GOV — Governance & License

Governance, process and license controls. 10 controls in total — 8 automatic, 2 attested.

How to read

Result: ✅ Pass · ⚠️ Warning · ❌ Fail · N/A Not evaluated. Status: Auto = Controlio measures it app-only · Attested = the customer marks it. Lv: L1 basic, L2 advanced.

Control	What it checks	Result criteria	Status
GOV-01 Trial license security risk L1	Checks the security risk from trial licenses. When a trial ends, the security controls tied to it can turn off.	✅ None (0) · ❌ One or more	Auto
GOV-02 No suspended licenses L1	Checks for suspended licenses. A suspended license disables the security features tied to it.	✅ None (0) · ❌ One or more	Auto
GOV-03 Group count tracking L1	Checks the total number of groups. Uncontrolled group growth makes management harder.	✅ 200 or fewer · ⚠️ More than 200	Auto
GOV-04 Dynamic group usage L2	Checks the use of dynamic groups whose membership is assigned automatically. Managing groups by hand raises the chance of error.	✅ 3 or more · ⚠️ 1–2 · ❌ None	Auto Requires Business Premium (Entra P1); N/A otherwise
GOV-05 Administrative Unit structure L2	Checks whether administrative units that limit how far authority spreads are defined. Without them, delegation stays uncontrolled.	✅ At least one · ⚠️ None	Auto Requires Entra ID P2; N/A otherwise
GOV-06 On-premises sync status tracking L1	Checks whether sync status with the on-premises directory is monitored. A sync failure affects user access.	✅ Status available · ⚠️ No info	Auto
GOV-07 License usage rate (waste check) L2	Checks how much of the purchased licenses is actually used. Unused licenses waste money.	✅ 80% or higher · ⚠️ 60–79% · ❌ Below 60%	Auto
GOV-08 No ownerless groups L1	Checks for groups with no defined owner. Ownerless groups fall outside management.	✅ None (0) · ⚠️ 1–5 · ❌ More than 5	Auto
GOV-10 Admin continuity plan L1	Checks the continuity plan that keeps critical admin roles from resting on a single person. If it rests on one person, their departure locks tenant management.		Attested Customer attestation (not measured automatically)
GOV-11 Periodic security audit reporting L1	Checks the frequency and distribution list of regular tenant-level security audit reports. Without them, drops in security posture go unnoticed.		Attested Customer attestation (not measured automatically)