After your first scan

Your tenant is connected and the first scan has filled your inventory. This guide shows what to look at first and walks you through a first policy, a first fix, a first automation and a first dashboard. At the end you have a small working setup you can build on.

Before you begin

You will need:

• A Workspace with a connected tenant, set up as in Set up Rencore Governance, and a first scan that shows data for Teams, SharePoint and Microsoft 365.
• The Contributor, Admin or Owner role. Contributors create policies, automations and dashboards. Readers can only look. See Roles and teams.
• An administrator who can give consent, the first time you run a built-in action that needs more permissions.

Step 1: Check what was scanned

1. Click “Inventory” on the navigation bar. Each connector tile shows its main objects.
2. Hover over the Teams tile and click “Go to Inventory”. The list shows each object type with its New and Removed counts and the date of its last scan.
3. Click “Inventory Options” ([…]), then “All scans”, to see which scan jobs have finished and which are still running.

You should now see objects for every connector you gave consent for. If a connector is empty after a day, check its consent: click “Settings”, “Environment Settings”, then the ellipses menu ([…]) on “General Settings” and “Manage consent”. See also Troubleshooting. How scanning works is explained in Inventory and scanning.

Step 2: Turn on your first policies

Start with a few policy templates that cover owners, external access, permissions and licenses. Each one is in the “Policy Template Library”:

Policy template	Connector	Severity	What it finds
Teams with very few owners	Teams	High	Teams with one owner or none
Teams with only disabled owner accounts	Teams	Medium	Teams whose owners all have disabled accounts
Groups with external users	Microsoft 365	Medium	Microsoft 365 Groups that have external members
SharePoint site has broken permission inheritance	SharePoint	Medium	Sites with permissions that differ from their parent
Licenses assigned to disabled users	Microsoft 365	Medium	Licenses still assigned to disabled accounts

To turn on a policy template, you will need to:

1. Click “Policies” on the navigation bar.
2. Click “Policy Options” ([…]), then “Create Policy”, and open the “Policy Template Library”.
3. Search for the template by name, or filter by Service, Category and Severity, and click it.
4. Review the logic on the “Logic” screen and click “Next”.
5. Review the title, category and severity on the “Details” screen and click “Save”.
6. Choose to save and turn on the policy.

The full steps are in Create a policy from a template. The policy templates reference lists every template for each connector.

You should now see results for each policy, based on the data of the last scan. On the Policies page, each connector tile shows a compliance score and its top five policies.

Step 3: Look at the violations

1. On the Policies page, click the title of “Teams with very few owners”.
2. Look at the list of violations: each row is one Team that breaks the rule.
3. Go back and click the policy’s trend to see the total, new and removed violations and how many Teams out of all Teams break the rule.

Severity tells you where to start. See Policies and violations.

Step 4: Fix one object by hand

To fix a single violation straight away, you run a built-in action on the object. You will need to:

1. Click “Inventory”, hover over the Teams tile and click “Go to Inventory”.
2. Click the Team you saw in the violation list, then click “Go to Object”.
3. On the details page, click “Add or remove owner to/from a Team” and add a second owner.
4. If you are asked for permissions, click “Give Consent” if you are an administrator, or “Ask admin for consent” to send a link to one.

After the next scan, the Team no longer matches the policy and is counted as removed. See Executing an action.

Step 5: Add your first automation

For the other Teams, and every Team that matches in future, let an automation ask the owner to act. To add it, you will need to:

1. Click “Automation” on the navigation bar, then “Add Automation”.
2. In the “Automations Template Library”, choose “Send one email per Team owner”.
3. Edit the trigger: choose On Policy Violation and select the policy “Teams with very few owners”.
4. Review the email action and the details. Keep the threshold limit low for a first run, for example 10 objects.
5. Save the automation as a draft, check it, and turn it on when you are ready.

The full steps are in Create an automation from a template. When to use a built-in action and when to use an automation is explained in Built-in actions, automations and automation actions.

Step 6: Add a dashboard

1. Click “Dashboards” on the navigation bar, then click “Create Dashboard”.
2. In the “Dashboard Template Library”, add a prebuilt dashboard, or create a custom one and add tiles for your new policies.
3. Share the dashboard with the people who should follow the results.

See Create a dashboard and Reports and dashboards.

What you see

You know what was scanned, you have five active policies with their violations, you fixed one object by hand, an automation follows up on the rest, and a dashboard shows the results.