EsmerisOverall grade: B. Solid posture with a few items that need attention — most importantly one former-employee token and an admin without MFA. Addressing the critical and high findings would move this toward an A.
At a glance
Findings
criticalFormer employee retains active access
The account was deprovisioned in HR but still holds an active OAuth token granting access to . Revoke the token and confirm offboarding.
highAdmin account without multi-factor authentication
Privileged account has no MFA registered. Admin accounts are the highest-value target; enforce MFA immediately.
highOrg-wide consent to a broad-scope third-party app
was granted organization-wide access to read all users' mail and files. Review whether this scope is still required.
mediumConnected app from an unverified publisher
is published by an unverified developer and holds calendar and contact scopes for users.
lowDormant accounts still enabled
7 accounts (including ) have not signed in for over 90 days but remain enabled. Consider suspending or removing them.