Scans, findings and freshness
How scans run after consent, how findings stay stable, and how a not-read result differs from a failing one.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Need a hands-on starting point?
Start with one tenant or talk to the team if you want help evaluating fit, permissions, or rollout approach.
Consent before any scan
TenantVigil refuses to start a scan for a tenant without live Microsoft consent. The onboarding page also confirms consent with the server before the first scan begins.
A failed first scan can come from missing permissions, Microsoft throttling or a tenant-side problem. Incomplete consent is shown as incomplete, not as a failed scan.
How scans run
Scans run as durable jobs with bounded retries. Scheduled and on-demand scans share the same admission, and every scan a person starts goes through the scan limits.
A full scan evaluates the catalogue and stores findings and evidence. A paid customer can also refresh one control without waiting for the next full scan.
Reading a result
A finding is each check's latest result, including single-check refreshes since the customer's latest full scan. The scan time and the check's own read time stay separate.
A check TenantVigil could not read is not a real warning. It shows not read with the reason, earns no score, and is never counted as passing. When no check could be read, the score shows Not scored, never a number.
Freshness
Each finding carries its own source and read time. Reports and evidence packs use stored scan results with their data-as-of time.
A missing or old source stays a limit on what the result can tell you. Review the source time before you act on a finding.
Next action
Investigate incidents with scoped evidence, or plan the change for a finding.
- Investigate an incident and coordinate response
- Plan a change and read its receipt