Assessments & reports
Why a section was skipped or is missing
A report only shows areas that were collected successfully. Here are the reasons a section is skipped and how to fix each one.
- Who can do this
- Admin or Owner fixes most causes
- Plan
- All plans
- Time
- 3-minute read
Why sections are skipped instead of guessed
If M365Assessments can’t read an area completely, it leaves that chapter out rather than showing a half-empty one. Missing data would otherwise look like “nothing configured” and produce false findings.
Reasons and fixes
The module isn’t enabled or consented
Only enabled and consented modules run. Check the customer's Modules card: use Add module for a missing module, or Onboarding link on a module showing Consent pending or Consent failed. Adding a module.
Global Reader is missing (role_missing: Global Reader)
Exchange Online, Defender, Purview and Teams need Microsoft's read-only Global Reader role on the module app. Without it those sections are skipped and the Modules card shows Global Reader missing. Have the customer finish the wizard's final step or assign the role manually. Role changes can take up to an hour to reach Exchange Online and Purview, so wait before running again.
Consent missing or a permission was added
If Microsoft reports that consent is missing for a module (for example it was revoked), its sections are skipped. When we add a permission to a module, sections that need it are skipped with “re-grant admin consent” until the customer approves again. Re-granting consent.
Not enough time left (time_budget)
A run is capped at about 110 minutes, and each later section has its own time budget. On very large tenants a section that no longer fits is skipped with a time-budget reason. Run the assessment again (runs outside business hours are often faster), or disable modules you don't need for this customer so the others have more time.
Licensing
Some checks depend on what the tenant is licensed for (for example Defender for Identity, auto-labeling or Insider Risk). Where a feature isn't licensed, the report says the data is unavailable or not licensed instead of reporting zero. Microsoft Defender for Endpoint device data isn't collected today.
The area connected but returned nothing usable
If an area signs in but Microsoft refuses the reads (typically a role that hasn't reached the service yet), the section is marked as failed and left out. Wait up to an hour after a role change and run again.
Power Platform or Teams Voice is missing
The Power Platform chapter only appears with the opt-in Power Platform module (not available for legacy customers). The Teams Voice / Phone System chapter only appears when the tenant uses Teams Phone.
SharePoint shows that some settings could not be collected
The read-only SharePoint & OneDrive module can't read every SharePoint tenant setting: Microsoft only exposes the rest to apps with Sites.FullControl.All. The opt-in SharePoint Advanced module adds them. Without it, the SharePoint chapter may note that some settings couldn't be collected; that's expected.
When the whole run fails instead
If Core can't be collected (for example the tenant's Conditional Access for workload identities blocks our app, or Core consent is gone), the whole run fails with an explanation. See An assessment is stuck or failed.
Last updated