{
  "schemaVersion": "1.0",
  "generatedAtUtc": "2026-09-12T00:14:22.5819282Z",
  "sourceRunTimestampUtc": "2026-09-12T00:07:46.9339475Z",
  "sourceOverallStatus": "CompleteForListedGraphScopes",
  "sourceReadOnly": true,
  "cloudOperationsByThisExporter": 0,
  "auditExecutionContext": {
    "graphMethodsImplementedByAudit": [
      "GET"
    ],
    "administrativeTokenRetainedBootstrapWriteScopes": true,
    "meaning": "Execution was read-only; the administrative token was not limited to read scopes. Operator action scopes were unchanged."
  },
  "sourceEvidence": {
    "file": "readiness-audit-complete.json",
    "sha256": "703e20a552fbed4bb232f96abf79e221f6f40f5e21f881243b79bf75e82bbfe5"
  },
  "completeCollectionScans": 8,
  "totalCollectionScans": 8,
  "completePrincipalChecks": 5,
  "totalPrincipalChecks": 5,
  "collections": [
    {
      "label": "Role definitions",
      "sourceScan": "RoleDefinitions",
      "scanStatus": "Complete",
      "observedObjects": 145,
      "authoritativeObjectCount": 145,
      "completedPages": 1
    },
    {
      "label": "Active directory-role assignments",
      "sourceScan": "ActiveRoleAssignments",
      "scanStatus": "Complete",
      "observedObjects": 9,
      "authoritativeObjectCount": 9,
      "completedPages": 1
    },
    {
      "label": "Directory-role eligibility instances",
      "sourceScan": "RoleEligibilityInstances",
      "scanStatus": "Complete",
      "observedObjects": 0,
      "authoritativeObjectCount": 0,
      "completedPages": 1
    },
    {
      "label": "Conditional Access policies (v1.0)",
      "sourceScan": "ConditionalAccessV1",
      "scanStatus": "Complete",
      "observedObjects": 1,
      "authoritativeObjectCount": 1,
      "completedPages": 1
    },
    {
      "label": "Conditional Access policies (beta)",
      "sourceScan": "ConditionalAccessBeta",
      "scanStatus": "Complete",
      "observedObjects": 1,
      "authoritativeObjectCount": 1,
      "completedPages": 1
    },
    {
      "label": "Groups",
      "sourceScan": "Groups",
      "scanStatus": "Complete",
      "observedObjects": 10,
      "authoritativeObjectCount": 10,
      "completedPages": 1
    },
    {
      "label": "Administrative units (beta)",
      "sourceScan": "AdministrativeUnitsBeta",
      "scanStatus": "Complete",
      "observedObjects": 0,
      "authoritativeObjectCount": 0,
      "completedPages": 1
    },
    {
      "label": "Access-package assignment policies",
      "sourceScan": "AccessPackageAssignmentPolicies",
      "scanStatus": "Complete",
      "observedObjects": 0,
      "authoritativeObjectCount": 0,
      "completedPages": 1
    }
  ],
  "principalChecks": [
    {
      "label": "Ordinary target",
      "completed": true,
      "transitiveActiveRolesStatus": "Complete",
      "transitiveActiveRoleCount": 0,
      "transitiveGroupStatus": "Complete",
      "transitiveGroupCount": 1,
      "directoryEligibilityCheckComplete": true,
      "directoryEligibilityInstancesObserved": 0,
      "userStateReadComplete": true,
      "groupPimEligibilityStatus": "NotCovered"
    },
    {
      "label": "Global Reader target",
      "completed": true,
      "transitiveActiveRolesStatus": "Complete",
      "transitiveActiveRoleCount": 1,
      "transitiveGroupStatus": "Complete",
      "transitiveGroupCount": 1,
      "directoryEligibilityCheckComplete": true,
      "directoryEligibilityInstancesObserved": 0,
      "userStateReadComplete": true,
      "groupPimEligibilityStatus": "NotCovered"
    },
    {
      "label": "Security Administrator operator",
      "completed": true,
      "transitiveActiveRolesStatus": "Complete",
      "transitiveActiveRoleCount": 1,
      "transitiveGroupStatus": "Complete",
      "transitiveGroupCount": 1,
      "directoryEligibilityCheckComplete": true,
      "directoryEligibilityInstancesObserved": 0,
      "userStateReadComplete": true,
      "groupPimEligibilityStatus": "NotCovered"
    },
    {
      "label": "SOC Identity Responder operator",
      "completed": true,
      "transitiveActiveRolesStatus": "Complete",
      "transitiveActiveRoleCount": 1,
      "transitiveGroupStatus": "Complete",
      "transitiveGroupCount": 0,
      "directoryEligibilityCheckComplete": true,
      "directoryEligibilityInstancesObserved": 0,
      "userStateReadComplete": true,
      "groupPimEligibilityStatus": "NotCovered"
    },
    {
      "label": "Security Operator operator",
      "completed": true,
      "transitiveActiveRolesStatus": "Complete",
      "transitiveActiveRoleCount": 1,
      "transitiveGroupStatus": "Complete",
      "transitiveGroupCount": 1,
      "directoryEligibilityCheckComplete": true,
      "directoryEligibilityInstancesObserved": 0,
      "userStateReadComplete": true,
      "groupPimEligibilityStatus": "NotCovered"
    }
  ],
  "dynamicGroupsObserved": 0,
  "memberOfCandidateScans": [
    {
      "label": "Groups",
      "scanStatus": "Complete",
      "candidatesObserved": 0,
      "authoritativeCandidateCount": 0
    },
    {
      "label": "Administrative units (beta)",
      "scanStatus": "Complete",
      "candidatesObserved": 0,
      "authoritativeCandidateCount": 0
    },
    {
      "label": "Access-package assignment policies",
      "scanStatus": "Complete",
      "candidatesObserved": 0,
      "authoritativeCandidateCount": 0
    }
  ],
  "conditionalAccessRiskCandidateScans": [
    {
      "label": "Conditional Access policies (v1.0)",
      "scanStatus": "Complete",
      "candidatesObserved": 0,
      "authoritativeCandidateCount": 0
    },
    {
      "label": "Conditional Access policies (beta)",
      "scanStatus": "Complete",
      "candidatesObserved": 0,
      "authoritativeCandidateCount": 0
    }
  ],
  "conditionalAccessPolicyStates": [
    {
      "state": "disabled",
      "observedPolicyCount": 1
    }
  ],
  "legacyRiskPolicies": {
    "automatedScriptStatus": "ManualReviewRequired",
    "separateManualUiReview": {
      "userRiskPolicy": "Disabled",
      "signInRiskPolicy": "Disabled",
      "retirementBannerDate": "2026-10-01",
      "sourceScreenshots": [
        {
          "file": "06-legacy-user-risk-retirement.png",
          "sha256": "cf037286d6ecb06e801a36e10c8906a5f89d012934484892a57d0826cf4e166e"
        },
        {
          "file": "07-legacy-signin-risk-retirement.png",
          "sha256": "7d6b31b8ad1bdea377baeb56837b9ac7209ca7f3efc2286e332ee017e014bb03"
        }
      ],
      "verificationBasis": "Separate administrator UI review and captured screenshots; not inferred from Graph Conditional Access inventory."
    }
  },
  "limitations": [
    "Point-in-time configuration inventory; no migration, risk remediation, or membership-equivalence test was performed by this audit.",
    "Directory-role eligibility coverage does not include PIM eligibility for group membership or ownership.",
    "Beta Conditional Access and administrative-unit APIs are explicitly used and may change.",
    "Zero memberOf candidates is supported only for the completely scanned listed surfaces; this is not a claim that no access-governance risks exist.",
    "The automated audit leaves legacy policies as ManualReviewRequired; the separate UI review supplies their enabled/disabled state.",
    "Counts include the isolated lab fixtures present during the run; they are not a post-cleanup inventory.",
    "The coordinating administrator received additional read scopes for this audit; the separate operator action-test scopes were unchanged."
  ],
  "sanitization": "Only labels, counts, statuses, timestamps, screenshot/source filenames, and checksums are exported. Directory IDs, UPNs, policy/group names, tokens, and credentials are omitted."
}