Live workspace. Durable storage schema active — live connectors, billing, and AI automation are activation-gated.View Activation Status
Signed out
Sign in as the approved QA user before running RLS-bound QA.
Sign in
Advanced / Operator Controls → Canary Rehearsal

Live-Read Canary Rehearsal

Dry-run execution rehearsal. First canary: Microsoft 365 / Entra ID.

PREVIEW TRANSPORT ONLYZERO WRITENO PROVIDER CALL
Preview only. No Microsoft connection. No OAuth. No live read. No write.

About this page

This page simulates a "canary" read of Microsoft 365 data. It proves that the ZAGOS engine can successfully parse identity and policy data without actually touching your live environment.

What you can do safely

  • View simulated compliance data
  • See how controls like MFA are mapped
  • Review simulated finding generation

What is currently blocked

  • Real Microsoft Graph call execution
  • Tenant Admin Consent
  • Real credential injection

Recommended Next Step

Review the detailed M365 Read Test Plan to understand the exact data we will request.

Review M365 Read Test Plan →
Technical Details & Simulation Logs

Preflight checks

  • Dry-run transport initialized
  • No real credentials injected
  • Network egress explicitly blocked
  • Schema isolated

Dry-run read-only request plan

  • Formulate identity read requests
  • Formulate tenant policy read requests
  • Formulate directory sync status read
  • No mutation scopes requested

Synthetic evidence fixture

{ "tenantPolicy": { "requireMfa": true, "legacyAuthenticationBlocked": true, "conditionalAccessEnabled": false }, "directorySync": { "lastSyncTime": "2026-06-28T00:00:00Z", "status": "Healthy" } }

Evidence normalization

  • mfa_enforcement: active
  • legacy_auth: blocked
  • conditional_access: inactive

Control mapping

  • IAM-01 (MFA) → Satisfied
  • IAM-02 (Legacy Auth) → Satisfied
  • NET-01 (Cond. Access) → Failed

Generated gaps / findings

High Severity Gap: Conditional Access not enabled
Evidence shows conditional access is inactive. This fails NET-01.
Remediation: Enable conditional access policies in Entra ID.

Abort simulation

  • API timeout > 5000ms
  • HTTP 401/403 returned
  • Payload size > 10MB
  • Data class violation
  • Unexpected write attempt
  • Missing owner approval

All abort safety breakers pass simulation.

Observation log

  • Rehearsal initiated
  • Dry-run preflight checks passed
  • Dry-run transport invoked
  • Synthetic payload received
  • Normalization complete
  • Gap generated: NET-01
  • Abort simulation complete
  • Rehearsal finished successfully

What remains parked before real execution

  • Owner configuration injection
  • OAuth client instantiation
  • Real Microsoft Graph call execution
  • Tenant Admin Consent

Navigation

← Back to Live-Read Preactivation Readiness
Secretless config guide