Mockup gallery 31 pages

Click any page for a full mockup. The left-rail nav on each mockup page lets you tab between pages directly — same structure as Power BI Desktop will render. Follow REPORT-DESIGN-SPEC.md when building the real visuals in Desktop.
Note: this gallery is the original design set, not the live page list — several shipped pages (SharePoint Sites & Access, the True-Up licence pages, Tenant Summary, Cleanup Project Guide) aren't shown here, and a "Phase 2" tag denotes phase grouping, not build status (many Phase 2 pages are already live). Source of truth for what's shipped is the backlog + CHANGELOG.

Executive summary with KPIs across users, computers, groups, and mail provisioning. Landing page for all personas.

Top-level executive view for cleanup engagements. Per-category progress matrix, velocity tracking, what-next remediation queue. Replaces / absorbs BACKLOG 2.7.

Every enabled account that has a problem. If IT only looks at one page, this is it. Red/amber KPIs front and center.

Flat searchable list of every user with 14 columns. Department × Office matrix for drilling. Sorted by Created descending.

U - Admin Access

1.52 Phase 1 future

U - Admin Access

Every privileged account across the 7 AD admin groups, plus the security findings that apply to them. Dedicated Tier-0 hygiene page.

U - Data Quality

1.52 Phase 1 future

U - Data Quality

Where the HR-sourced cosmetic data lives. Attribute completeness, department variations, missing fields. Not a security page — a cleanup page.

U - Hybrid Identity

U - Hybrid Identity

Deep dive on MailProvStatus: the 89 workaround-provisioned users, the 152 not-mail-enabled, plus Phase 2 cross-references against Exchange Online.

Server vs workstation split, OS version distribution, stale computers. End-of-life OS callout for lifecycle planning.

C - Stale Computers

1.52 Phase 1 future

C - Stale Computers

Computer accounts that haven't rotated their machine password in 90+/365+ days. Attack surface and cost signal combined.

C - OS End-of-Life

C - OS End-of-Life

Past-EOL and upcoming-EOL operating systems. Compliance-critical for regulated customers; upgrade-planning data for IT ops.

Security vs distribution split, scope breakdown, top 15 largest groups, empty-group callout for cleanup.

G - Privileged Groups

1.52 Phase 1 future

G - Privileged Groups

Groups-side view of privileged access. Per-group member rosters for the quarterly access review. Complements U - Admin Access (same data, different pivot).

G - Empty Groups

1.52 Phase 1 future

G - Empty Groups

Groups that have nobody in them. Sprawl accumulator from reorgs and retired projects. Usually safe to delete when > 1 year old.

Top-level Exchange Online mailbox inventory. Populated by Phase 2 Mailbox-Inventory runbook. Mailbox type breakdown, retention, delegation coverage.

M - Large Mailboxes

M - Large Mailboxes

Which mailboxes are eating the storage budget. Quota headroom, archive eligibility, cleanup candidates.

M - Orphaned Mailboxes

M - Orphaned Mailboxes

Mailboxes whose AD user is gone, disabled, or missing. Where the hybrid Exchange cleanup gap manifests in the cloud.

License inventory top-level. SKU allocation, assigned vs unassigned, monthly cost, disabled users still holding licenses.

L - License Waste

L - License Waste

Cost-framed findings. Disabled users still holding licenses, never-logged-in users burning E5, right-sizing candidates. Direct ROI story for IT ops.

Entra ID sign-in data. Active user counts, MFA coverage, risky sign-ins, single-factor-auth holdouts. The cloud side of lifecycle.

E - Never Signed In

E - Never Signed In

Users who have never signed in to Entra. Intersect with on-prem never-logged-in for ghost detection. Licensed ghosts are cost waste too.

1.52 Phase 1 future

The page your GRC lead subscribes to. Point-in-time snapshot formatted for audit evidence. Control attestation, quarterly deltas, privileged roster.

2.13 Phase 1 future

PingCastle-style forest map. Functional level per domain, FSMO role holders, AD recycle bin status, DSRM password age, DNS zone hygiene.

Tier-0 Inventory

Tier-0 Inventory

Closes the BloodHound-shaped 'who is Tier 0' gap without a graph DB. Recursive privileged group expansion, foreign security principals, AdminCount residue.

Bridges point-in-time and change-audit. Compare today's snapshot to yesterday's and surface deltas without becoming a real-time auditor.

C - LAPS Coverage

2.14 Phase 1 future

C - LAPS Coverage

Universal table-stakes finding shipped by every AD security tool. % computers with valid LAPS password, broken down by OS and OU.

2.16 Phase 1 future

PingCastle's iconic visual feature. Surfaces trust direction, type, dangerous attribute bits, and which trusts allow SID history (cross-forest DA risk).

E - CA Policies

E - CA Policies

Green-field per competitive review — no SaaS portal surfaces CA policy overlap or gap detection well. Differentiator opportunity.

E - Auth Methods

E - Auth Methods

Per-user MFA / FIDO2 registration matrix. Tenant-level passwordless adoption %. Differentiator vs SaaS competitors that only show enrolled vs not.

Most enterprise tenants accumulate hundreds of forgotten B2B guests. Stale 90/180/365 buckets, never-accepted invite detection, sensitive-group cross-check.

M - Distribution Groups

M - Distribution Groups

DGs accumulate quietly. Empty DGs, no-owner DGs, DGs with no message activity in 90+ days, single-member DGs. Surfaced for cleanup.

Collaboration Sprawl

Collaboration Sprawl

Empty Teams, orphaned Teams without owners, abandoned SharePoint sites. Cross-source sprawl page (no entity letter — pairs with Identity Census).