Answers before — and after — your first scan.

No. Lite is designed for read/query operations. The report is generated locally from data returned to the current PowerShell process.

The CSV, Findings, log and HTML report are written only to the local output folder created for the scan. OPSpectra Lite has no SaaS backend or telemetry.

The resource exists in the current ARM inventory and is shown with Resource Group context, tags and cost matching when available. Lite does not run a service-specific state or recovery check for that resource type.

Cost Management can be affected by permissions, billing scope, throttling, timeouts or an incomplete API response. Transient failures are retried up to four attempts per page with controlled delays. If no response can be validated, the result remains Unavailable and is never changed to a real zero or stale cached value. Scan details show attempts/retries; the log shows the final HTTP or error code.

Unknown means a dedicated Lite check could not establish a reliable positive or negative state. Not assessed means the resource is inventoried but Lite does not run a dedicated recovery check for that resource type.

Use Share → Open email. A prepared message opens in your default mail client. Attach OPSpectraReport.html or use Print / PDF and attach the PDF.

At minimum the signed-in identity must be able to read the target resources. Cost, RBAC and backup enrichment can require additional read permissions. Missing optional visibility should degrade to warnings/Unknown rather than changing Azure.

A vault is backup infrastructure, not a workload. The Backup tab shows vaults separately and recovery-check coverage is calculated only from workloads with dedicated Lite checks.

Lite intentionally scans one tenant context and one selected subscription at a time. Pro is planned for selecting several or all subscriptions across one or more tenants, combined cross-scope summaries with tenant/subscription drill-down, deeper services, history/comparison and consultant/MSP workflows. The Pro multi-scope interface may differ from the simpler Lite report.

The dedicated Azure VM Backup result comes from Recovery Services backup items. Microsoft.Compute restore point collections are evaluated separately. Lite reads the collection with expand=restorePoints, then reads each point with instanceView and matches the source VM and managed disks by exact Resource ID. A failed collection read is shown as Not verified, never as an empty collection. A usable restore point is recovery evidence, but does not prove that an active scheduled policy is healthy.

No. Findings cover only the data sources and deterministic Lite rules implemented in this release. No HIGH findings is not a security certification, compliance attestation, vulnerability assessment or proof that the environment has no risk.

No. OPSpectra Lite is an operational snapshot and decision-support report. Backup and restore-point evidence must be interpreted in context and does not replace a controlled recovery test, security audit, compliance assessment or business-continuity validation.

They measure different populations. Resources counts current Azure inventory; Backup counts workloads covered by dedicated recovery checks and shows restore-point evidence separately; Findings counts triggered rules. One resource or Resource Group can contribute more than one finding, so these totals are not expected to be identical.

Inventory, RBAC, service-state and recovery evidence are a snapshot of what Azure returned during the scan. Cost Management covers the previous closed calendar month. OPSpectra Lite is not continuous or real-time monitoring, so Azure can change after the report is generated.

Yes. Output can contain tenant/subscription identifiers, resource names and Resource IDs, Resource Groups, tags, direct RG RBAC context, costs, backup state and restore-point evidence. Treat the complete output folder and exported PDFs/CSVs as confidential internal infrastructure documentation and share them only with authorized recipients.

OPSpectra Lite does not implement its own credential store and does not write passwords, access tokens or keys into its report, CSV files or scan log. Authentication is handled by Microsoft Az. The script disables Az context autosave for the process and uses process-scoped sign-in/context selection; Microsoft Az and operating-system authentication behavior remains a Microsoft mechanism.

Include the OPSpectra version, operating system, PowerShell version, relevant Az module versions, a short reproduction description and only the minimum redacted log lines needed to show the problem. Do not send passwords, tokens, keys or a full unredacted report unless strictly necessary and agreed in advance.

Not under the standard Lite license. Lite is licensed to one named user and one purchasing organization for internal use. Paid assessments, client-environment operation, MSP/MSSP/outsourcing use, redistribution and sublicensing are outside the Lite license; a separate future Pro/MSP offering may support a broader licence scope.