Run metadata
- Output schema
- ews-audit-output/v3
- HTML artifact version
- ews-tenant-evidence-html/v3
- Binary version
- 0.3.0-rc.2
- Policy model version
- ews-policy-model/v1
- Run fingerprint
- e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077
- As of UTC
- 2026-08-10T12:00:00Z
Mailbox aggregate
- Mailbox EWS true
- 1
- Mailbox EWS false
- 2
- Mailbox EWS null
- 3
- Mailbox total
- 6
This aggregate does not map an application to a mailbox.
Sources
| Evidence ID | Kind | SHA-256 | Status |
|---|
| src-decisions | decisions | 45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5 | OBSERVED_COMPLETE |
| src-fictional-alpha-collector | collector_manifest | 42dc2c595dccbdb5b38153d98ab980aac7c60ef4fdcbaf3f2c247f1edf96886c | OBSERVED_COMPLETE |
| src-fictional-alpha-config | organization_config_v2 | 4751de9de09299b2767bd501326d6a4b94d0fb646d2c2ed17cf319353874eef3 | OBSERVED_COMPLETE |
| src-fictional-alpha-mailbox | mailbox_override_summary | 1a0469507a52654d82039a01b9c558c46ee7edf6f0722b804918f89a011564fa | OBSERVED_COMPLETE |
| src-fictional-alpha-permissions | permission_evidence | 21181dd921b109fbcdd2e06eca94163d4f292ac29399608639165110e639c189 | OBSERVED_COMPLETE |
| src-fictional-alpha-usage | usage | 4272adf23dde9b7d74aea146226304bba30818f3203625bf153b1506751b2d5e | OBSERVED_COMPLETE |
Applications
| Application ID | Display name | Observed owner | Ownership verification |
|---|
| 00000000-0000-4000-8000-000000000011 | Unknown application | NOT_OBSERVED | NOT_VERIFIED |
| 00000000-0000-4000-8000-000000000012 | Unknown application | NOT_OBSERVED | NOT_VERIFIED |
Usage
| Application ID | SOAP action | Window | Calls | Last activity UTC |
|---|
| 00000000-0000-4000-8000-000000000011 | GetItem | 90 | 7 | 2026-08-10 10:00:00 +0000 UTC |
Permission reconciliation
| Application ID | Usage | App-only | Tenant-wide delegated | Principal delegated | Quadrant |
|---|
| 00000000-0000-4000-8000-000000000011 | OBSERVED_IN_WINDOW | OBSERVED | UNKNOWN | UNKNOWN | USES_WITH_OBSERVED_RIGHT |
| 00000000-0000-4000-8000-000000000012 | NOT_OBSERVED_IN_WINDOW | OBSERVED | UNKNOWN | UNKNOWN | RIGHT_WITHOUT_OBSERVED_USAGE |
Organization policy model
| Phase | Application ID | EWS enabled | List | Membership | Modeled outcome | Rule |
|---|
| ENFORCEMENT_TARGET | 00000000-0000-4000-8000-000000000011 | TRUE | POPULATED | PRESENT | MODELED_ALLOWED | ENF-TRUE-LISTED |
| ENFORCEMENT_TARGET | 00000000-0000-4000-8000-000000000012 | TRUE | POPULATED | ABSENT | MODELED_BLOCKED | ENF-TRUE-UNLISTED |
| PRE_ENFORCEMENT | 00000000-0000-4000-8000-000000000011 | TRUE | POPULATED | PRESENT | MODELED_ALLOWED | PRE-TRUE-LISTED |
| PRE_ENFORCEMENT | 00000000-0000-4000-8000-000000000012 | TRUE | POPULATED | ABSENT | MODELED_BLOCKED | PRE-TRUE-UNLISTED |
Findings
| ID | Application ID | State | Severity | Explanation |
|---|
| finding-fictional-alpha-00000000-0000-4000-8000-000000000011-observed_allowlisted | 00000000-0000-4000-8000-000000000011 | OBSERVED_ALLOWLISTED | INFO | R_OBSERVED_ALLOWLISTED |
| finding-fictional-alpha-00000000-0000-4000-8000-000000000012-observed_not_allowlisted | 00000000-0000-4000-8000-000000000012 | OBSERVED_NOT_ALLOWLISTED | REVIEW | R_OBSERVED_NOT_ALLOWLISTED |
Decisions
| Application ID | Decision | Review status | Owner | Target date |
|---|
| 00000000-0000-4000-8000-000000000011 | keep | REVIEWED | fictional-owner-alpha | 2026-09-01 |
Configuration proposals
| Application ID | Target state | Desired membership | Eligibility | Decision | Review status |
|---|
| 00000000-0000-4000-8000-000000000011 | NO_TARGET | UNSPECIFIED | BLOCKED | keep | REVIEWED |
| 00000000-0000-4000-8000-000000000012 | NO_TARGET | UNSPECIFIED | BLOCKED | | |
Unknown evidence
| Application ID | Dimension | Status | Reason |
|---|
| 00000000-0000-4000-8000-000000000011 | DELEGATED_PRINCIPAL_RIGHT | NOT_COLLECTED | DELEGATED_OUT_OF_SCOPE |
| 00000000-0000-4000-8000-000000000011 | DELEGATED_TENANTWIDE_RIGHT | NOT_COLLECTED | DELEGATED_OUT_OF_SCOPE |
| 00000000-0000-4000-8000-000000000011 | OWNER_IDENTITY | NOT_COLLECTED | IDENTITY_NOT_VERIFIED |
| 00000000-0000-4000-8000-000000000012 | DELEGATED_PRINCIPAL_RIGHT | NOT_COLLECTED | DELEGATED_OUT_OF_SCOPE |
| 00000000-0000-4000-8000-000000000012 | DELEGATED_TENANTWIDE_RIGHT | NOT_COLLECTED | DELEGATED_OUT_OF_SCOPE |
| 00000000-0000-4000-8000-000000000012 | OWNER_IDENTITY | NOT_COLLECTED | IDENTITY_NOT_VERIFIED |
Unknown owners
| Application ID | Display name | Observed state | Reason |
|---|
| 00000000-0000-4000-8000-000000000011 | | OBSERVED_ALLOWLISTED | W_OWNER_UNKNOWN |
Full-replace warning
Configuration proposals are review-only full-set replacements. No change is authorized or executed by this artifact.
- REVIEW_CURRENT_FULL_SET
- REVIEW_ADD_DELTA
- REVIEW_REMOVE_DELTA
- REVIEW_LEGACY_POLICY
- REVIEW_MAILBOX_LIMITATIONS
- AUTHORIZE_CHANGE_OUTSIDE_PRODUCT
Required non-claims
This is a dated evidence-based model. It is not complete EWS discovery; it is not a live authorization test; it is not exact application-to-mailbox mapping; it is not production-safe allowlisting; it is not outage prevention; it is not Microsoft certification; and it is not proof of migration readiness.