Assessment Report — Guide

A point-in-time evaluation of your Microsoft 365 security and compliance posture.

The Kyvoi Assessment Report scans your tenant across dozens of security controls, maps each to the compliance frameworks you care about, and produces an audit-ready report with prioritized fixes and an AI advisory. This is a separate product from Continuous Monitoring — the report is a snapshot you retrieve on demand.

What the report does

Assesses your Microsoft 365 configuration across identity, email, data protection, and cloud app security.
Maps every control to frameworks — SOC 2, ISO 27001, NIST, CIS, PCI DSS, HIPAA, and India-specific frameworks (DPDP, RBI, SEBI, CERT-In).
Overlays MITRE ATT&CK so you see how each gap relates to real attacker techniques.
Prioritizes fixes by effort-to-impact, with exact remediation steps and portal links.
Includes an AI advisory — a tenant-specific CISO brief, attack-scenario analysis, and a 30-day roadmap.
Produces audit-ready evidence mapped to what an auditor will ask for.

Per-service assessments

You can scan a single service on its own — for example, just Identity & Access or just Email Security — and view it through the framework of your choice. Each service assessment covers all of that service's controls, with the selected framework and MITRE ATT&CK applied as overlays.

What permissions Kyvoi needs, and why

Kyvoi uses read-only Microsoft Graph permissions, granted through Microsoft's standard OAuth 2.0 consent flow. No configuration is ever changed during an assessment — Kyvoi only reads.

Area	Example read-only permissions	Why it's needed
Directory & users	`Directory.Read.All`, `User.Read.All`, `Group.Read.All`	Read tenant, user, and group configuration to assess identity controls
Policies	`Policy.Read.All`, `Policy.Read.ConditionalAccess`	Evaluate Conditional Access and security policies
Identity protection	`Policy.Read.IdentityProtection`, `IdentityRiskEvent.Read.All`	Assess risk-based policies and sign-in protections
Roles & privileged access	`RoleManagement.Read.All`, `PrivilegedAccess.Read.AzureAD`	Review admin roles and privileged access
Authentication methods	`UserAuthenticationMethod.Read.All`	Check MFA and authentication method configuration
Domains & audit	`Domain.Read.All`, `AuditLog.Read.All`	Verify domains and read audit configuration
Email (Exchange)	Exchange read scopes	Assess email security controls such as anti-phishing and safe links

The exact set is shown to you on the Microsoft consent screen before you approve anything. You review every permission there and grant them explicitly.

What Kyvoi does not access

Kyvoi does not request write permissions during an assessment — it cannot change any setting.
Kyvoi does not read the contents of your emails, files, or messages. It reads configuration — policies and posture — not user data.
Kyvoi does not access physical security, network infrastructure, or third-party apps outside Microsoft 365 unless explicitly noted.

Some controls may show as "not assessable" if a permission, license, or API isn't available on your tenant. These don't count against your score and are noted as coverage limitations, not failures.

How you receive the report

After you consent, the assessment runs and your report opens in your browser — typically within a couple of minutes.
You can download the report as a PDF to keep, share, or give to an auditor.
An AI Agent session accompanies the report, where you can ask questions about findings and remediation.

Frequently asked questions

Does Kyvoi change any of my settings?
No. The assessment is strictly read-only.

Can Kyvoi read my emails or files?
No. Kyvoi reads configuration and policy — not the contents of emails, files, or messages.

Why does it ask for so many permissions?
Each read-only permission maps to a set of controls the report evaluates. You see the full list on the consent screen. Scanning a single service requests only that service's permissions.

Is this the same as Continuous Monitoring?
No — the report is a point-in-time snapshot; monitoring is a separate, ongoing product.