Your first investigation
This walkthrough takes you from one connected source to a documented finding decision. You need a ModelFence account and membership in an organization. Connecting a source requires Admin or Owner; running a passive assessment requires Analyst or higher.
1. Sign in and choose an organization
Section titled “1. Sign in and choose an organization”Open modelfence.ca and select Sign in. Complete your organization’s Microsoft Entra sign-in. Choose an existing organization, or create one through onboarding if your account is new. Your current organization determines which assets, findings and integrations you can see.
If the database is waking from idle, keep the starting screen open. A cold start can take a few minutes; repeated reloads do not make it faster.
2. Connect one source
Section titled “2. Connect one source”Open Integrations and connect GitHub. An administrator of the GitHub account or organization must approve the ModelFence GitHub App for the selected repositories. Start with a repository you own that contains supported configuration.
Wait for discovery to finish. Open its assessment detail and check whether it Completed or Completed with gaps. If the GitHub integration is unavailable, ask your ModelFence operator whether the GitHub App has been configured. A live deployment does not automatically create that registration.
Development instances may offer explicitly labeled Synthetic demo repositories. These are illustrative data, not a scan of your organization.
3. Check coverage before findings
Section titled “3. Check coverage before findings”Open Coverage. Confirm that the capability relevant to your source was evaluated. Read each source’s detail, date and remediation. Not configured, Permission denied, Partial and Unsupported do not mean safe.
4. Follow a finding to its evidence
Section titled “4. Follow a finding to its evidence”Open Findings, select a row, then open its detail. Read:
- The rule and affected asset.
- Severity, confidence and the evidence state.
- The source file or observed event, including when it was collected.
- The recommended remediation and any scan gaps.
Use the asset link to open its detail. Use Access Explorer when you need to see adjacent tools, identities or destinations. Keep evidence filters visible so inferred relationships are not mistaken for observations.
5. Record a decision and check the fix
Section titled “5. Record a decision and check the fix”An Analyst can acknowledge a finding and assign it to an eligible member. Make the actual configuration or access change in the source system; ModelFence does not apply it for you. Run discovery again and compare the evidence.
Mark a finding resolved when your workflow requires it. A complete subsequent scan may mark an absent finding No longer detected. A partial scan does not prove the issue disappeared. Only Admins and Owners can accept risk, with a written reason and an expiry date.
Export a findings report when you need to share the decision and its provenance.