Skip to main content
This guide helps company users with Microsoft 365 read access and MSP staff find and read a Current Posture finding.

​
Before you start

​
Find a record

1

Read the metrics

Look at the detailed metrics under Your Microsoft 365 posture.
2

Pick a metric

Select a clickable metric to narrow Items needing attention to its finding type. Scroll to the findings table if it is out of view.
3

Search

Type a name or phrase in the Finding column filter. It also searches descriptions, identifiers, company or tenant text, and status or severity.
4

Page through results

The table shows 25 rows at first. You can switch to 10, 25, 50 or 100.
5

Open a finding

Click the row or its detail arrow to open the right-hand panel.
The finding-type badge above the table has Clear finding type filter, which removes the metric filter. Clear Filters resets the text filter separately. If a metric shows no rows after you were on a later page, go back to page 1 and select the metric again, because changing the metric keeps the page number.

​
Know which metrics open findings

Available metrics can open these related datasets: A metric is clickable only when it has evidence. Other metrics, such as managed devices, sign-in policies, active alerts, intercepted mail and failed sign-ins, do not open their records here, so a count can exist without a matching list. The full findings table can also hold Outdated sign-in methods, Admin access, Suspicious inbox rules, Shared mailboxes allowing sign-in and Critical software weaknesses. These are selected categories, not a complete inventory. Some rows are records for review, not proven problems. An Admin access row, for example, does not mean access is unsafe.

​
Read the detail panel

Read the name and description, then Provider context and Posture signal. Context can include Company, Tenant, Tenant domain, Category, Dataset and Enabled. Signal includes Status, Severity, Last synced and, when supplied, Observed in source. In the table, Status can show the severity label instead of the source status, so read the detail fields too. Unknown, or a missing description, means the source supplied too little to judge. It does not mean safe. Provider record IDs, source endpoints and the raw Source payload need integration-settings read access. The panel is not a settings editor. Close it with the close button or Escape.

​
What this table does not offer

Current Posture has no CSV or PDF export, bulk actions, manual sorting, Status or Severity dropdown, or date selector. Use the Finding search and the metric filters. The Type and Status columns are labels, not filters. The per-company page has no Company column or filter. Company users start with the Home AI Assistant for help; include the finding and timestamps. MSP staff can review or reopen a finding when permitted.

​
Troubleshooting

​
Frequently asked questions

Only metrics with available evidence and a supported finding dataset are clickable. Other metrics are summary-only.
No. It opens the same People without MFA dataset as the coverage metric. That list is not an exact drilldown of the admin count.
It came from a metric selection. Use Clear finding type filter on its badge to remove it; Clear Filters handles the table text filter separately.
Metric selection currently preserves the page number. Return to page one and select the metric again before concluding there are no matching findings.
No. The current reader offers Finding text search and supported metric-driven finding-type filters, not separate Type or Status dropdowns.
This table has no CSV or PDF export. Secure Score has a separate management-permission CSV workflow.
No. The table contains curated source categories and review items. Admin access or a suspicious-rule category alone is not proof of malicious activity.
Provider IDs, endpoints and payload details require integration-settings read access. Normal Company readers do not receive that management detail.