Skip to main content
Journey: Overview → Establish evidence → Assess → Follow up We will assess whether Acme’s observed Global Administrators have MFA registered. The examples below assume suitable source coverage and current, eligible evidence; the app also applies its coverage and freshness rules.

​
Choose and run the standard

1

Copy the identity template

In Standards → More → Browse library, choose BIOS Identity Assurance and copy it. The copy starts as a disabled draft.
2

Review the question

Review the Global Administrators use MFA control, its population, expectation and settings. Review the other controls and manual checks in the template before enabling the standard.Checkpoint: you understand that this control selects the Global Administrator role and checks MFA registration. Its name does not establish sign-in policy enforcement.
3

Enable the reviewed standard

Open the copied standard and select Review & enable. Turn on Enabled, then select Save changes.Checkpoint: the standard shows Enabled, and the controls you intend to assess are enabled too. The final Run checks action stays unavailable while the parent standard is disabled.
4

Run checks

Select Run checks from Standards. Review the selected standard, clients and settings, then confirm Run checks for N clients. Inspect the results after evaluation finishes.Checkpoint: the result belongs to the intended client and control, with an evaluation time you can identify.

​
Work through the result

The accounts below are fictional examples. Switch between scenarios to see how the conclusion changes.
The selected population contains Alex. The registration observation satisfies the expectation, so this simplified example passes.Your next question: does the selected population and source coverage represent the accounts you intended to assess? This result establishes registration for the assessed population.

​
Two cases that are easy to misread

The known contrary observation still proves a fail. The result does not mean the assessment has complete coverage. Investigate Morgan’s failure and Sam’s missing evidence as separate follow-ups.
An empty observed population produces No data in this example. It does not establish that the client has no administrators or that every administrator satisfies the control.

​
Explain the result to someone else

A useful explanation follows this pattern:
We assessed Acme’s observed Global Administrators for MFA registration. Morgan’s registration observation was false, so the control failed. Sam’s registration observation was missing, so coverage also needs investigation. We still need a separate review of effective MFA enforcement.
In a real handover, include the actual source, observation time and evidence references. Do not copy the example names into a client report. Checkpoint: you can distinguish contrary evidence from missing evidence and explain the limit of the conclusion. For other statuses, use Understanding control results.

Next: decide what happens next

Turn the assessment into an owned, verifiable follow-up.