States and transitions for discovery sources, runs, deviations and tombstone candidates, SLA handling, and the end-to-end sequence for each persona.

This page is the reference for the states Discovery moves things through: sources on their safety ladder, the outcome of each run, deviations from detection to decision, and CIs that are no longer seen. It closes with the typical sequence for each persona.

Source commissioning states

State	Meaning	Moved by	Allowed next states
Disabled	Registered, stages nothing.	Source manager	Connection test
Connection test	Proves connectivity; results are not applied.	Source manager	Observe only, quarantine, disabled
Observe only	Stages evidence within the approved scope; no CMDB change.	Source manager	Quarantine, active, paused, disabled
Active	Observes for production; writing still needs production-apply activation.	Source manager	Quarantine, paused, disabled
Paused	Runs are refused as paused.	Source manager	Connection test, observe only, active, quarantine, disabled
Quarantine	Stopped because a run broke the approved scope, or by an operator.	System or source manager	Connection test, disabled

The source manager is anyone holding discovery.source.manage. The UI offers Connection test, Approve observe-only and Pause source. Moving a source to active is supported by the service but has no button yet, and production-apply activation has a service and API but no screen yet — see Availability.

Run outcomes

Outcome	Meaning	Counts for absence?
Running	The pull is in progress.	No
Succeeded	Complete, successful run.	Yes, if the source is active and the run enumerated the whole estate
Partial	Some pages or records could not be read.	No
Failed	The pull failed; the run is closed rather than left running.	No
Quarantined	Refused at start because scope, manifest, fields or data classes differ from the approval.	No
Capped	Would have exceeded the approved change cap; nothing was written.	No
Paused	Refused because the source is paused.	No

Runs with outcome failed, partial, quarantined, capped or paused can be retried, up to three attempts in total. Runs in connection test are not applied and do not count for absence; observe-only runs never count either.

Deviation lifecycle

State	Meaning	Who moves it	Allowed next states
Open	A new disagreement between CMDB and observation.	Created by the apply sweep	Acknowledged, resolved, dismissed
Acknowledged	Someone has taken it on.	Deviation manager	Resolved, dismissed
Resolved	Decided: accept observed value or keep CMDB value, with reason.	Deviation manager	None (terminal)
Dismissed	Not a deviation (false alarm), with reason.	Deviation manager	None (terminal)

The deviation manager is anyone holding discovery.deviation.manage. Terminal states cannot be reopened. If the systems still disagree, the next run records a new deviation with its own detection time, so breach history and MTTR cannot be reset.

Tombstone candidate lifecycle

Step	What happens
Accruing	Successful runs that do not see the CI raise the absence streak.
Proposed	The streak reached the grace and no other origin sees the CI. The candidate appears under Absent CIs.
Retired	A person confirmed the absence. The CI moves to the retired lifecycle state; nothing is deleted.
Kept	A person decided the absence was a source artefact. The CI stays as it is.

The grace is 5 runs by default and for scanners, and 3 for Intune. A change of scope, manifest or field list resets the streak. Deciding a candidate needs discovery.tombstone.decide.

SLA, escalation and notification

Each deviation gets a due date from its reason. Targets are wall-clock hours from detection:

Reason	Severity	Review target
Governance attribute contradicted	High	1 day
Ambiguous or split identity	High	2 days
Class mismatch	Medium	3 days
Stale authority	Medium	5 days
Unranked source, no observations	Low	14 days
Production apply not activated	Low	30 days

The daily SLA sweep latches SLA breached on overdue deviations and records one audit event per breach. You find breaching deviations with the Breaching SLA only filter. Failed and partial imports are also raised on the System health page so operators see them outside Discovery.

Background schedule

Job	Schedule
Integration poll	Every 5 minutes (tick); 6 hours by default for scanners
Discovery apply sweep	Hourly at minute 47
Deviation SLA sweep	Daily at 02:15
Verification staleness	Daily at 02:15
Feed mirror sync	Daily at 04:00

End-to-end process per persona

Persona	Typical sequence
Tenant administrator	Enable `discovery_sources` → add the integration and store its credential → acknowledge residency → test the connection → grant `cmdb_admin` to the discovery owners.
CMDB administrator (onboarding)	Connection test → approve observe-only with scope and caps → watch the run ledger → check the review inbox volume → move to active → activate production apply once a second origin confirms CIs.
CMDB administrator (daily)	Review inbox → deviation queue (breaching first) → absent CIs → topology links → source health.
CI owner	Receives deviations for their CIs; resolves with the CMDB administrator or updates the CI record.
Auditor	Opens the attestation → reads the denominator policy and both windows → checks single-sourced justifications → checks open deviations and MTTR → requests the sealed artifact.

Current limitations along these sequences:

Store its credential: credentials are stored encrypted, but the integrations screen does not yet offer a field to enter them.
Move to active: supported by the service, no button yet.
Activate production apply: service and API only, no screen yet. Independent confirmations are not yet written by the sweep.
Review inbox: software, CPE and lifecycle items are listed but cannot yet be decided in the UI; topology links can.

The step-by-step procedures are in Guides for administrators and Guides for CMDB reviewers and auditors.

Lifecycle and processes