Microsoft Cloud Findings Now Follow Their Connection
September 20, 2026 · InfraScout Team
A finding from a host has always been as visible as the host: if you cannot see the agent, you cannot see what was found on it. Findings from Microsoft Cloud assessments had no host to follow, so every authenticated user in your tenant could see them. As of this release they follow the Entra connection they came from instead. A user who can see a connection sees its cloud findings, and a user who cannot, does not.
For anyone assessing more than one tenant, that is the change that matters. One customer's Entra, Defender and Microsoft 365 findings are now visible only to the people you granted that customer's connection.
Action required for tenant admins
Connections are visible to admins only until you grant them, so right after this release most Microsoft Cloud findings are visible to admins only. That is the closed-by-default model applied to findings, not missing data. Admins still see everything, so you will not notice it yourself.
Open each connection under Role Management → Connectors and grant the groups that work that tenant through the shield on its card. Their cloud findings appear for those users as soon as the grant takes effect. Then check the admin-only findings that could not be tied to any connection, as described below.
One finding, one place its visibility comes from
Every finding now takes its visibility from exactly one place: the host it was recorded on, or, when there is no host, the Entra connection it came from. There is no overlap and no third case. A cloud finding that names a machine in its text still belongs to its connection, because naming a machine is not the same as having been found on it.
The connection's own grant does the work. The groups you name on a connection already decide who can point the Microsoft Cloud tools at that tenant; now they also decide who sees what those tools found. You manage one list per tenant, not two.
Disabling a connection stops new calls against it but hides nothing it already found. Deleting a connection makes its findings admin-only, since there is no longer a grant for them to follow.
Each tenant keeps its own findings
With several connections in one InfraScout tenant — the usual setup when you manage several customers — the same check can come up in more than one of them. Each connection now keeps its own copy of the finding. The same check failing in two customer tenants is two findings, each attributed to its own tenant and each visible only to that tenant's people.
Holding two or more connections? Re-run your cloud assessments once per tenant
Before this release, the same finding reported through a second connection could replace the first connection's copy and appear under the wrong tenant. Findings saved from now on stay separate, but earlier ones are not split apart after the fact. Re-run your Microsoft Cloud assessments once against each connection, and every tenant gets its own correctly attributed set of findings.
See which tenant a finding belongs to
The Insights page now shows the connection wherever it matters. A cloud finding's Host cell carries a cloud badge naming its connection, so a list mixing several tenants reads at a glance. The Filters panel has an Entra connection filter that narrows the list to one tenant, which is the quickest way to work through a single customer's findings. The detail view names the connection in the slot a host finding uses for its host.
Connection names show for every user, not only admins, limited to the connections each user can see.
Placing the findings that had no connection
When this release went live, InfraScout attributed existing cloud findings to their connection wherever it could tell which one they came from: findings from a workflow that pins a connection, and findings from a conversation that used exactly one. The findings it could not place are visible to admins only.
They are the cloud findings in the list that carry no connection badge. To place one, open it as an admin. The detail view's rail carries a Visibility card with an Entra connection picker. Choose the connection the finding belongs to and it becomes visible to everyone that connection grants, usually within a minute. Choosing Not attributed — admin only takes it back, after a confirmation, since everyone who could see it through the connection loses access.
Re-running the assessment in chat as an admin works too. When a finding with no connection comes up again against a connection, it is attributed to that connection rather than recorded twice.
The AI names the connection too
The insight tools resolve a connection the same way the Microsoft Cloud tools do. insight_save records an agentless finding against the connection you name, or against the only connection you can see; when you can see several and name none, it refuses and lists them rather than guessing. insight_list can filter to one connection, and a by-key insight_delete resolves the connection the same way a save does, so it removes exactly the finding a save with the same arguments would write. The Insight Tools reference has the parameters.
Workflows that save cloud findings
An agentic workflow runs as its service account, not as an admin, so two setups now matter. A workflow that can reach cloud tools but pins no connection can only save its cloud findings when its service account sees exactly one connection. A workflow that pins a connection its service account is not granted writes findings it then cannot read back.
Saving a workflow now checks for both and shows a warning after the save succeeds. Pin the connection the workflow assesses, and grant that connection to one of the service account's groups.
What to do after this release
Walk each tenant once:
- Grant each Entra connection to the groups that work that tenant.
- On the Insights page, look for cloud findings that carry no connection badge and attribute the ones that belong to a tenant.
- Re-save your cloud workflows and act on any warning they show.
- If you hold two or more connections, re-run your Microsoft Cloud assessments once per connection.
Learn more
The visibility model is covered on the Groups and Connectors admin pages, and the triage side on Insights. For the model this builds on, see Resource Visibility Is Now Closed by Default.
Questions or feedback? Reach us at info@infrascout.cloud.