Security Baseline Integration Choices and Scan Context
The Prerequisites page contains only two optional integration-intent choices. They tell Calibrant what should happen if a Security Baseline cannot collect Fabric/Power BI or Power Platform evidence automatically. Leaving them unanswered does not block a scan, and a successful automatic collection does not ask you to confirm it again.
Who can answer
Workspace owners and administrators can save or replace answers. Members can see whether each answer is current, but cannot see the selected mode, explanation, evidence reference, person who answered, or exact answer time. Saved answers expire after 90 days and then need to be reconfirmed.
The two integration choices
How should this Security Checkup evaluate Microsoft Fabric and Power BI in this tenant?
Choose Automatic collection when the relay managed identity is in the security group allowed to use Fabric public/admin APIs. Choose Manual review when an owner or administrator will verify the Fabric controls outside Calibrant. Choose Not in use only when the tenant does not use Fabric or Power BI.
- Automatic collection — Calibrant expects the relay to obtain definitive evidence from the Microsoft API.
- Manual review — use this when an owner or administrator will verify the integration-dependent checks outside Calibrant. A nonblank explanation and evidence reference are required.
- Not in use — available only for Fabric/Power BI. Use it only when neither product is used in the tenant; a nonblank explanation and evidence reference are required.
How should this Security Checkup evaluate Microsoft Power Platform in this tenant?
Choose Automatic collection when the relay management application has the required Power Platform access. Choose Manual review when an owner or administrator will verify the Power Platform DLP control outside Calibrant.
- Automatic collection — Calibrant expects the relay to obtain definitive evidence from the Microsoft API.
- Manual review — use this when an owner or administrator will verify the integration-dependent checks outside Calibrant. A nonblank explanation and evidence reference are required.
Questions shown only after collection
A separate questionnaire is not shown before every scan. If returned Microsoft evidence cannot prove one exact detail, the result page pauses before publishing a score and asks only the affected question. Current examples are:
- What external sharing level is selected for OneDrive? In SharePoint admin center, open Policies → Sharing and read the OneDrive slider. Microsoft Graph does not expose this tenant setting, and Calibrant will not request SharePoint Administrator just to read it. Your answer is reused only while the collected SharePoint sharing level and Calibrant ruleset remain unchanged.
- Is Fabric guest access disabled or limited to approved security groups? Microsoft returned this Fabric setting as enabled but did not return its group scope. Check the matching tenant setting in the Fabric admin portal.
- Are Fabric external invitations disabled or limited to approved security groups? Microsoft returned this Fabric setting as enabled but did not return its group scope. Check the matching tenant setting in the Fabric admin portal.
- Is Fabric Publish to web limited to approved security groups? Microsoft returned Publish to web as enabled but did not return its included or excluded security groups. Check Tenant settings in the Fabric admin portal.
- Are Fabric organization-wide shareable links limited to approved security groups? Microsoft returned this link setting as enabled but did not return its included or excluded security groups. Check Tenant settings in the Fabric admin portal.
- Is Fabric external data sharing disabled or limited to approved security groups? Microsoft returned this Fabric setting as enabled but did not return its group scope. Check the matching tenant setting in the Fabric admin portal.
- Is Fabric API access for service principals limited to approved security groups? Microsoft returned this developer setting as enabled but did not return its group scope. Check Tenant settings in the Fabric admin portal.
- Is Fabric workspace creation by service principals limited to approved security groups? Microsoft returned this Fabric setting as enabled but did not return its group scope. Check Tenant settings in the Fabric admin portal.
The OneDrive sharing slider is handled this way because Microsoft Graph exposes the SharePoint tenant sharing level but not the separate OneDrive level. Calibrant deliberately does not request SharePoint Administrator just to read that slider. Fabric scope questions appear only when Microsoft reports a setting as enabled but omits whether it is limited to approved security groups. Power Platform or Fabric integration-fallback questions appear only when their automatic evidence is unavailable and no current intent choice already explains the gap.
A saved result-driven answer is reused only while the exact relevant Microsoft evidence and Calibrant ruleset are unchanged. If either changes, only that affected question is asked again. Until every requested answer is saved, the scan publishes no findings or score.
What happens when a scan runs
Calibrant freezes the integration-intent answers at launch. Editing today's answer later cannot rewrite an older scan. Automatic evidence can still make coverage complete when a choice was unanswered. When exact scan context is required, the unpublished snapshot is filled once by an owner or administrator before analysis resumes. The resulting coverage is labelled as follows:
| Result | Plain-English meaning | Living assessment/report |
|---|---|---|
| Complete | Definitive automatic and requested administrator context exists for every integration-dependent check, or an evidence-backed Fabric/Power BI Not in use decision applies. | May update the assessment and be used in comparisons and a printable report. |
| Provisional | A documented Manual review fallback applies to one or more evidence gaps. | Findings remain visible, but no assessment update, automatic comparison, or final report. |
| Failed | A technical collection or integrity requirement failed, or cloud/license evidence is unsupported or unverifiable. An answerable context gap pauses instead of publishing a failed partial result. | The scan has no completed result, score, assessment update, comparison, or printable report. |
| Framework license decision required | Automatic Microsoft evidence completed, but one or more linked-assessment controls lack a required native capability or an allowed documented compensating safeguard. | The exact controls and available treatments are shown. Evidence is retained, but the assessment is not updated until the decisions are resolved and a new scan runs. |
The label covers integration-dependent automatic checks only. Framework controls that are intentionally manual can remain Pending and require a normal assessment attestation without changing this integration coverage label.
Security Baseline assesses Calibrant's independently authored M365 Security Baseline and CISA SCuBA. CIS v6 references shown on Calibrant baseline controls are informational mapping aids only; they are not an official CIS Benchmark assessment, certification, or claim of CIS v7 coverage.
What to put in the evidence fields
The explanation should say what was verified, how, and who owns the follow-up. The evidence reference should point to something your organization can retrieve, such as a ticket, review record, or screenshot location. Do not enter passwords, access tokens, private keys, or other secrets.
Owners and administrators can review these choices at Security Scan Prerequisites.