOT_COLLECTED", "reason_code": "DELEGATED_OUT_OF_SCOPE", "source_ref": "fictional-permissions", "limitations": [ "DELEGATED_OUT_OF_SCOPE" ] }, { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000012", "dimension": "OWNER_IDENTITY", "evidence_status": "NOT_COLLECTED", "reason_code": "IDENTITY_NOT_VERIFIED", "source_ref": "APPLICATION_CONTEXT", "limitations": [ "IDENTITY_NOT_VERIFIED" ] } ], "unknown_owners": [ { "tenant_key": "fictional-alpha", "application_id": "00000000-0000-4000-8000-000000000011", "display_name": "", "observed_state": "OBSERVED_ALLOWLISTED", "reason_code": "W_OWNER_UNKNOWN", "evidence_ids": [ "src-fictional-alpha-config", "src-fictional-alpha-permissions", "src-fictional-alpha-usage" ] } ] }