Evidence and scans

Audience: ISMS Admin.

Where: the Certaria app. Scans read your Microsoft 365 configuration in the background.

Why this matters: most of your ISO 27001 evidence already exists in your Microsoft 365 configuration. This is the part of Certaria that finds it, and it runs whether or not anyone is watching, which makes it the part administrators understand least.

What a scan reads

Every scan reads seven sources at once:

Source	What it evidences
Microsoft Secure Score	Overall security posture, including the individual control recommendations behind the score
Intune device management	Endpoint and asset controls
Sensitivity labels	Information classification and handling
Audit logging	Monitoring and logging controls
Conditional Access	Access control and identity
Directory role assignments	Privileged access: who holds administrative roles
OAuth grants and service principals	Third-party application access to your tenant

Each source credits the Annex A controls it supports, and the result lands in Scan History.

Evidence is only ever added, never removed

A scan credits controls. It does not withdraw credit from a control it did not reach this time. So if one source fails, the evidence it produced last time stays in place rather than disappearing, and your Statement of Applicability does not lurch about because a permission expired overnight.

When scans run

What	When	Notes
Daily readiness scan	Once a day	Started by Certaria: Schedule Evidence Scan, which hands the work to the shared scan
On-demand scan	When you start one yourself	The same seven sources. Certaria calls this Sync Now
Device compliance top-up	Every day	Refreshes device controls only if device evidence is more than 48 hours old
Device register sync	Once a day	Brings your Intune-managed devices into the asset register

The device top-up is worth understanding. It exists so device evidence never goes stale between full scans, and it does nothing at all when a recent scan has already covered those controls. A day where it does nothing is a day it worked.

Turning off the daily scan does not stop you scanning

Switching off Certaria: Schedule Evidence Scan stops the automatic daily run and leaves scans you start yourself working exactly as before. That is the right switch if you want scanning under your own control rather than none at all.

Your devices in the asset register

The daily device sync adds or updates each Intune-managed device with its compliance state, operating system version, and when it last checked in with Intune. Your asset register stays current without anyone typing into it.

What it does not do is decide anything. Whether a device is in scope, who owns it, and what happens when it falls out of compliance are all yours.

When a scan reports errors

You will receive an email headed “Readiness Scan completed with errors”. The scan finished; one of its sources did not.

1. Read the error line. It names the source, for example Sensitivity Labels: Failed.
2. The usual cause is a missing Graph permission. The app registration lacks the permission for that source, or consent was granted as Delegated rather than Application. See Graph consent.
3. Re-run the scan. A clean run sends no email.

The scan deliberately completes rather than aborting: six sources of evidence collected is better than none, and you get told precisely which one is missing.

Reading the results honestly

“No evidence” and “not applicable” are different things, and only you can tell them apart. A control with no evidence might be one Certaria cannot see, one you have implemented outside Microsoft 365, or one that genuinely does not apply to you. The scan reports what it found. The Statement of Applicability is where you record what it means.

A control evidenced automatically is still your responsibility. Certaria can show your auditor that Conditional Access policies exist. It cannot tell them the policies are the right ones.

Common failure modes

Symptom	Cause	Fix
Scan email lists a failed source	Missing or wrongly typed Graph permission	Check the permission is under Application permissions with admin consent
Device evidence looks stale	The top-up only fires when evidence is over 48 hours old	Expected. Run a full scan if you need it now
Fewer controls evidenced than last time	A source failed, or something genuinely changed in your tenant	Check Scan History and the most recent scan email
No scans at all in Scan History	The daily schedule flow is switched off	Turn it on in the solution’s cloud flows list
Devices missing from Assets	They are not Intune-managed, so Certaria cannot see them	Add them by hand, or bring them under Intune

Next

• The Statement of Applicability, where evidence becomes a decision
• Graph consent, if a source is failing
• Troubleshooting