TRANSPARENCY · UPDATED 2026-04-18
Every governance tool makes a choice about what to detect. Most vendors don't publish that list because it exposes gaps.
We publish ours because governance tools are sold on trust, not feature-count.
Below is a complete, honest inventory of the 74 specific signals our 6 assessments detect, and the 18 things we do not currently check.
Our principle
Under-promise coverage. Over-deliver on accuracy. If we're not confident a finding is real, we either raise the confidence threshold or we don't surface it at all.
What we check (74 signals across 6 modules)
Each module is a read-only Microsoft Graph + SharePoint REST + Power Platform BAP scan. No writes. No impersonation. No long-lived tokens stored outside encrypted credential store.
What we don't check (and why)
These gaps are intentional. Most are planned for future releases; some we've decided are better handled by specialized tools you already own.
Known gaps
- Defender XDR telemetry. We don't pull signals from Defender for Endpoint, Defender for Cloud Apps, or Defender for Identity. You already have the Defender portal for this. Mixing our signal with Defender's would double-count.
- Exchange Online mail flow rules. We detect DLP coverage and mailbox provisioning but do not audit transport rules, journaling, or anti-spam policies. A dedicated mail compliance review covers this better.
- Intune device posture. We report whether Conditional Access enforces device compliance, but do not inspect per-device compliance state, app protection policies, or enrollment mode. Intune Admin Center is authoritative here.
- Restricted Content Discovery (RCD) propagation. We detect whether RCD is enabled, but Microsoft's API does not expose propagation progress for sites >500K items. We report the flag; we cannot report whether it has actually taken effect on every site.
- Power BI admin details. Dataset + workspace inventory requires Power BI admin API access separate from BAP. We flag this as "v2" in the Dependency Graph output. Current scan does not include Power BI.
- Microsoft Forms. Forms API does not expose form-to-SP linkage centrally. Flagged as "v2" — we rely on SharePoint-side detection only.
- Viva Connections dashboard cards. No public API coverage. Flagged as "v2".
- SharePoint term store & site scripts. We detect classic pages and workflows, not managed metadata service consumption or site-script usage. Modernization Engine is getting this in a future release.
- Email journaling / EV / Mimecast archives. Outside current scope. Planned as a dedicated assessment.
- Content classification accuracy. We detect whether sensitivity labels are deployed. We do NOT attempt to audit whether any given document is correctly classified. That requires content inspection beyond governance-posture scope.
- Specific compliance certifications. We do not audit HIPAA, FedRAMP, PCI-DSS, SOX, or other regulatory framework adherence. Microsoft's Compliance Manager is designed for this.
- Application dependencies outside M365. We scan Power Automate flows and Power Apps. We do NOT scan third-party SaaS integrations, SCIM provisioning targets, or non-Microsoft OAuth consumers.
- License cost optimization. We detect waste (unassigned paid licenses) but do not produce "you could save $X by downgrading Y" cost-optimization reports. Dedicated M365 cost tools do this better.
- End-user Copilot usage analytics. We measure readiness, not usage. Microsoft's Copilot adoption dashboard in the admin center covers per-user usage once enabled.
- Real-time tenant monitoring. Continuous Monitoring runs monthly, not in real time. Expect 24+ hours between when a change happens and when our next scheduled scan reflects it.
- Remediation execution. Except for SharePoint restructuring and OneDrive cleanup wizards, we do not auto-apply fixes. Findings tell you what to do; your admin runs the PowerShell.
- Multi-tenant federation / Entra External ID. We scan a single tenant at a time. Cross-tenant federation health (B2B trust direction, outbound sharing posture to federated partners) is not in scope.
- Azure infrastructure beyond M365. We are M365-scoped. Azure subscription inventory, VNet peering, Key Vault policy — out of scope.
How we handle uncertainty
When a signal requires a permission the scanning service principal doesn't have (e.g., Power Platform Admin but missing Env Admin), we emit a manual-verification finding with a deep link to the admin portal. We don't fabricate a result. Same for Microsoft APIs that are unreliable or under-documented — we'd rather flag "we couldn't verify this" than guess.
Every finding will eventually carry a Confidence Score (High / Medium / Low) based on the underlying API reliability, scope of evidence, and known edge cases. Tracked issue; shipping in the next governance release.
What we don't sell
- Your data. Scan results are stored encrypted per-tenant. We do not train models on them, share them with partners, or use them in aggregate analytics. Ever.
- Contact-us pricing. CA$399 single assessment. CA$1,599 bundle. Published. One-time. No renewals you'll forget.
- Upsell calls. There is no sales motion. You buy with a credit card. You email support@migrationfox.com if you have a question.
- Multi-year commits. 90-day access window per purchase. Buy again if you need another scan.
Ready to run a free snapshot?
View-only, 1 scan/month per product. No credit card. See exactly what we detect on your own tenant.
Start free snapshot →
Last updated: April 18, 2026 ·
Spot something missing or inaccurate? Email support@migrationfox.com