Inventory and scanning

Dashboards, reports, policies, automations, reviews and provisioning all work on inventory data.

How it works

Objects, types and relations

Each item in the inventory is an inventory object, for example one Team or one user. Every object belongs to an object type, also called an entity, with its own properties. Objects are linked by relations, so you can see, for example, the owners, members and channels of a Team. The inventory reference lists every object type and its properties for each connector.

Scanning

Rencore Governance scans your Environment continuously, so there is no fixed time when all data is updated. It adjusts how often it reads each part to the amount of data, the connector, the effort it takes to read the data and how often it changes. Data that Microsoft APIs return quickly is updated more often than data that has to be crawled. Scans stay within Microsoft 365 throttling limits.

Each object type has an update interval: Daily, Weekly, Bi-Weekly or Monthly, and some elements also offer Never or Initial (collected once). The interval is a target, not a guarantee: the actual timing depends on the size of your tenant and on throttling. Under Configure objects you can lengthen the interval of less important objects, which leaves more capacity for the important ones. You can also turn off an object type, or a single property or relation. Turning off an object type removes its data and the policies that depend on it.

Partial scanning splits a scan into batches. Each batch is written to the inventory as soon as it is complete, and the policies, segments and reports it affects are recalculated right away. You see updated counts while a scan is still running, instead of only at the end.

You cannot start or schedule a scan yourself. Every completed and running scan job is listed under “All scans”.

The first scan

After you connect a tenant and give consent, the first scan builds the initial inventory. Depending on the size of your tenant, it can take up to 24 hours before the first data is shown.

Segments

A segment is a saved filter over inventory objects, for example every user whose country is the United States. Segments are recalculated as scans update the inventory. You can build one in the Segment Builder or create one from a report.

The inventory page

1. Date filter: 30 days, 3 months, 6 months, 1 year or 2 years of tile data.
2. Inventory options ([…]): configure objects, go to the inventory objects, or open “All scans”.
3. Connector tiles: the main objects of each connector. Hover over a tile and click “Go to Inventory” to list all objects of that connector.

The object list shows, for each object type, the New and Removed counts, the date of the last scan and a trend for the selected period. From here you add or import segments, open “All scans” and configure objects.

Example

You turn on the Teams connector and give consent. The first scan reads every Team, with its owners, members, channels and settings, into the inventory. From then on, scanning picks up new and removed Teams on its own. The policy template “Teams with external users” checks the same data and lists each Team with external users as a violation, and a segment of those Teams can feed a report or a dashboard tile.

How it relates to other concepts

• The inventory belongs to one Environment. What is scanned depends on the connectors you turn on and the consent you give.
• Policies and reports are queries over the inventory, each built on one primary object type.
• An automation triggered on a policy violation runs after the next scan of its connector. If an object type is scanned monthly, the automation also runs monthly. See Built-in actions, automations and automation actions.
• A segment filters objects inside the inventory. A Virtual Environment splits the whole Environment. They are separate features.
• Custom Metadata, an add-on, adds your own properties and object types to the inventory.