Evidence
Evidence shows the data Griffin31 used to reach each result. It answers the question every security team asks: “Failed? Where exactly?”
You’ll find it in the Evidence tab of every recommendation.
What You See
Section titled “What You See”Evidence is a table of the items behind the result: users, admin roles, Conditional Access policies, devices, mailboxes or tenant settings, depending on the check. Each row shows the details that matter for that check, for example a user’s principal name and last sign-in.
- Search the table to find a specific user, policy or device.
- Depending on the check, Evidence lists every relevant item, or only the items that need attention.
How to Use It
Section titled “How to Use It”| Goal | How Evidence helps |
|---|---|
| Fix | See exactly which users, policies or devices need to change, instead of searching the admin centers |
| Verify | After a fix, the next scan updates the Evidence and the state, so you can confirm the change worked |
| Prove | Show auditors, management or customers the actual data behind a result |
| Decide | Before you mark a recommendation as reviewed or exempt it, check the data the decision is based on |
Evidence and Compliance
Section titled “Evidence and Compliance”Compliance frameworks are built from recommendations, and each recommendation carries its own Evidence. This makes Evidence the base for audit preparation in Griffin31. See Compliance.
Privacy: Evidence comes from the same read-only data Griffin31 already scans. Griffin31 never reads email content or files. See Connector Permissions.