Run metadata
- Output schema
- ews-audit-output/v3
- HTML artifact version
- ews-tenant-evidence-html/v3
- Binary version
- 0.3.0-rc.2
- Policy model version
- ews-policy-model/v1
- Run fingerprint
- e8b0c9535daefa375f7ce76ca68386ca2f4e9ca2bcdef9a66d9b408af01d1077
- As of UTC
- 2026-08-10T12:00:00Z
Mailbox aggregate
- Mailbox EWS true
- 1
- Mailbox EWS false
- 2
- Mailbox EWS null
- 3
- Mailbox total
- 6
This aggregate does not map an application to a mailbox.
Sources
| Evidence ID | Kind | SHA-256 | Status |
|---|
| src-decisions | decisions | 45e614cb56e372056df83ad4b664508ff873376fad976a9f37b411cfde7789c5 | OBSERVED_COMPLETE |
| src-fictional-gamma-collector | collector_manifest | af60eb929414b66c80d9180ba6ee439c84153852589f4ac7fb38f972c71ed565 | OBSERVED_COMPLETE |
| src-fictional-gamma-config | organization_config_v2 | 5559d2e18ee12b4980f069bf248e7528f464a2e139ab0d84fa2091b1ebbdad88 | OBSERVED_COMPLETE |
| src-fictional-gamma-mailbox | mailbox_override_summary | 43f847a19bc80b76f0e579b6c1fc188a9a42d20f9824a0b93ef31741891ec482 | OBSERVED_COMPLETE |
| src-fictional-gamma-permissions | permission_evidence | 287bd705e56e7b1ac76da83e635d3c0f53c47d6fd529dafc4b7af359aaaedf6f | OBSERVED_COMPLETE |
| src-fictional-gamma-usage | usage | 3f95d31ab41b29a18737dc79b6fa13bbbbc5a763c6fc72f45c5db598c7376ac2 | UNAVAILABLE |
Applications
| Application ID | Display name | Observed owner | Ownership verification |
|---|
| 00000000-0000-4000-8000-000000000031 | Unknown application | NOT_OBSERVED | NOT_VERIFIED |
Usage
| Application ID | SOAP action | Window | Calls | Last activity UTC |
|---|
Permission reconciliation
| Application ID | Usage | App-only | Tenant-wide delegated | Principal delegated | Quadrant |
|---|
| 00000000-0000-4000-8000-000000000031 | UNKNOWN | OBSERVED | NOT_OBSERVED | OBSERVED | CANNOT_DETERMINE |
Organization policy model
| Phase | Application ID | EWS enabled | List | Membership | Modeled outcome | Rule |
|---|
| ENFORCEMENT_TARGET | 00000000-0000-4000-8000-000000000031 | NULL | UNKNOWN | UNKNOWN | CANNOT_DETERMINE | CANNOT-APPID-PARAMETER |
| PRE_ENFORCEMENT | 00000000-0000-4000-8000-000000000031 | NULL | UNKNOWN | UNKNOWN | CANNOT_DETERMINE | CANNOT-APPID-PARAMETER |
Findings
| ID | Application ID | State | Severity | Explanation |
|---|
| finding-fictional-gamma-00000000-0000-4000-8000-000000000031-observed_allowlist_unknown | 00000000-0000-4000-8000-000000000031 | OBSERVED_ALLOWLIST_UNKNOWN | REVIEW | W_ALLOWLIST_UNKNOWN |
Decisions
| Application ID | Decision | Review status | Owner | Target date |
|---|
| 00000000-0000-4000-8000-000000000031 | investigate | REVIEWED | fictional-owner-gamma | 2026-09-03 |
Configuration proposals
| Application ID | Target state | Desired membership | Eligibility | Decision | Review status |
|---|
| 00000000-0000-4000-8000-000000000031 | NO_TARGET | UNSPECIFIED | BLOCKED | investigate | REVIEWED |
Unknown evidence
| Application ID | Dimension | Status | Reason |
|---|
| 00000000-0000-4000-8000-000000000031 | APP_ID_MEMBERSHIP | UNAVAILABLE | ALLOWLIST_ORIGIN_NOT_OBSERVABLE |
| 00000000-0000-4000-8000-000000000031 | APP_ID_PARAMETER | UNAVAILABLE | APP_ID_PARAMETER_UNAVAILABLE |
| 00000000-0000-4000-8000-000000000031 | LEGACY_POLICY | UNAVAILABLE | LEGACY_POLICY_INTERACTION_UNRESOLVED |
| 00000000-0000-4000-8000-000000000031 | ORGANIZATION_POLICY | OBSERVED_COMPLETE | POLICY_INPUT_INCOMPLETE |
| 00000000-0000-4000-8000-000000000031 | OWNER_IDENTITY | NOT_COLLECTED | IDENTITY_NOT_VERIFIED |
| 00000000-0000-4000-8000-000000000031 | USAGE | UNAVAILABLE | USAGE_WINDOW_ONLY |
Unknown owners
| Application ID | Display name | Observed state | Reason |
|---|
Full-replace warning
Configuration proposals are review-only full-set replacements. No change is authorized or executed by this artifact.
- REVIEW_CURRENT_FULL_SET
- REVIEW_ADD_DELTA
- REVIEW_REMOVE_DELTA
- REVIEW_LEGACY_POLICY
- REVIEW_MAILBOX_LIMITATIONS
- AUTHORIZE_CHANGE_OUTSIDE_PRODUCT
Required non-claims
This is a dated evidence-based model. It is not complete EWS discovery; it is not a live authorization test; it is not exact application-to-mailbox mapping; it is not production-safe allowlisting; it is not outage prevention; it is not Microsoft certification; and it is not proof of migration readiness.