AccessAudit

Purpose

Provide credible Microsoft 365-style access-review proof without requiring or publishing a live tenant.

What it proves

• permission-matrix modelling;
• privileged, guest, stale, and broad-access risk flags;
• explicit human Retain, Remove, and NeedsReview decisions;
• remediation tracking separated from recommendation;
• sign-off gates and retained audit evidence;
• native reporting for risk and review completion;
• export views that exclude private reviewer notes;
• deterministic tests and native API smoke validation;
• cross-platform Ubuntu CI;
• public-safe synthetic evidence.

Run locally

Verify

Evidence groups

The eight screenshots under `docs/screenshot-groups` were captured from the running native ASP.NET Core application during v1.0.0 manual review.

• **SG01 - Permission Matrix and Risk Review**
• **SG02 - Remediation, Sign-off, and Audit Evidence**

Security and data boundary

The directory is entirely synthetic. No tenant IDs, real users, group memberships, Microsoft Graph credentials, tokens, or live permission writes are included.

Out of scope

• no live Microsoft 365 or Entra tenant connection;
• no Microsoft Graph write operations;
• no automated access removal;
• no production authentication or persistent database;
• no real user, group, tenant, or permission data;
• no production compliance certification.

Rights

Public visibility does not grant a blanket open-source licence. See `RIGHTS_AND_LICENSING.md`.

Created by **Codie Shannon**.