Run metadata
- Output schema
- ews-audit-output/v3
- HTML artifact version
- ews-tenant-evidence-html/v3
- Binary version
- 0.3.0-rc.2
- Policy model version
- ews-policy-model/v1
- Run fingerprint
- e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077
- As of UTC
- 2026-08-10T12:00:00Z
Mailbox aggregate
- Mailbox EWS true
- 1
- Mailbox EWS false
- 2
- Mailbox EWS null
- 3
- Mailbox total
- 6
This aggregate does not map an application to a mailbox.
Sources
| Evidence ID | Kind | SHA-256 | Status |
|---|
| src-decisions | decisions | 45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5 | OBSERVED_COMPLETE |
| src-fictional-beta-collector | collector_manifest | 33daa965c5a34c18c3f6b6422667605db6943bc5c5d63689db17ad63193b62d2 | OBSERVED_COMPLETE |
| src-fictional-beta-config | organization_config_v2 | 7c2a58618f4a1a0edd4326efa306a272a3e9f36ddf087348a70437c8e571810a | OBSERVED_COMPLETE |
| src-fictional-beta-mailbox | mailbox_override_summary | 09796f6b1ac87b49dc1ef18bc2b15a43107280170bd7a2e2f7be87b60720585c | OBSERVED_COMPLETE |
| src-fictional-beta-permissions | permission_evidence | d4c3f4ee01e6d903bf299f0a604441d9575fc81f059f4691c508429e013bfbfb | OBSERVED_COMPLETE |
| src-fictional-beta-usage | usage | bc354c72e1ec9bd75775cd3f207e0f2df0fb2a7421c44a5f419d57265b09dde6 | OBSERVED_COMPLETE |
Applications
| Application ID | Display name | Observed owner | Ownership verification |
|---|
| 00000000-0000-4000-8000-000000000021 | Unknown application | NOT_OBSERVED | NOT_VERIFIED |
Usage
| Application ID | SOAP action | Window | Calls | Last activity UTC |
|---|
| 00000000-0000-4000-8000-000000000021 | FindItem | 90 | 11 | 2026-08-10 10:05:00 +0000 UTC |
Permission reconciliation
| Application ID | Usage | App-only | Tenant-wide delegated | Principal delegated | Quadrant |
|---|
| 00000000-0000-4000-8000-000000000021 | OBSERVED_IN_WINDOW | OBSERVED | OBSERVED | NOT_OBSERVED | USES_WITH_OBSERVED_RIGHT |
Organization policy model
| Phase | Application ID | EWS enabled | List | Membership | Modeled outcome | Rule |
|---|
| ENFORCEMENT_TARGET | 00000000-0000-4000-8000-000000000021 | NULL | EMPTY | ABSENT | MODELED_PHASED_BLOCK | ENF-NULL-ANY |
| PRE_ENFORCEMENT | 00000000-0000-4000-8000-000000000021 | NULL | EMPTY | ABSENT | MODELED_ALLOWED | PRE-NULL-ANY |
Findings
| ID | Application ID | State | Severity | Explanation |
|---|
| finding-fictional-beta-00000000-0000-4000-8000-000000000021-observed_not_allowlisted | 00000000-0000-4000-8000-000000000021 | OBSERVED_NOT_ALLOWLISTED | REVIEW | R_OBSERVED_NOT_ALLOWLISTED |
Decisions
| Application ID | Decision | Review status | Owner | Target date |
|---|
| 00000000-0000-4000-8000-000000000021 | migrate | REVIEWED | fictional-owner-beta | 2026-09-02 |
Configuration proposals
| Application ID | Target state | Desired membership | Eligibility | Decision | Review status |
|---|
| 00000000-0000-4000-8000-000000000021 | NO_TARGET | UNSPECIFIED | BLOCKED | migrate | REVIEWED |
Unknown evidence
| Application ID | Dimension | Status | Reason |
|---|
| 00000000-0000-4000-8000-000000000021 | OWNER_IDENTITY | NOT_COLLECTED | IDENTITY_NOT_VERIFIED |
Unknown owners
| Application ID | Display name | Observed state | Reason |
|---|
| 00000000-0000-4000-8000-000000000021 | | OBSERVED_NOT_ALLOWLISTED | W_OWNER_UNKNOWN |
Full-replace warning
Configuration proposals are review-only full-set replacements. No change is authorized or executed by this artifact.
- REVIEW_CURRENT_FULL_SET
- REVIEW_ADD_DELTA
- REVIEW_REMOVE_DELTA
- REVIEW_LEGACY_POLICY
- REVIEW_MAILBOX_LIMITATIONS
- AUTHORIZE_CHANGE_OUTSIDE_PRODUCT
Required non-claims
This is a dated evidence-based model. It is not complete EWS discovery; it is not a live authorization test; it is not exact application-to-mailbox mapping; it is not production-safe allowlisting; it is not outage prevention; it is not Microsoft certification; and it is not proof of migration readiness.