This five-minute check shows whether your MAS migration is carrying security debt, license waste, or both.
Ten questions, scored one to five, across two halves that are really one problem: license efficiency and security maturity. In MAS a user's license tier is set by their security group, so the security model is the license bill. This score tells you which half to fix first. It bridges to the Workshop. It does not replace it.
It scores two things a MAS migration depends on: license efficiency, meaning whether you are sizing AppPoints from the work people do rather than from headcount, and security maturity, meaning whether your security groups are role-based, explainable, and tested. Carrying either as debt into a migration is expensive.
Because in MAS they are the same thing. A user's license tier is set by their security group, so the security model is the license bill. You cannot size AppPoints correctly on top of a security model you do not trust, and you cannot fix the license bill without touching access.
Combining security groups widens access. When a user is in multiple groups the most permissive grant wins and conditions OR together, so a scoped data restriction is defeated by a broader group or the EVERYONE group. That is why the right test is the user's full combined profile, not any single group. The old most-restrictive-wins framing is backward for data restrictions.
No. A high score means your model is worth preserving and validating during migration rather than rebuilding. A low score means rebuild before you size or cut over. Either way the Workshop carries the full scoring instrument, the weighted model, and the build steps this five-minute check only points at.