Security alerts

Insights → Security reads Microsoft Secure Score, MFA coverage, Conditional Access posture, Global Administrator count and at-risk accounts from a connected Microsoft 365 tenant. On plans below Growth it's locked; on Growth or above it asks you to connect a tenant first — see "Connecting Microsoft 365". Once connected it shows your current Secure Score, a score trend (once there are two assessments), and a checklist of specific issues with plain-English fixes: MFA for everyone (security defaults or Conditional Access), MFA for admins, accounts able to complete MFA, legacy authentication blocked, two to four Global Administrators, no disabled users still holding licences, and risky users. Download PDF saves it as the Security Assessment report. The assessment re-runs itself every night after a successful sync, and each failing check becomes a critical "Security check failures" alert on the Alerts page rather than sitting in a report nobody reads (checks that only warn don't raise alerts). A few checks depend on Microsoft licensing and extra Graph permissions (risky users needs Entra ID P2, for example; MFA for everyone needs Conditional Access to be readable) — where Microsoft can't be read the check reports as Not assessed, with the reason, rather than failing: it's neither a pass nor a fail, it raises no alert, the PDF and the QBR count it in its own column, and Fleet shows it beside the failures. A permission that was never granted is fixed by reconnecting from Settings → Integrations; a one-off outage on Microsoft's side keeps the check's last known result until the next night.