An audit is only worth what you deliver from it. From a single stored audit, EntraGUARD produces 4 different reports — one per audience — in 5 file formats and in both languages. Here is what each one is for, what it contains, and an extract of what it looks like.
4report types
5file formats
318controls reported
FR / ENfrom the same audit
Why several reports rather than one
The steering committee, the administrator who fixes things and the compliance officer are not looking for the same thing in the same audit. A single hundred-page document is read by nobody: the executive cannot find the decision, the administrator cannot find the offending object, the auditor cannot find the framework. EntraGUARD therefore keeps one source of truth — the stored audit, with its date, its baseline and its scope — and renders it once per audience. The figures cannot drift between documents: they are computed once, not once per report.
The 4 report types
The type is picked at export time and applies to every requested format. Each report states the exact scope of the audit it comes from: without that, two reports for the same client are not comparable.
Executive report
Management · CISO · security committee
It answers, in one page, the only question a board asks: where do we stand, and is it getting better? The weighted score — a level 1 control counts three times a level 2 one — gives a single figure, comparable between audits and between entities; the change in points since the previous audit says whether the effort paid off. This is the document that releases a budget, not the one that explains how to fix things.
What it contains
The weighted compliance score and its change in points
The split between compliant, non-compliant, warnings and not evaluated
The heaviest non-conformities, written without technical jargon
The exact scope: baseline applied, date, controls actually evaluated
Extract
COMPLIANCE SCORE 68 / 100+11 pts since 12 Mar
Controls evaluated 313 / 318 Baseline “ANSSI”
Compliant 214Non-compliant 57Warnings 47Not evaluated 5WHAT EXPOSES YOU MOST TODAY
1 14 privileged-role accounts without phishing-resistant
authentication
2 No Conditional Access policy covers the administrative roles
3 9 applications hold a secret that expired more than 90 days ago
Detailed technical report
IT team · administrators · managed service provider
This is the report that makes the audit verifiable. Every control appears with its verdict and, above all, with the objects found: not “non-compliant”, but which accounts, which groups, which resources. The verification command is included, so the administrator can replay the check locally and, if need be, challenge the result. An audit you cannot replay does not get fixed: it gets argued about.
What it contains
Every evaluated control, grouped by category, with a stable identifier
The verdict and the named list of objects at fault
The PowerShell verification command and the link to the official documentation
The framework mapping, control by control
Extract
ENTRA-PRIV-004 Require a phishing-resistant authentication
method for privileged roles
Level 1 · Privileged accounts · NON-COMPLIANTObjects found (14)
adm.dupont@contoso.com SMS only
adm.leroy@contoso.com password only
svc-backup@contoso.com password only
… 11 more
Verification Get-MgUserAuthenticationMethod -UserId <id>
Reference learn.microsoft.com/entra/identity/authentication
Frameworks CIS 1.1.4 · ANSSI · ISO 27001 · NIS2 · DORA
Prioritized remediation plan
Project manager · run team · client action plan
This is the report you take to the follow-up meeting. Non-conformities are sorted by real severity — level 1 controls first, then by the number of affected objects — rather than in catalog order: whatever would be exploited first comes at the top. In CSV or Excel, each row becomes a ticket; the action plan no longer has to be written, only assigned.
What it contains
Non-conformities sorted by priority, not by identifier
The action to take, written as an instruction
The number of affected objects, which gives the real workload
One row per action, ready to import into a ticketing tool
Extract
# LVL CONTROL ACTION OBJECTS1 L1 ENTRA-PRIV-004 Enrol privileged accounts in FIDO2 14
or passkeys
2 L1 ENTRA-CA-011 Create a Conditional Access policy 1
targeting the admin roles
3 L1 ENTRA-WKL-002 Rotate then shorten the expired 9
application secrets
4 L2 ENTRA-EXO-018 Disable the remaining legacy 3
authentication on Exchange Online
It translates the audit into the auditor's language. The same non-conformity does not weigh the same read through the ANSSI guide, a CIS benchmark or Annex A of ISO 27001; this report gives, framework by framework, how many controls are covered and the compliance rate reached. This is the exhibit you attach to a NIS2 file, an insurer's questionnaire or a client security review.
What it contains
Coverage and compliance rate for every framework: CIS Microsoft 365, CISA SCuBA, ISO 27001, NIST 800-53, MCSB, ANSSI, NIS2, DORA
The controls behind each rate, so the figure can be justified
Controls not evaluated, counted separately — a partially covered framework says so
The same report can be exported to several formats at once. They do not serve the same purpose: a PDF cannot be sorted, a CSV cannot be signed.
HTML
The web report: one standalone file, no external resource, opens in any browser. This is the one you send by email — the recipient installs nothing, the coloured tables and the diagrams are inside.
PDF
The paginated deliverable: the one that gets signed, archived and attached to a file. Table of contents, headers, page numbers, vector diagrams — this is the version of record.
Excel
The native .xlsx workbook, to sort, filter and annotate. This is where the remediation plan becomes a tracker: add an “owner” column, a “due date” column, and the report turns into the project board.
CSV
The universal import format: semicolon separator, UTF-8 with BOM, opens cleanly in Excel as well as in a ticketing tool or an online spreadsheet.
JSON
The complete structure — summary and controls. This is the integration format: SIEM ingestion, feeding a GRC tool, automated comparison of two audits, machine-readable archiving.
Where the reports come from
The report is not a separate step: it is the stored audit, rendered. The type and the formats are chosen at export time, and the file is written locally.
The export screen: pick the report type, then the formatsComparing two audits: what was fixed, what regressed
Where each report lands in an engagement
A tool-based audit does not produce a document, it produces a sequence. Here is the usual order of an engagement, and the report that goes with it.
Day 0 — Framing
The baseline is frozen: which controls are in scope, which are excluded and why. Scope is written before the audit, not negotiated afterwards.
Day 1 — Audit
The audit runs read-only, then the detailed technical report goes to the IT team the same day — while the findings are still fresh and verifiable.
Day +2 — Management
The executive report, as a PDF: one score, one trend, three risks. This is the document that gets the decision made.
Week 1 — Plan
The remediation plan in Excel: one row per action, sorted by priority. Add an owner and a due date, and the project tracker exists.
Quarterly — Committee
Comparison of the quarter's audit with the reference audit: the detail separates what was fixed from what regressed, framework by framework.
Yearly — Compliance
The framework report, attached to the NIS2 or DORA file, to the insurer's questionnaire or to a large account's security review.
Under your brand, in your language
Every report carries your logo, your name and your issuer details, with the audited client's logo on the cover. The same audit is rendered in French or in English without being re-run. And the export stays a local file: no client data goes through a third-party service — which is often the very condition for auditing a sensitive environment.
Want to see a full report?
We can walk you through the tool's real output on a demonstration environment.