Work with your security findings
How to read a finding, where to fix it across Microsoft 365, email, and devices, and how your score updates afterwards.
Anatomy of a finding
Every check produces a finding. Click any finding on your dashboard to expand it. Each one gives you:
Critical, high, medium, low, or info - how much this issue matters.
A plain-language explanation of the risk - no jargon.
The exact users, apps, policies, or devices that triggered the finding.
Step-by-step remediation, including the exact admin portal to use.
How scoring works. Each pillar starts at 100 and loses points for every issue: critical -15, high -10, medium -5, info 0. A warning (partial pass) is a flat -5. Work top-down: fix Critical and High findings first for the biggest gains.
Findings are license-aware. When a real gap exists but closing it needs a higher Microsoft license (for example device code flow, which needs Conditional Access, or advanced email protection), PosturIQ shows a warning and suggests the upgrade rather than failing the check outright. Where a check can't be evaluated at all without the license, it's marked "not available" and left out of your score instead of counting against you.
The three pillars, and where to fix each
PosturIQ scores three areas. Every finding already tells you exactly what to change and names the setting - this is just the map of which console each pillar's fixes live in.
Microsoft 365 identity
Who can sign in and how: MFA, conditional access, admin roles, OAuth app consent, stale and guest accounts, audit logging, and external sharing. Most fixes live in the Entra admin center (Conditional Access, Users, Roles, Enterprise apps), with a few in the Microsoft 365 admin center, Microsoft Purview (audit log), and the SharePoint admin center (external sharing).
Email security
Anti-phishing, anti-spam, malware filtering, auto-forwarding, spam-filter bypasses, DKIM/DMARC, and external-sender tagging. Most fixes live in the Microsoft Defender portal (Threat policies and preset security policies), with a few in the Exchange admin center.
A few of the strongest email protections (impersonation defense, Safe Links and Safe Attachments) need Microsoft Defender for Office 365 (Plan 1+), included in Microsoft 365 Business Premium, E3, and E5. On tenants with Exchange Online Protection only, those checks show a warning and suggest upgrading, rather than fully failing.
Device security
Endpoint hardening: malware protection, disk encryption, firewall, OS patching, remote access, screen lock, and more. These are fixed on the device itself - in Windows Security and Settings, or macOS System Settings - not in a cloud portal. The expanded finding lists the exact steps for each platform.
Devices: the fleet view and per-device detail
Identity and email each score your whole tenant, but devices are scored one machine at a time. That's why device findings have two views of their own.
All devices
The fleet list shows every enrolled machine, newest check-in first. Each card carries that device's own 0-100 score and a trend arrow versus its last check, its OS, the logged-in user, and when it last reported, plus a badge or two naming its top fail or warning. A machine that hasn't reported in a while gets a stale flag so you can spot devices that are offline or decommissioned. Up top, a health breakdown groups the fleet into Good, Fair, and At risk, and you can filter to just Windows or just macOS.
Device detail
Click any device to open its own page: its score, OS and hardware details, and every check it ran - failures first, then warnings, then passes and anything not applicable. Each check reads exactly like an identity or email finding - status, detail, why it matters, and the precise fix for that machine - so remediating a laptop follows the same anatomy as the rest of the report. Prev and next buttons let you walk the fleet without going back to the list.
Software updates
The Software updates view rolls up pending updates across the whole fleet in two parts:
OS updates - devices whose operating system is behind on patches, sorted by how long since the last patch (oldest, most urgent first). This maps to the OS patching check, which is a scored, critical part of each device's score.
App updates - outdated third-party applications aggregated across the fleet, showing each package's install count, the oldest version still installed, and the version available. Expand a row to see exactly which devices are affected and jump to any of them.
The app update list is informational - it's there for visibility and inventory and does not lower a device's score. Falling behind on OS patches does, through the OS patching check.
After you fix something, your score updates on the next scan
A fix in Microsoft or on a device doesn't change your PosturIQ score instantly. The score reflects the last scan, so PosturIQ has to look again before a finding clears.
Microsoft 365 and email changes
After changing a setting in an admin portal, PosturIQ picks it up on the next scan. You have two options:
Run a manual scan - open the ⋮ actions menu on your dashboard and choose Run manual scan. It finishes in about a minute.
Wait for the weekly scan - PosturIQ scans automatically on your schedule (weekly by default) and emails you the updated report.
Device changes
Each device re-checks itself on its own weekly schedule (the installed task runs on a random weekday to spread load), so a device's score refreshes within a week of your fix. To confirm a fix right away, run the installed PosturIQ scheduled task on that device now - on Windows, run the PosturIQ Check task from Task Scheduler; on macOS, trigger the PosturIQ launch daemon. Results appear on your dashboard within seconds.
Fixed it but the finding is still there? You're almost certainly looking at pre-fix scan data. Run a manual scan (identity/email) or run the device's installed PosturIQ check task now, then refresh. If it persists, re-check the exact setting named in the finding's suggested fix.
When a finding is a deliberate exception: accept the risk
Some findings flag configuration you've chosen on purpose - a break-glass account excluded from MFA, a vetted third-party app with broad permissions, a partner guest account that needs standing access. Rather than let it pin your score down forever, you can accept that specific item as a known, documented risk. The finding stops counting against your score, but PosturIQ keeps watching: if a new unaccepted item appears later, it re-flags on its own.
Item-level, not check-level - you accept a specific account, app, or policy, never a whole check. New items still get flagged.
Accountable - every acceptance needs a reason and records who approved it and when. It shows on the finding and in your PDF and CSV reports as an audit trail.
Reversible - revoke any time. And if an accepted item disappears from your tenant, PosturIQ marks it "safe to remove" rather than hiding it.
To accept an item, expand the finding, click accept next to the item, and enter a reason. Acceptance applies on the next scan, so run a manual scan to see the score update. It's available on the checks where a specific item is most often a deliberate exception:
MFA enforcement · Legacy authentication · Device code flow
Guest user access · Inactive licensed users · Third-party OAuth app permissions