Your first week

After you connect, a first scan builds the inventory of your SaaS applications, their accounts and the access granted. Then Sorvek runs a new scan every night. Reading the mailbox history is the longest part: it continues in slices over the following days, and the inventory keeps growing in the meantime.

The first scan

When it starts depends on how you connected your source:

• Microsoft admin consent: the first scan starts right after you connect, if your organization has never been scanned and the SaaS Discovery module is active.
• BYO app registration (Microsoft): nothing starts on its own. Run it from Settings > Scans > Run a scan, or wait for the nightly run.
• Google Workspace: the first scan takes place during the nightly run that follows the activation of the source. See Connect Google Workspace.

How long it takes depends on the number of users and mailboxes. The scan runs in the background: you can leave the page without interrupting it.

What appears

The scan first reads the directory, then the mailboxes, sign-ins with a Microsoft account and the OAuth grants given to third-party applications. It then saves the applications and accounts, and calculates the security findings (sensitive grants, accounts without MFA, disabled accounts that keep access, etc.).

During the very first scan, the Overview shows a counter of applications discovered so far, which updates on its own.

At the end:

• a notification in Sorvek gives the count and leads to the Scans page;
• for a Microsoft 365 source, the first successful scan also sends an email to the Communication email, with the first scan report attached when it is produced successfully.

Once the inventory is in place, the Overview offers a First mission: the Start reviewing button shows you the applications one by one so you can give each one a status. See Read the application inventory.

Nightly scans

Every day at 2:30 a.m. UTC (9:30 p.m. or 10:30 p.m. in Montreal, depending on the season), Sorvek scans organizations one after another, with a 5-minute pause between two organizations. The exact time of your scan therefore varies from one night to the next.

An organization is skipped if its active source is disabled or if it has no usable connector (for Microsoft, an active Entra ID connector).

For mailboxes, each run picks up where the previous one stopped: it reads new messages instead of reading everything again.

What takes longer

Mailbox history. At night, the scan reads at most 2,000 messages per mailbox. The rest of the history is caught up in slices during the day (between 8 a.m. and 11 p.m. UTC), one organization at a time and never during a scan. Applications found in old emails may therefore appear over the following days. During a slice, Sorvek shows Mailbox history backfill running.

Enrichment. Logos, vendor profiles and the categorization of unknown applications are filled in after the scans, partly during the night.

Google Workspace. Gmail first sets a recent starting point, then catches up on the history gradually from one run to the next. OAuth activity is read over the last 180 days.

Check a scan's status

• Overview: the header shows Scan in progress, Mailbox history backfill running, Last scan failed or Last scan: followed by the date.
• Settings > Scans: the scan history of the active source, with each scan's status (Running, Completed, Partial, Failed), its duration, and the number of users, messages and accounts. Show backfill slices also shows the daytime slices.
• Click a scan's row to open its details and see the Coverage by module: Collected, Partial, Not collected, Not enabled or Not included in the license, and the Missing permissions if there are any.

The Run a scan button is on this same page. It shows Scan running… while a scan is running, and Scan unavailable if the active source has no Microsoft 365 Mail connector, which is the case for a Google Workspace source.

To understand a missing permission, see Requested permissions.