Run Your First Scan

Once your tenant is connected, you can run a scan immediately from the dashboard.

What the scan checks

Every scan tests your tenant against established security benchmarks:

• CIS Microsoft 365 Foundations Benchmark - 100+ controls across identity, data, email, applications, and audit logging
• EIDSCA (Entra ID Security Config Analyzer) - in-depth Entra ID configuration checks
• CISA SCuBA - U.S. Cybersecurity and Infrastructure Security Agency's M365 security baseline

Each check returns one of three results: Passed, Failed, or Skipped (when the check is not applicable to your configuration).

Starting a scan

1. From the dashboard, click Run Scan in the top-right corner.
2. The scan starts immediately.

If you have multiple tenants connected, the scan runs against the currently active tenant shown in the tenant switcher (top navigation bar).

The dashboard displays an active scan banner with a pulsing indicator showing the scan type, when it started, and whether it was triggered manually or by the scheduler. Click View scan on the banner to go to the scan detail page.

TIP

You do not need to keep the browser open. The scan runs in the background and you receive an email when it completes.

What to expect

Scans typically complete in 10 to 15 minutes. The exact duration depends on the size of your tenant and the number of users, groups, and policies.

During the scan:

1. Aether365 authenticates to your tenant using the read-only service principal
2. Reads configuration data across the selected services
3. Evaluates each check against the benchmark
4. Writes results to your dashboard
5. Sends an email summary to your registered address

The scan detail page shows a phase progress indicator while the scan is running: initialization, scanning, analysis, completion.

After the scan

When the scan completes, the dashboard updates with your results. Click the completed scan in the recent activity table or navigate to Scans in the sidebar to see all your scans.

Compliance scan results

The compliance scan detail page shows:

• A large security posture score (percentage of checks passed) with a status label: Excellent, Good, Needs attention, or Critical risk
• A change indicator showing the score delta compared to your previous scan
• A stacked bar showing passed, failed, and skipped counts visually
• Framework tiles (All, CIS, EIDSCA, CISA) - click a tile to filter results by framework. Each tile shows its own check count and pass rate ring
• Check results grouped by section (e.g. CIS 1.1 Account and Authentication, CIS 5.1 Auditing) with expandable rows showing control ID, title, severity, and remediation guidance
• A download button for the full report

Scan statuses

Status	Meaning
Completed	Scan finished successfully
Running	Scan is currently in progress
Pending	Scan is queued and will start shortly
Failed	Scan did not complete - see Scan Failures
Cancelled	Scan was manually cancelled before completing

See Reading Results for a full walkthrough of how to interpret your scan results.