5 open, 1 resolved · last scan 03 Sep 09:42
IDFinding & evidenceControl areaPriorityStatusTarget
F-001Blocker
Org-wide sharing links on 3 high-traffic sites
Legal, HR and Finance document libraries are reachable by "Everyone except external". Copilot would surface this content to any internal user the moment it is enabled.
F-002Blocker
Sensitivity label coverage at 61%
Auto-labelling policy AL-04 is drafted and waiting on GDC approval to publish. Coverage must reach 90% before the wider rollout gate.
F-003
9 guest accounts inactive beyond 90 days
These retain Copilot-relevant Graph access until removed. Removal batch is approved and scheduled.
F-004
Legacy authentication on 2 service accounts
Legacy auth bypasses Conditional Access. The owning application has not yet been identified – enquiry open with GDC IT.
F-005
DLP policies not extended to Copilot interactions
Existing DLP rules cover mail and endpoint only. Four rules are being extended to Copilot output under change CHG-1187.
F-006
Audit log retention set to 90 days
GDC policy requires 12 months. Retention was lifted to 365 days and verified.
Findings are also on the dashboard board alongside change requests, your actions and deliverables. Click any row for full detail and activity.