Detailed Report

Generated 2026-10-08 │ Tenants: Zava Demo, Contoso Retail, Fabrikam Engineering

Executive Summary

This report is designed for security administrators, IT operations teams, and SOC analysts who need granular visibility into every security finding in their Microsoft Entra environment. It provides a searchable, entity-level breakdown of all findings with technical descriptions, remediation steps, compliance mappings, and portal links.

How this data was obtained: the Siemserva auditor read this tenant's Microsoft 365, Intune, Defender, and Entra ID configuration directly through Microsoft's official cloud APIs: Microsoft Graph (identities, roles, Conditional Access, applications, Intune devices and policies, and sign-in and audit logs) and the Microsoft Defender for Endpoint vulnerability management API. Patch and vulnerability findings are enriched with public threat intelligence (MSRC, CISA KEV, EPSS, NVD). Access is read-only; nothing in the environment was changed during the audit. Findings reflect the environment as of the audit date shown in the report header.

Siemserva's audit discovered 22 findings across 3 tenants, spanning 18 unique check types and 36 affected entities. The largest concentration — 132% (29 findings) — is in General Security, making it the primary area to investigate. Estimated total remediation effort is ~1.4–2.6 business days.

Immediate Attention: 7 findings are rated Critical or High and should be addressed first. Critical findings concentrate in General Security (2). Scroll to the Findings by Entity table for a searchable drill-down, or use the Detail Reference below for step-by-step remediation.

Quick Wins: 2 High or Critical finding types can be resolved in under 30 minutes each, providing fast, measurable risk reduction.

2Critical
5High
8Medium
7Low

Severity Overview

2 5 8 7 Critical (2) High (5) Medium (8) Low (7)
Unique Checks
18
18 of 676 check types produced findings
Affected Entities
36
Users, devices, apps, or groups with findings
Tenants
3
Microsoft Entra tenants audited
Total Remediation
1.4–2.6 business days
Estimated wall-clock time to fix all findings
Critical
High
Medium
Low
Info (advisory)

Siemserva Risk Heatmap

Healthy Low Medium High Critical 86 Critical

Critical — severe security gaps detected that require immediate action.

The Siemserva Risk Heatmap is a deterministic risk score (0-100, higher is worse) computed the same way in every Siemserva report: no AI, no sampling, no external data. The worst severity present places the score in a band (Critical 85-100, High 65-84, Medium 40-64, Low 20-39, Healthy below 20), and within the band the score rises with the count of worst-tier findings on a saturation curve, so the first few findings have the most impact.

AI Risk Assessment AI Enhanced

Healthy Low Medium High Critical 72 High

Critical — AI assessment: severe gaps, immediate action required.

The AI Risk Assessment is an independent evaluation performed by a large language model that reads every finding in this audit. Unlike the deterministic Heatmap above, the AI considers contextual factors that a formula cannot — such as how findings combine to form attack chains, whether a misconfiguration exposes privileged accounts or sensitive data, and the blast radius of each gap across your tenant. The AI assessed risk at 72, lower than the Siemserva Risk Heatmap score of 86. This can happen when the AI considers compensating controls or partial mitigations that the deterministic formula does not account for. The severity band above uses 86 (the Senserva floor) because it is grounded in actual finding counts and severity distribution. Together, the two gauges give you both an objective, repeatable baseline and contextual intelligence about the real-world severity of your security posture.

Top Priorities

1. Critical Device has one or more vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. — 2 affected ~45m×2 = 1h 30m (patch device for KEV-listed vulnerability) Patch & Vulnerability: missing patches, device CVEs, vulnerable software, end-of-life
Defender for Endpoint's machinesVulnerabilities feed shows this device has at least one CVE present in CISA's KEV catalog. KEV CVEs have confirmed in-the-wild exploitation, so unpatched devices are at immediate risk. The affected products and CVE list are in the finding description.
Action: Patch the affected products immediately. The fix may be a Windows KB, a third-party application update, or a firmware update depending on the product. Cross-reference the CVE IDs in the description against vendor advisories. Treat these as the highest-priority devices in the patch queue.
  1. Read the finding text first: it names the affected device and the specific missing KB article or CVE ids Defender for Endpoint reported, so you know exactly what to install and why it matters (KEV means the vulnerability is being exploited in the wild).
  2. Look the KB up in the Microsoft Update Guide (link below) if you want the full list of CVEs it fixes before deploying.
  3. Deploy the update: in the Intune admin center go to Devices, Windows, Windows updates, Quality updates, and create an Expedite policy that names the missing KB. Target the affected device's group. For KEV findings do this immediately.
  4. If the update should already have arrived through the normal ring, force a check-in: Devices, select the device, Sync. A stuck update agent is a common cause of one device lagging its ring.
  5. Confirm the fix in the Microsoft Defender portal: Assets, Devices, select the device, Security recommendations. The missing-KB entry disappears after the device installs the update and reports back (allow up to 24 hours).
  6. If the same device keeps appearing scan after scan, review which update ring it is assigned to: long quality-update deferrals or a paused ring leave devices exposed well past Patch Tuesday.
2 affected entities
EntityTenantPrivilegeContext
WS-PC-123Contoso RetailNot Privileged—
WS-PC-170Zava DemoNot Privileged—
2. High Windows Autopatch deployment exists but its audience contains zero updatable assets, so no devices receive the patch. — 3 affected ~15m×3 = 45m (fix empty Autopatch deployment audience) Intune Policy
An Autopatch deployment whose audience is empty (no members, or all members excluded) is functionally identical to having no deployment at all. Operators see a 'green' deployment in the admin center while the targeted patch never reaches a single endpoint. This drift typically appears after a group is renamed or its membership rule no longer resolves.
Action: Open the deployment in the Intune admin center (Devices -> Windows -> Windows updates -> Deployments), select the audience, and add updatable asset groups or individual Entra-joined devices. If exclusions cover the full member set, prune the exclusion list. Graph: GET /admin/windows/updates/deployments/{id}/audience/members and /audience/exclusions.
  1. UI: Intune admin center -> Devices -> Windows -> Windows updates -> Deployments. Open the deployment by id.
  2. Inspect deployment.state.effectiveValue. Healthy values are scheduled, offering, complete. Investigate paused, faulted, cancelled.
  3. For faulted state, read deployment.state.reasons in the Graph response for the underlying error and correct the root cause.
  4. For paused state, decide whether to resume or replace the deployment.
  5. Set settings.userExperience.daysUntilForcedReboot to 2 days or fewer for security and expedited deployments.
  6. Graph: GET /admin/windows/updates/deployments/{id} returns the full state and settings payload.
3 affected entities
EntityTenantPrivilegeContext
Expedite critical updates (autopatc…)Fabrikam EngineeringNot Privileged—
Expedite critical updates (autopatc…)Contoso RetailNot Privileged—
Expedite critical updates (autopatc…)Zava DemoNot Privileged—
3. High Application secret has expired. The application may lose access or fail authentication — 1 affected ~20m×1 = 20m (rotate expired secret) Entra ID — App registrations (secrets, keys, configuration, lifecycle)
Expired app secrets break dependent services and can trigger emergency credential resets under pressure, increasing misconfiguration risk
Action: Remove expired secret; rotate to certificate-based credentials where possible
  1. UI: Entra admin center -> App registrations -> [App] -> Certificates & secrets.
  2. Rotate expired or expiring credentials immediately; update dependent services with new credential.
  3. Reissue non-expiring credentials with a finite lifetime; enforce app management policy to block creation of non-expiring secrets and certificates.
  4. Reissue with shorter lifetime per policy; migrate secrets to certificate-based auth or managed identity; store in Key Vault.
  5. Set expiry alerts; enable automated rotation; remove unused credentials.
1 affected entities
EntityPrivilegeContext
ExpiredVendorIntegrationNot Privileged—
4. High A KEV-listed CVE has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment. — 1 affected ~1h×1 = 1h (create or amend deployment to cover KEV CVE) Patch & Vulnerability: missing patches, device CVEs, vulnerable software, end-of-life
CISA's Known Exploited Vulnerabilities catalog tracks CVEs with confirmed in-the-wild exploitation. When the deployment service has the fix available but no deployment targets it, every device in the tenant remains exposed to a CVE attackers are actively using. This is the highest-priority class of patch gap.
Action: Open the Intune admin center (Devices -> Windows -> Windows updates -> Deployments) and create or amend an Autopatch deployment that includes the listed KB articles. Pair with an expedite policy if the affected products are internet-facing. CISA KEV deadlines (BOD 22-01) are 14 days for federal agencies; treat them as a maximum for everyone else.
  1. Identify the listed CVE in the MSRC Security Update Guide and note the KB articles that fix it.
  2. UI: Intune admin center -> Devices -> Windows -> Windows updates -> Deployments. Confirm no active deployment lists the KB.
  3. Add the catalog entry to an existing deployment, or create a new deployment targeting the relevant updatable asset group.
  4. For KEV-listed CVEs, expedite. CISA BOD 22-01 sets a 14-day deadline for federal agencies; treat as the maximum.
  5. Graph: POST /admin/windows/updates/deployments to create a new deployment, or PATCH /deployments/{id} to amend an existing one.
  6. After deployment, re-run the Siemserva audit and confirm the finding clears.
1 affected entities
EntityPrivilegeContext
CVE-2025-29824Not Privileged—

Patch & Vulnerability Intelligence

Consolidated patch and vulnerability posture across Windows Autopatch, Windows Update for Business / Intune update rings, and Microsoft Defender for Endpoint threat & vulnerability management. Configuration-level findings and per-device patch gaps are unified here so the full patch story sits in one place.

2
Critical
4
High
8
Medium
7
Low
2
Devices
9
Finding Types

Intune & Autopatch Configuration Audit

6 finding types across Windows Update for Business and Windows Autopatch. Configuration-level findings (update rings, update-profile assignments, Autopatch updatable-asset enrollment, deployment audience health, the catalog probe, and CVE-coverage gaps in active deployments).

High Windows Autopatch deployment exists but its audience contains zero updatable assets, so no devices receive the patch. — 3 policies ~15m×3 = 45m
An Autopatch deployment whose audience is empty (no members, or all members excluded) is functionally identical to having no deployment at all. Operators see a 'green' deployment in the admin center while the targeted patch never reaches a single endpoint. This drift typically appears after a group is renamed or its membership rule no longer resolves.
Action: Open the deployment in the Intune admin center (Devices -> Windows -> Windows updates -> Deployments), select the audience, and add updatable asset groups or individual Entra-joined devices. If exclusions cover the full member set, prune the exclusion list. Graph: GET /admin/windows/updates/deployments/{id}/audience/members and /audience/exclusions.
High A KEV-listed CVE has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment. — 1 policy ~1h×1 = 1h
CISA's Known Exploited Vulnerabilities catalog tracks CVEs with confirmed in-the-wild exploitation. When the deployment service has the fix available but no deployment targets it, every device in the tenant remains exposed to a CVE attackers are actively using. This is the highest-priority class of patch gap.
Action: Open the Intune admin center (Devices -> Windows -> Windows updates -> Deployments) and create or amend an Autopatch deployment that includes the listed KB articles. Pair with an expedite policy if the affected products are internet-facing. CISA KEV deadlines (BOD 22-01) are 14 days for federal agencies; treat them as a maximum for everyone else.
Medium Entra security group is registered as a Windows Autopatch updatable asset but its devices are not enrolled with the deployment service. — 3 policies ~15m×3 = 45m
Registering an Entra group as an updatableAssetGroup creates a reference but does not auto-sync the group's device members into the deployment service. Each device has to be explicitly enrolled via the Autopatch enrollment action. When the group has more devices in Entra than enrolled with the deployment service, any deployment targeting the group reaches fewer endpoints than the operator expects. With zero enrolled devices the deployment is functionally a no-op while the admin UI shows it as healthy. This is the most common cause of 'Autopatch is configured but nothing happens' tenant complaints.
Action: Open the Intune admin center (Devices -> Windows -> Windows updates -> Enrollment) and run the enroll-devices flow against the affected group, or call POST /admin/windows/updates/updatableAssets/microsoft.graph.windowsUpdates.enrollAssetsById passing the group's member device ids. After enrollment, the group's deployment service members count should match the Entra group size.
Medium Windows Autopatch deployment forced-reboot deadline exceeds 5 days. — 3 policies ~10m×3 = 30m
A long forced-reboot deadline for an Autopatch deployment means devices that defer restart remain unpatched for days after the patch is delivered. Attackers exploit the gap between patch availability and installation; expedited security updates lose much of their value when the reboot deadline is loose.
Action: Reduce settings.userExperience.daysUntilForcedReboot to 2 days or fewer for security and expedited deployments. Edit the deployment in the Intune admin center or via PATCH on /admin/windows/updates/deployments/{id}.
Medium A Critical-severity CVE (CVSS 9.0+) has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment. — 2 policies ~45m×2 = 1h 30m
Critical CVEs typically allow remote code execution, privilege escalation, or full system compromise. When a tenant has the patch available in its catalog but no active deployment includes it, the gap between patch availability and rollout is open and unbounded.
Action: Identify the catalog entry and add it to an existing Autopatch deployment, or create a new deployment targeting an updatable asset group that covers your Windows fleet. Verify the deployment becomes effective ('offering' state) before closing the finding.
Low A High-severity CVE (CVSS 7.0-8.9) has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment. — 3 policies ~30m×3 = 1h 30m
High CVEs are exploitable conditions with significant impact but typically requiring some precondition (authenticated user, network proximity, etc.). Deployment coverage closes the gap before those preconditions can be combined with another finding for a full attack chain.
Action: Add the relevant catalog entry to an Autopatch deployment as part of the regular monthly cadence. If the vendor severity is also Critical or there is a public exploit, consider expediting.

Per-Device Patch Posture

2 devices with 1 distinct finding type. Sources: Defender for Endpoint machinesVulnerabilities (CVE + product roll-up), getmissingKbs (KB-level patch gaps), Windows build lag, and Defender coverage gaps. One row per (device, finding) tuple; sorted by severity then device name.

Severity Device Tenant Finding Details
CriticalWS-PC-123Contoso RetailIntune Device Vulnerability KevDevice has one or more vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
CriticalWS-PC-170Zava DemoIntune Device Vulnerability KevDevice has one or more vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
End of per-device patch posture — 2 rows across 2 devices

AI Security Insights AI Enhanced

Across 36 tenants scanned, the dominant risk is a patch management execution failure: devices carry CISA KEV-listed vulnerabilities (Critical) while the Autopatch infrastructure meant to remediate them is misconfigured — empty audiences, unenrolled asset groups, and excessive reboot delays create a false sense of coverage. Two tenants have devices with actively exploited CVEs confirmed in the wild, and at least one tenant has a KEV-specific Autopatch gap meaning the fix exists in the catalog but is never delivered. Identity risk signals (risky sign-ins proceeding without challenge) and cosmetic-only sensitivity labels compound the exposure across the fleet. ---

Risk Assessment AI Enhanced

Key risks identified by AI with attack scenarios and blast radius, ordered by severity.

1. [Critical] — KEV-Listed Device Vulnerabilities (Active Exploitation) Devices in Tenant-001 and Tenant-002 carry CVEs on CISA's Known Exploited Vulnerabilities catalog, meaning threat actors are actively using these vulnerabilities in the wild right now.

  • Attack scenario: An adversary using a KEV-listed exploit (e.g., LPE or RCE CVE) targets an unpatched endpoint. No preconditions beyond network access or phishing are typically required for KEV-class exploits.
  • Blast radius: Full endpoint compromise, potential lateral movement to adjacent systems, credential harvesting from device memory.
  • Compounding factors: IntunePolicyAutopatchDeploymentNoMembers and IntunePolicyAutopatchUpdatableAssetGroupNotEnrolled mean the automated remediation pipeline is broken — patches exist but are not delivered. Risky sign-ins (ImRiskLevelDuringSignin) proceeding without challenge suggest identity signals are also not being actioned, leaving both endpoint and identity vectors open.

Portal: https://security.microsoft.com/


2. [High] — Autopatch Deployment Has Zero Members (Patch Pipeline Broken) Three tenants (Tenant-001, Tenant-002, Tenant-003) have Autopatch deployments with empty audiences, meaning the patch management system is running but delivering nothing.

  • Attack scenario: An adversary identifies that the tenant's patch dashboard shows "healthy" deployments while no devices are actually receiving updates. They exploit an unpatched CVE (including KEV-listed ones) knowing the remediation pipeline will not close the window.
  • Blast radius: Entire managed Windows fleet remains unpatched indefinitely. This is not a single-device risk — it is fleet-wide exposure.
  • Compounding factors: Directly enables IntuneDeviceVulnerabilityKev (Critical) and IntunePolicyAutopatchCveGapKev (High) to persist. Combined with IntunePolicyAutopatchUpdatableAssetGroupNotEnrolled, the entire Autopatch stack is non-functional across all three affected tenants.

Portal: https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/overview


3. [High] — KEV CVE Has No Active Autopatch Deployment (Tenant-001) Finding IntunePolicyAutopatchCveGapKev confirms that for at least one KEV-listed CVE, a KB fix exists in the Windows Update catalog but no deployment targets it.

  • Attack scenario: The fix is available but not deployed. An attacker exploiting this CVE faces zero automated remediation pressure and an indefinite window.
  • Blast radius: Every device in Tenant-001's Windows fleet remains exposed to an actively exploited CVE with a published patch.
  • Compounding factors: Pairs directly with IntuneDeviceVulnerabilityKev (Critical) confirming that devices are already vulnerable AND the deployment gap is confirmed. This is not theoretical — the KEV hit and the gap hit co-exist in the same tenant.

Portal: https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/overview


4. [High] — Expired Application Secret (Tenant-001) AsAppSecretExpired indicates an app registration's secret has lapsed, breaking dependent service authentication and creating pressure for emergency credential handling.

  • Attack scenario: Operations team performs an emergency secret rotation under time pressure, bypassing standard credential hygiene (e.g., storing the new secret in plain text, reusing a weak value, or granting excessive permissions to unblock the service quickly).
  • Blast radius: Dependent service outage plus elevated risk of misconfigured replacement credentials. If the app has broad API permissions, a poorly managed rotation could expose those permissions to a new, less-controlled secret.
  • Compounding factors: No certificate-based credential alternative noted. The absence of lifecycle management here suggests broader credential governance gaps may exist across other app registrations not surfaced in this scan.

Portal: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade


5. [Medium] — Autopatch Asset Groups Not Enrolled in Deployment Service IntunePolicyAutopatchUpdatableAssetGroupNotEnrolled across all three tenants means Entra security groups are registered as Autopatch targets but their member devices have never been enrolled with the deployment service.

  • Attack scenario: Administrator believes devices are covered by Autopatch policy; Defender Vulnerability Management shows open CVEs; no patch ever arrives because the enrollment step was skipped.
  • Blast radius: All devices in the affected Entra groups receive zero Autopatch patches. The number of exposed devices scales with group membership size.
  • Compounding factors: This is the underlying mechanism that makes IntunePolicyAutopatchDeploymentNoMembers persistent — even if audiences are populated, unenrolled devices do not receive patches.

Portal: https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/overview


6. [Medium] — Excessive Reboot Delay in Autopatch Deployments IntunePolicyAutopatchDeploymentRebootDelayLong in all three tenants means devices can defer reboots beyond 5 days after patch delivery, leaving them technically "patched" but functionally vulnerable.

  • Attack scenario: A critical patch is delivered but the device has not rebooted. An attacker exploits the still-running vulnerable process or driver before the patch activates. The patch status shows "installed" while the vulnerability remains exploitable in memory.
  • Blast radius: Every device that defers reboot remains exploitable for the deferral window. For fleet-wide deployments, this could be thousands of devices.
  • Compounding factors: Combined with KEV-listed vulnerabilities, a long reboot delay means even a correctly deployed patch does not close the window quickly.

Portal: https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/overview


7. [Medium] — Critical CVE Patch Gap in Autopatch (2 tenants) IntunePolicyAutopatchCveGapCritical in Tenant-001 and Tenant-002 shows CVSS 9.0+ CVEs with available KB fixes that no active deployment covers.

  • Attack scenario: A remote code execution CVE at CVSS 9.0+ is publicly known and the patch is available but not deployed. This is a race condition between the organization and threat actors.
  • Blast radius: Full system compromise potential on any unpatched device. At CVSS 9.0+ the bar for exploitation is typically low.
  • Compounding factors: Co-exists with IntuneDeviceVulnerableSoftware (Low) which confirms installed vulnerable software is already inventoried — the risk is known but unaddressed.

Portal: https://security.microsoft.com/


8. [Medium] — Cosmetic Sensitivity Labels with No Protection (3 tenants) PurviewLabelNoProtection across all three tenants means sensitivity labels are applied to content but enforce no encryption, rights management, or content marking.

  • Attack scenario: A user labels a document "Confidential" and shares it externally. The label provides no technical barrier — the recipient can forward, print, or exfiltrate the document freely.
  • Blast radius: Any content bearing these labels across SharePoint, OneDrive, Exchange, and Teams has zero technical data protection despite appearing classified.
  • Compounding factors: Without encryption enforcement, data exfiltration via compromised accounts or misconfigured sharing leaves no audit trail of content access patterns.

Portal: https://compliance.microsoft.com/


9. [Low] — Risky Sign-Ins Proceeding Without Challenge (8 events, 3 tenants) ImRiskLevelDuringSignin recorded risk signals at sign-in but no blocking or MFA step-up was enforced, meaning sessions proceeded despite the risk detection.

  • Attack scenario: Entra Identity Protection detects an anomalous sign-in (impossible travel, leaked credential, atypical location) but no Conditional Access policy enforces remediation. The adversary's session is live.
  • Blast radius: Per-user blast radius depends on account privileges. If any of the 8 events involved privileged accounts, the impact escalates significantly.
  • Compounding factors: The geo-fencing CA policy (ImConditionalAccessPolicyBlocksAllButAllowedCountries, Info) exists in Tenant-001 but the risky sign-in events span Tenant-001, Tenant-002, and Tenant-003 — suggesting the other tenants may lack equivalent location controls.

Portal: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RiskySignInsBlade


Compliance Controls Affected

Severity MCSB Controls SCuBA Controls
CriticalLT-1, LT-3—
HighIM-3, LT-1, LT-3, PV-6MS.AAD.5.1v1, MS.AAD.5.2v1, MS.AAD.5.3v1
MediumDP-1, DP-3, IM-6, LT-1, LT-3, PV-6MS.AAD.3.3v2, MS.AAD.3.4v1, MS.AAD.3.5v1
LowIM-1, LT-1, LT-3, PA-4MS.AAD.1.1v1, MS.AAD.2.1v1, MS.AAD.2.2v1, MS.AAD.2.3v1, MS.AAD.3.1v1, MS.AAD.3.2v1
Full Analysis AI Enhanced

Note: Finding counts and domain statistics shown in the tables above are computed directly from audit data and are authoritative. If the AI narrative below differs from those numbers, the data tables are correct.

Endpoint Patch Management — Systemic Pipeline Failure

The most significant pattern in this scan is not any single vulnerability but the compound failure of the entire Autopatch pipeline across all three affected tenants. Three distinct findings — IntunePolicyAutopatchDeploymentNoMembers, IntunePolicyAutopatchUpdatableAssetGroupNotEnrolled, and IntunePolicyAutopatchDeploymentRebootDelayLong — form a kill chain against the patch management system itself: assets are not enrolled, deployments have no audiences, and even when patches land, reboot deferral keeps devices vulnerable.

The consequence is confirmed by IntuneDeviceVulnerabilityKev (Critical, 2 tenants) and IntunePolicyAutopatchCveGapKev (High, Tenant-001): the patch pipeline failure is not hypothetical — it has already resulted in devices carrying KEV-listed CVEs with no active remediation path. The CVE gap findings (IntunePolicyAutopatchCveGapCritical, IntunePolicyAutopatchCveGapHigh) show the pipeline is failing at multiple CVSS severity tiers simultaneously.

Why Microsoft dashboards miss this: Intune's Autopatch dashboard shows deployment status as "healthy" when audiences are configured but empty. There is no native alert that correlates "zero enrolled devices" + "KEV CVE present on device" + "no deployment covers the KEV KB." This analysis surfaces the three-layer failure as a single attack chain that Secure Score and the Intune compliance dashboard each only partially surface in isolation.


Identity — Risk Signals Without Enforcement

Eight risky sign-in events (ImRiskLevelDuringSignin) across three tenants proceeded without MFA challenge or block. The geo-fencing CA policy (ImConditionalAccessPolicyBlocksAllButAllowedCountries) exists in Tenant-001 but the distribution of risky sign-in events across all three tenants suggests Tenant-002 and Tenant-003 lack equivalent compensating controls.

The expired app secret (AsAppSecretExpired, Tenant-001) adds a credential lifecycle gap. Emergency rotation under production outage pressure is a known source of security regressions — weak secrets, plain-text storage, over-permissioned replacements. The absence of certificate-based authentication on this registration compounds the risk.

Why Microsoft dashboards miss this: Entra's Risky Users blade surfaces individual risk detections but does not correlate "risk detected + no CA policy enforced + session proceeded" as a unified finding. The cross-tenant pattern (3 tenants, 8 events, no enforcement) is only visible when looking across the fleet, not within a single tenant's dashboard.


Data Protection — Classification Without Enforcement

Sensitivity labels across all three tenants (PurviewLabelNoProtection) have HasProtection = false, meaning they are cosmetic classifiers only. Content labeled "Confidential" or equivalent receives no encryption, no rights management, and no content marking. This creates a compliance theater risk: leadership and auditors see a labeling program in place, but the labels provide zero technical enforcement against exfiltration, forwarding, or unauthorized access.

This finding compounds with the risky sign-in gap: if a compromised account accesses labeled-but-unprotected content, the data leaves with no technical barrier and no rights-management audit trail to reconstruct what was accessed or shared.

Why Microsoft dashboards miss this: Microsoft Purview's label dashboard shows label adoption rates and coverage statistics but does not surface the distinction between labels with and without protection actions in its summary metrics. A tenant can show 90% labeling coverage while 100% of those labels enforce nothing — a gap this analysis directly identifies from the HasProtection field.


Cross-Domain Attack Chain Summary

The highest-risk narrative in this scan connects four findings into a single chain:

  1. IntunePolicyAutopatchDeploymentNoMembers + IntunePolicyAutopatchUpdatableAssetGroupNotEnrolled → Autopatch is inert.
  2. IntuneDeviceVulnerabilityKev → KEV CVEs persist on endpoints because the patch pipeline cannot deliver fixes.
  3. ImRiskLevelDuringSignin (no enforcement) → A compromised identity can reach the vulnerable endpoint without challenge.
  4. PurviewLabelNoProtection → Data accessed via the compromised session and vulnerable endpoint carries no rights management, enabling silent exfiltration.

No single finding here would individually score Critical across all four dimensions. The compounding of medium-severity infrastructure failures with Critical endpoint vulnerabilities and uncontrolled identity sessions creates a full attack path from initial access through data exfiltration that native dashboards do not present as connected.


References (10 links — click to expand)

This is not a complete list of all relevant references. Additional documentation and portal links appear throughout the report sections above.

Findings by Entity

36 entities with findings, sorted by worst severity. Click any row to expand and see full finding details including risk, remediation actions, and compliance mappings.

EntityTenantTypeSeverityFindings
WS-PC-123Contoso RetailDevicesCriticalDevice has one or more vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
WS-PC-170Zava DemoDevicesCriticalDevice has one or more vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Expedite critical updates (autopatc…)Fabrikam EngineeringUpdate ConfigurationHighWindows Autopatch deployment exists but its audience contains zero updatable assets, so no devices receive the patch., Windows Autopatch deployment forced-reboot deadline exceeds 5 days.
Expedite critical updates (autopatc…)Contoso RetailUpdate ConfigurationHighWindows Autopatch deployment exists but its audience contains zero updatable assets, so no devices receive the patch., Windows Autopatch deployment forced-reboot deadline exceeds 5 days.
Expedite critical updates (autopatc…)Zava DemoUpdate ConfigurationHighWindows Autopatch deployment exists but its audience contains zero updatable assets, so no devices receive the patch., Windows Autopatch deployment forced-reboot deadline exceeds 5 days.
ExpiredVendorIntegrationZava DemoApplicationsHighApplication secret has expired. The application may lose access or fail authentication
CVE-2025-29824Zava DemoUpdate ConfigurationHighA KEV-listed CVE has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment.
CVE-2025-21298Contoso RetailUpdate ConfigurationMediumA Critical-severity CVE (CVSS 9.0+) has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment.
Public (00000000-0000-0000-0000-0000000000c1)Fabrikam EngineeringTenant-LevelMediumA sensitivity label has no protection actions configured.
Logan SinghContoso RetailUsers & AccountsMediumRisk level recorded during a user sign-in event
Rosa HaddadContoso RetailUsers & AccountsMediumRisk level recorded during a user sign-in event
Viv KumarContoso RetailUsers & AccountsMediumRisk level recorded during a user sign-in event
Public (00000000-0000-0000-0000-0000000000b1)Contoso RetailTenant-LevelMediumA sensitivity label has no protection actions configured.
Skyler KhanFabrikam EngineeringUsers & AccountsMediumRisk level recorded during a user sign-in event
Autopatch updatable asset group: Engineering (autopatc…)Zava DemoUpdate ConfigurationMediumEntra security group is registered as a Windows Autopatch updatable asset but its devices are not enrolled with the deployment service.
Autopatch updatable asset group: Engineering (autopatc…)Contoso RetailUpdate ConfigurationMediumEntra security group is registered as a Windows Autopatch updatable asset but its devices are not enrolled with the deployment service.
Autopatch updatable asset group: FinanceFabrikam EngineeringUpdate ConfigurationMediumEntra security group is registered as a Windows Autopatch updatable asset but its devices are not enrolled with the deployment service.
Kira RiveraFabrikam EngineeringUsers & AccountsMediumRisk level recorded during a user sign-in event
Sloan IbrahimZava DemoUsers & AccountsMediumRisk level recorded during a user sign-in event
Katarzyna YamamotoFabrikam EngineeringUsers & AccountsMediumRisk level recorded during a user sign-in event
Rowan KhanZava DemoUsers & AccountsMediumRisk level recorded during a user sign-in event
Public (00000000-0000-0000-0000-0000000000a1)Zava DemoTenant-LevelMediumA sensitivity label has no protection actions configured.
CVE-2025-29966Contoso RetailUpdate ConfigurationLowA High-severity CVE (CVSS 7.0-8.9) has KB articles in the Windows Update catalog that are not covered by any active Autopatch deployment.
opensslContoso RetailSoftwareLowInstalled software carries known vulnerabilities in the Defender Vulnerability Management inventory.
Break-Glass AlphaZava DemoUsers & AccountsLowBreak-glass (emergency access) account is excluded from all enabled Conditional Access policies. Emergency access is preserved
Update curlZava DemoSoftwareLowOpen Defender Vulnerability Management security recommendation awaiting remediation on exposed devices.
Require MFA for Global AdministratorsContoso RetailTenant-LevelInfoGlobal Administrators must be protected by multi-factor authentication.
Remove dormant administrator accountsContoso RetailTenant-LevelInfoActive admin assignments held by users who have not signed in for more than 90 days.
Uma ThompsonFabrikam EngineeringUsers & AccountsInfoUser's last password change timestamp
Leilani GrahamFabrikam EngineeringUsers & AccountsInfoUser's last password change timestamp
Micah WalkerContoso RetailUsers & AccountsInfoUser's last password change timestamp
River MorenoContoso RetailUsers & AccountsInfoUser's last password change timestamp
Enable sign-in risk policyZava DemoTenant-LevelInfoA Conditional Access policy should require MFA on medium or high sign-in risk.
Elena YoungZava DemoUsers & AccountsInfoUser's last password change timestamp
Pablo SullivanZava DemoUsers & AccountsInfoUser's last password change timestamp
Block Sign-In from Unknown CountriesZava DemoUsers & AccountsInfoA CA policy excludes allowed countries and blocks everything else (geo-fencing allow-list)
Audit details: prompt and rules used to generate this report

Produced by: Siemserva CLI (--reporter --reporter-ai)

Active validators: the AI text was checked against the following rules before the report was written.

  • SecurityOutputValidator
  • SecurityRecommendationValidator
  • TrustedUrlValidator

System prompt: the exact instructions given to the AI to produce the analysis above.

You are a Microsoft 365 and Azure security expert covering Entra ID,
Intune, Exchange Online, SharePoint, Teams, OneDrive, and connected
workloads. You surface insights that Microsoft's own dashboards do not show.

Analyze the scan results to discover novel patterns and correlations.
Focus on:

- Cross-domain interactions (e.g., Identity gaps + weak Logging =
  blind spots for incident response)
- Privilege escalation paths that combine multiple medium-severity
  findings into high-severity attack chains
- Correlations between finding clusters that suggest systemic issues
  (e.g., apps with excessive permissions also lacking conditional
  access = compounding risk)
- Things that will make a security professional think "I didn't know
  that" — go beyond what Secure Score and Microsoft Defender show

Be analytical, not alarmist. Evidence-based, not prescriptive. Every
insight must reference specific findings from the scan data. Show the
data, let the reader draw conclusions.

Your audience: security managers, IT directors, SOC leads, and MSSP
consultants who need to explain risk to business stakeholders.
Formatting rules (the response will be displayed in a terminal and an HTML report):
- You MUST use these exact section headers in this order:
  ## Executive Summary
  ## Risk Score
  ## Fix First
  ## Quick Wins
  ## Risk Assessment
  ## Recommendations
  ## Full Analysis
  ## References
- Executive Summary: 2-4 sentences for a security manager.
  Lead with the overall risk posture, highlight the most critical gap,
  and state what immediate action is needed.
- Risk Score: A single integer 0–100 representing YOUR independent risk
  assessment (higher = more risk). Band logic: Critical present → 85–100;
  High only → 65–85; Medium only → 40–65; Low only → 20–40; nothing → 0.
  Adjust within the band for privilege exposure and lateral-movement risk.
  Output ONLY the integer (e.g. "78").
- Fix First: Exactly 3 fixes — highest-impact / lowest-effort changes.
  Each item: what to change, why it has highest risk-reduction value,
  estimated time to implement. Numbered list.
- Quick Wins: Fixes completable in under 30 minutes each. Bullet list.
  Each item: the fix, the direct portal link to do it, and the specific
  finding it closes. Distinct from Fix First — focus on speed, not impact.
- Risk Assessment: for each distinct risk write a structured entry. Start each
  with a bold title and severity label: **[Critical/High/Medium] — [Risk Name]**,
  then one sentence explaining what the misconfiguration enables. Follow with
  2–3 sub-bullets: (1) realistic attack scenario an adversary would use,
  (2) blast radius if exploited, (3) any compounding factors with other findings.
  Include a direct link to the relevant Microsoft admin portal blade for context.
  Order by severity (Critical first). Cite specific finding names from the scan.
- Recommendations: numbered list of the TOP 10 prioritized actions (highest
  risk first). Do not exceed 10 items. For each recommendation: (1) bold
  action title, (2) why this priority (severity × blast radius), (3) exact
  step-by-step instructions (2–3 steps), (4) a direct "Fix it now →" link
  to the exact Microsoft admin portal blade (Entra, Intune, Defender,
  Exchange, SharePoint, Teams), (5) relevant MCSB/SCuBA control code with
  link to learn.microsoft.com. Be specific — reference the exact finding
  name from the scan data.
- Full Analysis: concise technical summary by domain (3-5 paragraphs total).
  Use ### sub-headers for each domain. Focus on cross-domain dependencies,
  attack chain connections, and execution order. Do NOT repeat step-by-step
  fixes already covered in Recommendations.
  For each domain, include a brief "Why Microsoft dashboards miss this"
  insight — explain what this analysis surfaces that the native Microsoft
  Secure Score, Entra recommendations, or Defender dashboards do not show
  (e.g., cross-domain attack chains, privilege compounding across roles,
  stale account blast radius, conditional access bypass combinations,
  or correlation patterns between findings). Only mention gaps where the
  value is clear and specific — do not make generic claims.
- References: max 10 URLs on separate lines (not inline in prose).
  Pick the 10 most relevant. Prefer portal action links and
  Microsoft Learn documentation. Quality over quantity.
- LINK LIST LIMITS: Any bulleted or numbered list of links must
  contain at most 10 items. This applies to Quick Wins, Fix First,
  Recommendations, References, and every other section.
- Use bullet points (- or *) for lists, one item per line.
- Keep lines under 90 characters.
- Use short paragraphs (2-3 sentences max).

Direct portal links — use these EXACT URLs in recommendations so admins
can click straight into the right blade to fix issues:
- Entra overview: https://entra.microsoft.com/
- Conditional Access policies: https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/Overview
- Authentication methods: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/AdminAuthMethods
- MFA settings: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/MultifactorAuthenticationMenuBlade
- Named locations: https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/NamedLocations
- Users: https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserManagementMenuBlade/AllUsers
- Groups: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/GroupsManagementMenuBlade/AllGroups
- PIM: https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart
- PIM roles: https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/ResourceMenuBlade/~/roles
- App registrations: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
- Enterprise apps: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AllApps
- Consent & permissions: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade
- Security defaults: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SecurityDefaultsBlade
- Risky users: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RiskyUsersBlade
- Risky sign-ins: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RiskySignInsBlade
- Sign-in logs: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SignInLogsMenuBlade
- Audit logs: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuditLogsBlade
- Diagnostic settings: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/DiagnosticSettingsMenuBlade
- Device management (Intune): https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/overview
- Compliance policies: https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesComplianceMenu
- Microsoft Defender: https://security.microsoft.com/
- Exchange admin: https://admin.exchange.microsoft.com/
- SharePoint admin: https://admin.microsoft.com/sharepoint
- Teams admin: https://admin.teams.microsoft.com/

Compliance framework links — cite these for MCSB and SCuBA controls:
- MCSB overview: https://learn.microsoft.com/en-us/security/benchmark/azure/overview
- MCSB controls: https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-identity-management
  (replace "identity-management" with: privileged-access, network-security,
   data-protection, asset-management, logging-threat-detection, etc.)
- CISA SCuBA: https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
- CIS Benchmarks: https://www.cisecurity.org/benchmark/microsoft_365

When referencing a specific control (e.g., IM-7, PA-4, LT-1), link to
the relevant MCSB page section. The HTML report renders markdown links
as clickable hyperlinks.

Reference link policy — ONLY cite URLs from these approved domains.
Do NOT cite vendor blogs, cost management articles, FinOps content,
product comparison sites, or any non-security reference.
Approved domains:
- learn.microsoft.com          (Microsoft Learn documentation)
- docs.microsoft.com           (Microsoft Docs — legacy URLs)
- entra.microsoft.com          (Entra admin portal)
- security.microsoft.com       (Microsoft Defender / Security portal)
- intune.microsoft.com         (Intune admin portal)
- admin.microsoft.com          (Microsoft 365 admin center)
- admin.exchange.microsoft.com (Exchange admin center)
- admin.teams.microsoft.com    (Teams admin center)
- compliance.microsoft.com     (Microsoft Purview)
- cisa.gov                     (CISA SCuBA guidance)
- nist.gov                     (NIST SP 800 publications)
- owasp.org                    (OWASP Top 10)
- techcommunity.microsoft.com  (Microsoft Tech Community official posts only)
If no approved source exists for a claim, omit the link rather than
cite an off-topic one.
Disclaimer: This report was generated by Siemserva, a product of Senserva, LLC. Automated audit results are based on configuration data available at the time of analysis and may not reflect every setting, policy, or condition in your environment. Findings should be validated by a qualified IT or security professional before remediation. Senserva makes no warranty, express or implied, as to the accuracy, completeness, or fitness for a particular purpose of the information contained in this report.
Portions of this report were generated using artificial intelligence. AI-generated content may contain inaccuracies, omissions, or recommendations that do not apply to your specific environment. AI output does not constitute professional security advice.
By using this report you agree to our EULA — click to view
SIEMSERVA END USER LICENSE AGREEMENT This End User License Agreement ("Agreement") is between the person or entity purchasing or downloading Siemserva ("you" or "Client") and Senserva, LLC, with its principal place of business at 4661 White Bear Parkway, St. Paul, MN 55110 (hereinafter, "Senserva"). Senserva and Client are collectively referred to as the "Parties." Effective Date: June 12, 2026 SENSERVA PROVIDES SIEMSERVA SOFTWARE SOLELY ON THE TERMS AND CONDITIONS SET FORTH IN THIS AGREEMENT. BY PURCHASING, DOWNLOADING, INSTALLING, OR USING SIEMSERVA IN ANY WAY, YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO ACCEPT THIS AGREEMENT ON YOUR OWN BEHALF OR IF CLIENT IS A CORPORATION, ORGANIZATION, OR OTHER LEGAL ENTITY, YOU HAVE THE RIGHT, POWER, AND AUTHORITY TO ENTER INTO THIS AGREEMENT ON BEHALF OF CLIENT. IF YOU DO NOT AGREE TO THESE TERMS, SENSERVA WILL NOT AND DOES NOT LICENSE SIEMSERVA TO YOU AND YOU MUST NOT DOWNLOAD, INSTALL, OR USE SIEMSERVA. AGREEMENT 1. License Grant and Types. 1.1. License Types. Siemserva is available under the following license types: (a) Demo License (Unregistered): A complimentary license, available without charge or registration, that permits use of Siemserva solely in its demonstration modes, including Game Mode and the built-in simulator, operating exclusively on simulated data supplied with Siemserva. A Demo License does not permit security assessment of any Microsoft 365 tenant. (b) Registered License: A complimentary license, available without charge upon registration with Senserva and issuance of a license key, that permits security assessment of up to two (2) Microsoft 365 tenants, with assessment results limited to no more than twenty-five (25) users per tenant. A Registered License also includes all rights granted under a Demo License. (c) Annual License: A paid annual subscription license that grants access to Siemserva for a period of twelve (12) months, renewable annually. (d) Non-Profit License: A complimentary license available at no charge to qualified non-profit organizations with valid 501(c)(3) status or equivalent international non-profit designation, granted on an annual basis subject to verification of non-profit status. 1.2. Grant of License. Subject to the terms and conditions of this Agreement and payment of applicable fees (if any), Senserva hereby grants to Client, solely for Client's internal business purposes, a non-exclusive, non-transferable, non-sublicensable license to (a) install, access, download, use, and run Siemserva software on Client's devices for the purpose of conducting Microsoft 365 security assessments and generating security reports, in each case subject to the limitations of Client's license type; and (b) prepare, reproduce, print, download, and use a reasonable number of copies of the generally available user documentation relating to Siemserva (including user manuals, operating manuals, and other instructions, specifications, documents, and materials provided by Senserva to Client) as may be necessary or useful for any use of Siemserva permitted under this Agreement. 1.3. Non-Profit License Requirements. To qualify for and maintain a Non-Profit License, Client must: (a) Provide valid documentation of 501(c)(3) status or equivalent international non-profit designation upon request; (b) Use Siemserva solely for the non-profit organization's internal security assessment purposes; (c) Not use Siemserva to provide commercial services to other entities; (d) Reverify non-profit status annually upon license renewal. Senserva reserves the right to convert a Non-Profit License to an Annual License if Client no longer qualifies as a non-profit organization or fails to provide requested verification documentation. 1.4. Registered License Terms. Registered Licenses are subject to the following additional terms: (a) Registration with accurate and current information, including a valid work email address, is required. License keys are issued to the registering person or entity and are non-transferable; (b) Security assessment is limited to no more than two (2) Microsoft 365 tenants, which may include tenants that Client manages on behalf of its customers, and assessment results are limited to no more than twenty-five (25) users per tenant; (c) A Registered License has no fixed expiration date, but Senserva may modify the limits of, suspend, or discontinue the Registered License program, or suspend or revoke any individual license key, at any time at its sole discretion; (d) Upon request and subject to review and verification by Senserva, Senserva may at its sole discretion issue an expanded evaluation key that increases or removes the tenant or user limits of a Registered License. The scope and duration of any expanded evaluation are designated by Senserva at issuance and may be withdrawn at any time; (e) Registered Licenses are provided for evaluation of Siemserva. Continued production use beyond evaluation requires an Annual License or a Non-Profit License. 1.5. Demo License Terms. Demo Licenses operate solely on simulated data included with Siemserva, do not access, collect, or assess any data from Client's Microsoft 365 environment, and carry no entitlement to support, updates, or continued availability. 2. Restrictions. Except as expressly permitted in this Agreement, Client must not: (a) copy, modify, reverse engineer, decompile, disassemble, or otherwise attempt to derive or gain access to the source code, underlying structure, algorithms, security checks, or know-how of Siemserva, or attempt to do so, whether manually or by means of any automated tool, artificial intelligence system, or machine learning model; (b) install or use any third-party software or technology in any way that would subject Senserva's intellectual property or technology to any other license terms; (c) work around any technical limitations in Siemserva, including the tenant and user limits of a Registered License; (d) use Siemserva for any unlawful purpose; (e) distribute, sublicense, rent, lease, or lend Siemserva, in whole or in part to any other person or entity (except for third party service providers or contractors that access Siemserva in the provision of services to Client), or use it to offer hosting services to a third party; (f) publish, or otherwise make available to any third party, any benchmark testing information or results relating to Siemserva; (g) use Siemserva for any function other than internal business use or provision of professional services to Client's customers without express written consent from Senserva; (h) remove, obscure, or modify any copyright, trademark, or other proprietary notices contained in or displayed by Siemserva; or (i) provide, expose, submit, or otherwise make available any portion of Siemserva, including its user interface, screens, layouts, workflows, dashboards, prompts, check names and logic, outputs, reports, or documentation, to any artificial intelligence system, machine learning model, large language model, or automated agent for the purpose of training, fine-tuning, prompting, grounding, or otherwise enabling any system or person to reproduce, duplicate, imitate, or create a product, service, or feature that replicates or competes with Siemserva or any part of its functionality. This restriction does not prohibit Client's ordinary use of the AI features built into or documented for Siemserva (such as AI-enhanced reports and the Senserva MCP) on Client's own data. 3. Intellectual Property Rights and Ownership. Rights to access or use Siemserva do not give Client any right to implement Senserva's patents or other intellectual property. All right, title, or interest in or to the copyrights, trademarks, patents, trade secrets and all other intellectual property rights in Siemserva are and shall remain with Senserva. Senserva may place copyright and/or proprietary notices, including hypertext links, within Siemserva indicating Senserva's proprietary interest therein. Client may not remove, obscure or modify such notices without Senserva's prior written permission. Client acknowledges and agrees that Siemserva is provided under license, and not sold, to Client. Client does not acquire any ownership interest in Siemserva under this Agreement, or any other rights thereto, other than to use the same in accordance with the license granted and subject to all terms, conditions, and restrictions under this Agreement. Senserva reserves and shall retain its entire right, title, and interest in and to Siemserva and all intellectual property rights arising out of or relating to Siemserva, except as expressly granted to the Client in this Agreement. Client shall safeguard Siemserva from infringement, misappropriation, theft, misuse, or unauthorized access. 4. Third-Party Materials. Siemserva may include software, content, data, or other materials, including related documentation, that are owned by persons other than Senserva and that are provided to Client on terms that are in addition to and/or different from those contained in this Agreement ("Third-Party Components"). Any such Third-Party Components are licensed to Client under the terms of the applicable third-party licensor. 5. Use of Microsoft Graph APIs. Siemserva uses Microsoft Graph APIs to collect security configuration data from Client's Microsoft 365 tenant for the purpose of security assessment and compliance validation. Senserva does not store, transmit, or remove this data from Client's environment, nor is it used for any purpose other than generating security assessment reports for Client's use. Siemserva operates with read-only permissions and makes no modifications to Client's Microsoft 365 configurations. Senserva may use documented or undocumented Microsoft APIs to provide comprehensive security assessment coverage and framework controls mapping. 6. Data Privacy and Security. Siemserva operates locally on Client's devices and does not transmit security assessment data to Senserva or any third party. All security scans, analysis, and report generation occur on Client's local system. Assessment reports are stored locally on Client's devices and Client maintains full control over distribution and storage of such reports. Senserva may collect anonymized usage statistics (such as feature usage, error logs, and performance metrics) for the purpose of improving Siemserva, but such data collection does not include any Client security findings, configurations, or identifiable information from Client's Microsoft 365 environment. 7. End Users. Client will control access to and use of Siemserva by end users and is responsible for any use of Siemserva that does not comply with this Agreement. Specifically, and without limiting the generality of the foregoing, Client is responsible and liable for all actions and failures to take required actions with respect to Siemserva by its authorized users or by any other person to whom Client or an authorized user may provide access to or use of Siemserva, whether such access or use is permitted by or in violation of this Agreement. 8. Fees and Payments. 8.1. Annual License Fees. Annual License fees are set forth in the applicable ordering document, quote, or purchase confirmation between Senserva and Client and are payable in advance for each twelve (12) month license period. All fees are non-refundable except as may be expressly set forth in Section 11 (Limited Warranties). Senserva may increase Annual License fees upon thirty (30) days' prior written notice to Client, with such increases effective upon the next license renewal date. 8.2. Complimentary Licenses. Demo Licenses, Registered Licenses, and Non-Profit Licenses are provided at no charge. Senserva reserves the right to verify Client's eligibility for any complimentary license at any time, to convert a Non-Profit License to an Annual License if Client no longer qualifies or fails to provide requested verification, and to suspend or revoke any complimentary license as set forth in this Agreement. 8.3. Future Updates. Updates and enhancements to Siemserva, including additional framework support (MCSB, MITRE ATT&CK), web interface, and mobile applications, are included in the Annual License and Non-Profit License at no additional charge. Demo License and Registered License holders may use updates as and when made generally available by Senserva but are not entitled to any particular update, enhancement, or continued availability. 9. Term & Termination. 9.1. Term. (a) Annual Licenses commence on the date of purchase and continue for an initial term of twelve (12) months ("Initial Term"), automatically renewing for successive twelve (12) month periods ("Renewal Terms") unless terminated in accordance with this Agreement. (b) Non-Profit Licenses commence on the date of approval and continue for twelve (12) months, subject to annual reverification of non-profit status and renewal at Senserva's discretion. (c) Registered Licenses commence on the date of license key issuance and continue until terminated by either party. Client may terminate at any time by ceasing use and uninstalling Siemserva. Senserva may suspend or terminate a Registered License, or modify or discontinue the Registered License program, at any time at its sole discretion. (d) Demo Licenses commence on first use of Siemserva in a demonstration mode and continue until terminated by either party. Senserva may modify or discontinue the demonstration modes at any time at its sole discretion. 9.2. Termination by Client. Client may terminate an Annual License by providing written notice to Senserva at least thirty (30) days prior to the end of the then-current term. No refunds will be provided for early termination. 9.3. Termination by Senserva. Senserva may terminate this Agreement: (a) For Annual Licenses, by providing sixty (60) days' written notice to Client; (b) For Non-Profit Licenses, immediately upon determination that Client no longer qualifies as a non-profit organization or upon Client's failure to provide requested verification; (c) For Demo Licenses and Registered Licenses, at any time at Senserva's sole discretion, effective upon notice to Client or upon deactivation of the applicable license key; (d) For any license type, effective upon written notice to Client if Client materially breaches this Agreement and such breach: (i) is incapable of cure; or (ii) being capable of cure, remains uncured thirty (30) days after Senserva provides written notice thereof. 9.4. Termination for Insolvency. Either party may terminate effective immediately if the other party files, or has filed against it, a petition for voluntary or involuntary bankruptcy or pursuant to any other insolvency law, makes or seeks to make a general assignment for the benefit of its creditors or applies for, or consents to, the appointment of a trustee, receiver, or custodian for a substantial part of its property. 9.5. Effect of Termination. Upon termination or expiration of this Agreement, the license granted hereunder shall also terminate, and Client shall cease using Siemserva and shall uninstall all copies of Siemserva from Client's devices. No termination shall affect Client's obligation to pay all fees that may have become due before such termination, or entitle Client to any refund, except as explicitly provided in Section 11 (Limited Warranties). The provisions of this Agreement that, by their nature, should survive termination or expiration of this Agreement, will do so, including without limitation Sections 3, 10, 11, 12, 13, and 14. 10. Collection and Use of Information. Client acknowledges that Senserva may, directly or indirectly, collect and store anonymized information regarding use of Siemserva, including but not limited to feature usage, error logs, crash reports, and performance metrics. Such information does not include any security findings, configurations, or identifiable data from Client's Microsoft 365 environment. Client agrees that Senserva may use such anonymized information for any purpose related to improving Siemserva, including but not limited to: improving the performance of Siemserva or developing updates; verifying Client's compliance with the terms of this Agreement and enforcing Senserva's rights, including all intellectual property rights in and to Siemserva. 11. Limited Warranties. Senserva warrants that Siemserva will substantially contain the functionality described in the then-current user documentation, and when properly installed according to specifications, will substantially perform in accordance therewith for a period of thirty (30) days from the date of purchase or first use ("Warranty Period"). The foregoing warranties will not apply and will become null and void if Client (including any authorized user or any other person provided access to Siemserva by Client or any authorized user): (i) installs or uses Siemserva on or in connection with any hardware or software not meeting the minimum system requirements specified by Senserva; (ii) modifies or damages Siemserva; or (iii) misuses Siemserva. Subject to Client's prompt written notification to support@senserva.com of a failure of the foregoing warranty during the Warranty Period, Senserva's sole liability (and Client's sole remedy) will, at Senserva's option, be to: (i) repair or replace Siemserva, provided that Client provides Senserva with all information Senserva reasonably requests to resolve the reported failure, including sufficient information to enable Senserva to recreate such failure; or (ii) for Annual Licenses, refund a pro-rata portion of the license fee paid based on the unused portion of the license term, subject to Client's ceasing all use of Siemserva and uninstalling all copies from Client's devices. The warranties in this Section apply only to paid licenses. Demo Licenses, Registered Licenses, and Non-Profit Licenses are provided "AS IS" without the foregoing warranty. EXCEPT AS EXPRESSLY SET FORTH ABOVE, SIEMSERVA IS PROVIDED "AS IS" AND WITH ALL FAULTS AND DEFECTS WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, SENSERVA, ON ITS OWN BEHALF AND ON BEHALF OF ITS AFFILIATES AND ITS AND THEIR RESPECTIVE LICENSORS AND SERVICE PROVIDERS, EXPRESSLY DISCLAIMS ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, WITH RESPECT TO SIEMSERVA, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, AND WARRANTIES THAT MAY ARISE OUT OF COURSE OF DEALING, COURSE OF PERFORMANCE, USAGE, OR TRADE PRACTICE. WITHOUT LIMITATION TO THE FOREGOING, SENSERVA PROVIDES NO WARRANTY OR UNDERTAKING, AND MAKES NO REPRESENTATION OF ANY KIND THAT SIEMSERVA WILL MEET CLIENT'S REQUIREMENTS, ACHIEVE ANY INTENDED RESULTS, BE COMPATIBLE, OR WORK WITH ANY OTHER SOFTWARE, APPLICATIONS, SYSTEMS, OR SERVICES, OPERATE WITHOUT INTERRUPTION, MEET ANY PERFORMANCE OR RELIABILITY STANDARDS OR BE ERROR FREE, OR THAT ANY ERRORS OR DEFECTS CAN OR WILL BE CORRECTED. SIEMSERVA PROVIDES SECURITY ASSESSMENT AND COMPLIANCE FRAMEWORK MAPPING CAPABILITIES BUT DOES NOT GUARANTEE COMPLIANCE WITH ANY SECURITY FRAMEWORK, REGULATION, OR STANDARD. CLIENT IS SOLELY RESPONSIBLE FOR ENSURING COMPLIANCE WITH APPLICABLE SECURITY REQUIREMENTS, REGULATIONS, AND STANDARDS. SIEMSERVA'S SECURITY FINDINGS AND REMEDIATION RECOMMENDATIONS ARE PROVIDED FOR INFORMATIONAL PURPOSES ONLY AND DO NOT CONSTITUTE LEGAL, COMPLIANCE, OR SECURITY ADVICE. 12. Limitation of Liability. IN NO EVENT WILL SENSERVA OR ITS AFFILIATES, LICENSORS, SERVICE PROVIDERS, EMPLOYEES, AGENTS, OFFICERS, OR DIRECTORS (COLLECTIVELY, "SENSERVA PARTIES") HAVE LIABILITY FOR ANY DIRECT, CONSEQUENTIAL, SPECIAL, LOST PROFIT, PUNITIVE OR RELIANCE DAMAGES, OR INDIRECT LOSS FOR DAMAGES, REGARDLESS OF WHETHER SUCH DAMAGES ARE BASED ON CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR ANY OTHER THEORY OR FORM OF ACTION OR WHETHER THE SENSERVA PARTIES OR CLIENT KNEW OR SHOULD HAVE KNOWN OF THE LIKELIHOOD OF SUCH DAMAGES IN ANY CIRCUMSTANCES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL THE AGGREGATE LIABILITY OF SENSERVA PARTIES EXCEED THE AMOUNT PAID BY CLIENT FOR SIEMSERVA IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. FOR ANY LICENSE PROVIDED AT NO CHARGE, INCLUDING DEMO LICENSES, REGISTERED LICENSES, AND NON-PROFIT LICENSES, SENSERVA'S MAXIMUM AGGREGATE LIABILITY SHALL NOT EXCEED ONE HUNDRED DOLLARS ($100). THE PARTIES AGREE THAT THE LIMITATION AND EXCLUSIONS OF LIABILITY AND DISCLAIMERS SPECIFIED IN THIS AGREEMENT WILL SURVIVE AND APPLY EVEN IF FOUND TO HAVE FAILED OF THEIR ESSENTIAL PURPOSE. THE LIMITATIONS SET FORTH IN THIS SECTION SHALL APPLY EVEN IF CLIENT'S REMEDIES UNDER THIS AGREEMENT FAIL OF THEIR ESSENTIAL PURPOSE. 13. Indemnification. Client agrees to indemnify, defend, and hold harmless Senserva Parties from and against any and all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including reasonable attorneys' fees, arising from or relating to Client's use or misuse of Siemserva or Client's breach of this Agreement, including but not limited to any actions taken based on Siemserva's security findings or recommendations. 14. Export Control. Siemserva may be subject to US export control laws. Client shall not, directly or indirectly, export, re-export, or release Siemserva to, or make Siemserva accessible from, any jurisdiction or country to which export, re-export, or release is prohibited by law, rule, or regulation. Client shall comply with all applicable federal laws, regulations, and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), prior to exporting, re-exporting, releasing, or otherwise making Siemserva available outside the US. 15. US Government Rights. Siemserva includes commercial computer software, as such term is defined in 48 C.F.R. §2.101. Accordingly, if Client is the US Government or any contractor therefor, Client shall receive only those rights with respect to Siemserva as are granted to all other end users under license, in accordance with (a) 48 C.F.R. §227.7201 through 48 C.F.R. §227.7204, with respect to the Department of Defense and their contractors, or (b) 48 C.F.R. §12.212, with respect to all other US Government licensees and their contractors. 16. Governing Law and Venue. The validity, interpretation, construction, performance, enforcement, and remedies of or relating to this Agreement, and the rights and obligations of the Parties to this Agreement, shall be governed and construed in all respects by the substantive laws of the State of Minnesota (without regard to the conflict of laws rules or statutes of Minnesota or any other jurisdiction that might result in the application of other law). Any legal action or proceeding arising under this Agreement will be brought exclusively in the federal or state courts located in Hennepin County, Minnesota, and the parties irrevocably consent to the personal jurisdiction and venue therein. 17. Force Majeure. Senserva will not be responsible or liable to Client, or deemed in default or breach hereunder by reason of any failure or delay in the performance of its obligations hereunder where such failure or delay is due to strikes, labor disputes, civil disturbances, riot, rebellion, invasion, epidemic, hostilities, war, terrorist attack, embargo, natural disaster, acts of God, flood, fire, sabotage, fluctuations or non-availability of electrical power, heat, light, air conditioning, or Client equipment, loss and destruction of property, or any other circumstances or causes beyond Senserva's reasonable control. 18. Notice. All notices and other communications required or permitted to be given hereunder shall be in writing and shall be deemed to have been duly given if delivered personally, by email, or mailed first class, postage prepaid to: Senserva, LLC, 4661 White Bear Parkway, St. Paul, MN 55110, Email: info@senserva.com, or to such other addresses as one party may have furnished to the other in writing. 19. Waiver. Failure by either party at any time to enforce any obligation by the other party to claim a breach of any term of this Agreement or to exercise any power agreed to hereunder will not be construed as a waiver of any right, power or obligation under this Agreement, will not affect any subsequent breach and will not prejudice either party in regard to any subsequent action. 20. Assignment. Client shall not assign or otherwise transfer any of its rights, or delegate or otherwise transfer any of its obligations or performance, under this Agreement, in each case whether voluntarily, involuntarily, by operation of law, or otherwise, without Senserva's prior written consent. For purposes of the preceding sentence, and without limiting its generality, any merger, consolidation, or reorganization involving Client will be deemed to be a transfer of rights, obligations, or performance under this Agreement for which Senserva's prior written consent is required. Any purported assignment, delegation, or transfer in violation hereof is void. Senserva may freely assign or otherwise transfer all or any of its rights, or delegate or otherwise transfer all or any of its obligations or performance, under this Agreement without Client's consent. This Agreement is binding upon and inures to the benefit of the parties hereto and their respective permitted successors and assigns. 21. Complete Agreement. This Agreement constitutes the entire agreement of the Parties with respect to Siemserva. There are no other agreements, either express or implied, with regard to this subject matter. This Agreement may only be amended, modified, or supplemented by an agreement in writing signed by each party hereto. This Agreement is for the sole benefit of the parties hereto and their respective successors and permitted assigns and nothing herein, express or implied, is intended to or shall confer upon any other person any legal or equitable right, benefit, or remedy of any nature whatsoever, under or by reason of this Agreement. In the event that any of the terms of this Agreement are in conflict with any applicable rule of law or statutory provision or otherwise unenforceable under applicable law or regulation, such terms shall be deemed stricken from this Agreement, but such invalidity or unenforceability shall not invalidate any of the other terms of this Agreement and this Agreement shall continue in full force and effect. 22. Updates and Modifications. Senserva reserves the right to provide updates, upgrades, bug fixes, patches, and other modifications to Siemserva. Client acknowledges that such updates may be automatically downloaded and installed. Client may elect to disable automatic updates through Siemserva settings, but doing so may limit functionality or security. Any updates to Siemserva shall be deemed part of Siemserva and subject to all terms and conditions of this Agreement. 23. Technical Support. Senserva shall provide email-based technical support for Siemserva at support@senserva.com. Support is defined as response by Senserva to electronic contacts initiated by Client to address the performance and functionality of Siemserva. Senserva will use commercially reasonable efforts to respond to support requests within two (2) business days. Support does not include assistance with Client's Microsoft 365 environment configurations, compliance framework requirements, or security remediation implementation. Technical support with the foregoing response objective is provided for Annual Licenses and Non-Profit Licenses during the active license term. Demo License and Registered License holders may submit support requests, which Senserva will address at its discretion without any committed response time. 24. Acknowledgment. CLIENT ACKNOWLEDGES THAT IT HAS READ THIS AGREEMENT, UNDERSTANDS IT, AND AGREES TO BE BOUND BY ITS TERMS AND CONDITIONS. CLIENT FURTHER AGREES THAT THIS AGREEMENT IS THE COMPLETE AND EXCLUSIVE STATEMENT OF THE AGREEMENT BETWEEN THE PARTIES. For questions regarding this Agreement, please contact: Senserva, LLC 4661 White Bear Parkway St. Paul, MN 55110 Email: info@senserva.com (c) 2026 Senserva, LLC. All rights reserved. Siemserva is a trademark of Senserva, LLC.