What the report gives you
- Calculated score out of 100
- Prioritized critical, high, medium, and informational findings
- Signal coverage notes for unavailable permissions or optional modules
- A self-contained HTML scorecard for sharing the evidence
Free / read-only / M365
Run the scan. Understand the evidence. Fix what matters.
SecureGauge gives you a 100-point posture score, a screenshot-ready HTML report, and clear notes about coverage that was unavailable. The scanner is the first step; remediation comes after evidence.
No write permissions. No tenant changes. No credit card.
illustrative report
PS C:\> .\SecureGauge.ps1 -ShowReport
Reading approved posture signals…
Read-only scan complete.
Illustrative scorecard
82/100
Identity evidenceAvailable
Forwarding checkUnavailable
Sharing checkAvailable
Illustrative only. Scores and findings reflect the signals available to a real scan; unavailable optional checks are reported rather than guessed.
Phase 2 / Understand findings
Know exactly what the score covers.
The Graph baseline provides identity evidence. Exchange Online and SharePoint Online signals are optional and explicitly marked when they cannot run.
Graph baseline
MFA registration coverage
Reports Microsoft Graph evidence for MFA registration coverage.
Graph baseline
Direct admin account activity
Flags enabled, directly assigned high-impact Entra admin accounts without a recent successful sign-in signal.
Optional EXO
Mailbox forwarding
Reads mailbox-level forwarding when the optional Exchange Online check is available. It does not claim to inventory inbox rules.
Optional SPO
External sharing policy
Reads tenant and site sharing policy when the optional SharePoint Online check is available. It does not enumerate every link or file.
Permission boundary
Read the tenant. Change nothing.
SecureGauge requests delegated Microsoft Graph read permissions. It never creates, updates, deletes, remediates, or changes tenant configuration.
Graph delegated scopes
User.Read.All
Directory.Read.All
AuditLog.Read.All
Reports.Read.All
RoleManagement.Read.Directory
Optional Exchange Online and SharePoint Online checks are marked unavailable when they cannot be read. An unavailable signal is not treated as a finding.
Next step after your score
Critical and high findings come first.
Use the report to separate available evidence from unavailable optional checks. Then review the matching download, if one is currently available, before making any tenant change.
Phase 3 / Fix findings
Prioritize the evidence, then choose the next action.
This panel only links to downloads currently available in the live catalog. Unavailable checks or missing remediation coverage are called out plainly.
Identity / admin exposure
Use this when the report calls out MFA coverage or direct privileged-account activity.
Checking available downloads…
Exchange forwarding
Available only when the optional Exchange Online forwarding check ran.
Checking available downloads…
SharePoint / OneDrive sharing
Available only when the optional SharePoint Online sharing check ran.
Checking available downloads…
Need a broader review? Send the report evidence to your existing security or Microsoft 365 support contact.
Get support