Evidence sources, connected once

Identity · Cloud

Single sign-on, MFA enrolment, and access reviews pulled on schedule.

Identity · Cloud

User inventory, conditional access policies, and privileged role changes.

Identity · Cloud

Admin roles, two-step verification settings, and account recovery events.

Identity · On-premises

Directory groups and privileged account membership from on-prem domains.

Cloud infrastructure · Cloud

Configuration evidence for accounts, storage, logging, and network rules.

Cloud infrastructure · Cloud

Subscription policies, resource configuration, and activity log exports.

Cloud infrastructure · Cloud

Project IAM, audit logs, and firewall rule snapshots.

Development · Cloud

Branch protection, reviewer rules, and admin action history.

Development · On-premises

Protected branches, approval rules, and self-hosted runner configuration.

Ticketing · Cloud

Change tickets linked to deployments, with approval trails.

Ticketing · Cloud

Change, incident, and problem records with assignment history.

Ticketing · Cloud

Issue workflow states and project membership as change evidence.

Communication · Cloud

Channel membership for incident rooms and approval announcements.

Communication · Cloud

Team membership and meeting policy settings for evidence packs.

Human resources · Cloud

Headcount, start dates, and termination events for access reviews.

Human resources · Cloud

Employee records and onboarding checklists feeding joiner workflows.

CRM · Cloud

Account and opportunity ownership for vendor and customer registers.

Endpoint · Cloud

Device encryption state, OS versions, and compliance profiles.