Recommendations

In short

Every recommendation is one security check with a clear state. Griffin31 decides Passed, Partial or Failed; your team decides Approved or Excluded.

A recommendation is one security check on your Microsoft 365 tenant, for example “Require MFA for all admin roles”. Griffin31 checks each one on every scan and shows the result, the risk, and how to fix it.

---

States

Every recommendation has one state. The state also tells you who decided it: Griffin31 or a person on your team.

State	Who decided	Meaning
Passed	Griffin31	The latest scan found this set correctly
Partial	Griffin31	Set for some users or devices, not all
Failed	Griffin31	The latest scan found this not set. See Remediation
Not reviewed	Waiting for you	Needs a manual check. Approve it once done. For an automatic check, the next scan updates the result
Approved	Your team	Checked by hand and marked OK
Excluded	Your team	Left out on purpose, with a reason
Needs license	Your licenses	Needs a license your tenant doesn’t have. Hover the state to see which one

---

Quick Filters

The boxes at the top of the list filter it in one click:

Box	Shows
Passed / Approved / Not reviewed / Excluded / Needs license	Recommendations in that state
Failed	Failed and partial recommendations
Quick wins	Recommendations that need action, are easy to fix and have a low impact on users
In threats	Part of at least one threat’s attack path

The list opens on Failed and Not reviewed. Reset to default brings that back.

Filters, Columns and Views

• Filters adds state, title, product, risk, user impact, effort, scopes, who signed a decision, when an approval or exclusion expires, assignee, license, operating system and validation method.
• The default columns are State, ID, Title, Product, Risk, User impact and Effort. You can show more, such as Score, Scopes, Assigned to, License or Validation method.
• Table views has ready-made views: All, Needs action (failed, partial or not reviewed), Quick wins and Bonus pending (bonus points still to earn). You can also save your own views.

---

Recommendation Details

Click a recommendation to open its details panel. The top shows its ID, product and name.

Action Banner

Under the tabs, a banner stays in view while you scroll. It shows the state and, when your team made a decision, who made it and when, the reason, and the until date. When that date passes, the banner shows Expiry pending next scan: the expiry is applied at the next scan.

Tabs

Tab	What you find there
Overview	Risk, user impact, effort, score, MITRE technique and who signed the decision. Then the Risk description, the User impact, the Regulations it maps to (each opens that framework in Compliance), its MITRE ATT&CK techniques, and Reference links
Requirements	The Licenses and Included license plans it needs, Related recommendations with their state, Related stories, and its operating system, scopes and validation method
Remediation	Numbered Remediation steps, and at most one note to read before you change anything
Evidence	The data behind the result. See Evidence
History	Every change to this recommendation: when, what happened, who, and the details such as reason, expiry and notes

At the bottom of the panel, Edit changes the decision and Open case assigns the recommendation. Both are for the Admin and User roles.

---

Decisions

Select Edit to open Edit decision. There are two kinds of decision.

Approve

You checked it and it meets the recommendation. Only manual checks can be approved. Choose a reason:

• I checked it, it’s set correctly
• We fixed it
• Other (a note is required)

Approving a manual check that isn’t part of a threat earns bonus points.

Exclude

Another tool covers it, it doesn’t apply, or you accept the risk. Choose a reason:

• I use a third-party tool
• Risk accepted
• Other (a note is required)

For both decisions you can add a note for future reviewers and an optional Active until date. When that date passes, the decision expires at the next scan and the recommendation is checked again.

Remove decision returns the recommendation to Not reviewed. For an automatic check, the next scan updates the result.

Every decision is saved in the History tab and in Recent activity with who made it and when.

Tip: an exclusion is a business decision, not a fix. Use a clear reason and an expiry date so it gets reviewed again.

---

Open a Case

Open case assigns the recommendation to a teammate:

1. Choose an active teammate under Assign to.
2. Add an optional Assignment note with context for the assignee.
3. Select Open case.

Griffin31 emails the person you assign, and the recommendation shows in their Cases. When a case is already open, the button reads View case, and you can change the assignee or the note.