Scheduled assessments and monitoring
Keep customers monitored with scheduled assessments, endpoint self-reports and weekly exposure monitoring.
Updated
On this page
One assessment is a snapshot. Monitoring keeps findings current: fixed issues resolve themselves, regressions reopen and alert, and the trends in Change history fill in.
What runs on its own
| What | When | For |
|---|---|---|
| Automatic assessments | Microsoft 365 and passive external assessments, weekly, and as soon as a customer is connected or gets its first domain (details) | Managed customers |
| Scheduled assessments | Daily, weekly or monthly, as you set them | Any customer |
| Endpoint monitoring | Devices self-report every few hours (6 by default); collected into a daily Endpoint monitoring assessment per customer | Customers with devices |
| Weekly exposure monitoring | Weekly dark web and contact checks | Managed customers, with Weekly monitoring on in Customer settings → Contacts |
| Microsoft 365 | Identity sync once a day; security monitoring twice an hour | Connected tenants |
| Vulnerability matching | Twice a day against fresh advisory data, and on every new inventory | Everything with inventory |
| Code & apps | Daily rescans | Connected repositories and SBOM applications |
Prospects and archived customers are left out of automatic exposure monitoring.
Schedule an assessment
In the customer's workspace open Assessments → Schedules and create a schedule:
| Field | Options |
|---|---|
| Type | External (passive), Microsoft 365 or Internal (agents) |
| Frequency | Daily, Weekly (pick the weekday) or Monthly (pick the day) |
| Hour | The hour it starts, in UTC |
Scheduled external assessments are always passive. Run active scans by hand, with their attestation and approval.
Archiving a customer pauses its schedules, and unarchiving doesn't turn them back on: do that here.
Self-report interval
Settings → Endpoint policy sets how often agents send their own report (off, or every 1–24 hours). Patch status stays current even for laptops that are offline when an assessment runs. A device that hasn't reported within the freshness limit (7 days by default) shows No recent data instead of a stale verdict.
Regressions and notifications
When a resolved finding comes back it reopens, shows as a regression in Change history, and fires the
finding.reopened webhook. Turn on the notifications you want (for example Assessment completed or Assessment or
scheduled scan failed) in Settings → Notifications. See Notifications.
Plan limits
Every assessment, scheduled or not, counts against your plan's monthly assessments. Settings → Billing shows this month's use. Once the allowance is used up, new assessments, scheduled ones included, are refused until next month.