Frequently Asked Questions

Straight answers about scoring, supported Microsoft 365 tenants, and what access the customer-hosted relay receives.

Why does Calibrant sometimes ask for administrator context after a scan?

A Microsoft API can show that a policy exists, but often cannot prove that the policy covers every intended user and application, that an exclusion is justified, or that a third-party process provides the intended result. Calibrant first collects the Microsoft evidence and then asks only for the missing decision. Each control is scored once from the combined evidence.

A product proven unlicensed is excluded without lowering the score. A machine-confirmed foundation failure cannot be turned into a pass by answering Yes. When context is required, the scan pauses without a score until an owner or administrator answers; technical collection failures remain visible and cannot be explained away.

Will I have to answer the same Healthcheck context on every scan?

No. Stable Tenant Context is eligible for reuse for up to 90 days. A scan-specific answer is saved and reused when the later scan returns the same relevant Microsoft evidence under the same Calibrant evaluation version. If the evidence changes, Calibrant asks again only for the affected control rather than silently applying an answer to a different configuration.

A material change to Calibrant's related evaluation logic also requires reconfirmation. An answer created before evidence-based reuse was introduced may therefore be requested once under the new process; after that, unchanged evidence is reused normally. Clearing a saved answer also stops future reuse without changing any completed historical audit.

Why can Security Baseline withhold an assessment after collection completed?

A linked framework can require Microsoft capabilities the tenant does not have. That is a licensing decision, not a missing relay result. Calibrant labels it separately, names every affected control, and explains whether the control requires native Microsoft licensing or permits an evidenced third-party safeguard. The collected evidence remains available, but no final assessment is published until the required decisions are resolved and a new scan runs.

The result's resolution link opens a focused list containing only the affected controls—not every still-pending control in the framework. Add the missing Microsoft capability, or, where the framework explicitly permits it, document the equivalent third-party safeguard separately for each control. If neither exists, leave the item unresolved; it cannot be bypassed with a generic note. After the licensing or safeguard requirements are met, run a new scan to publish the assessment.

Which Microsoft 365 tenants can use Calibrant?

Tenant Healthcheck and Security Baseline currently support Microsoft's worldwide commercial cloud only. GCC, GCC High, DoD, China/21Vianet, and other sovereign or national clouds are not supported yet.

This limit applies to every Calibrant plan and the free trial. Support for another cloud will be announced only after its endpoints, licensing, permissions, and checks have been separately tested.

Are the relay's Microsoft permissions read-only?

The relay's 18 tenant-wide Microsoft Graph application roles and Global Reader directory role are read-only. They cannot change tenant settings, but read-only is not the same as narrow. Some roles can read more source information than a single Calibrant check needs. For example, the access-review role can read every review, reviewer, decision, and setting across the tenant.

Calibrant's compiled collector returns only the small result needed for each check. For access reviews, that means aggregate coverage rather than names, reviewers, or individual decisions. This data minimization reduces what leaves the customer VM; it does not reduce what Microsoft allows the Managed Identity to read. Protect the relay VM and identity as a privileged reader.

What is different about the optional Power Platform registration?

Microsoft does not provide a read-only version of its Power Platform management registration. Calibrant issues only fixed read requests, but Microsoft grants that registration broader administrative access. It is optional and is not created unless the customer explicitly enables it. Declining it leaves the related controls not evaluated rather than granting Calibrant more access.

Read the complete permission and data-minimization boundary and the exact relay permission list before granting access.