{
  "meta": {
    "title": "Norwegian health-trust (helseforetak) email-platform sovereignty",
    "source": "public DNS (MX + SPF + autodiscover CNAME); entities from Brønnøysund Enhetsregisteret",
    "sourceDate": "2026-06-29",
    "license": "CC BY 4.0",
    "attribution": "Skytilsynet / BetterWorld, skytilsynet.no",
    "method": "See ../docs/scorecard-spec.md §2 and scanner/README.md.",
    "floor_note": "microsoft_pct and us_pct are a FLOOR, not a ceiling: 0 domain(s) sit behind a mail-security gateway whose backend SPF did not unmask — some are likely Microsoft too. The true US share is >= the figure shown."
  },
  "summary": {
    "methodology_version": 2,
    "total": 25,
    "us_microsoft": 24,
    "us_google": 0,
    "us_mixed": 0,
    "eu_sovereign": 0,
    "other": 1,
    "none": 0,
    "us_total": 24,
    "us_pct": 96.0,
    "microsoft_pct": 96.0,
    "federated": 0,
    "backend_unmasked": 0,
    "floor_note": "microsoft_pct and us_pct are a FLOOR, not a ceiling: 0 domain(s) sit behind a mail-security gateway whose backend SPF did not unmask — some are likely Microsoft too. The true US share is >= the figure shown."
  },
  "organ": [
    {
      "category": "helse",
      "name": "Sykehuset Østfold HF",
      "domain": "sykehuset-ostfold.no",
      "website_domain": "sykehuset-ostfold.no",
      "platform": "OTHER",
      "jurisdiction": "Undetermined",
      "governance": null,
      "alternative": null,
      "behind_gateway": false,
      "fingerprint": null,
      "flags": [],
      "verdict": {
        "platform": "UAVKLART",
        "label": "Uavklart",
        "confidence": 0.0,
        "uavklart": true,
        "note": "Regional/ukjent plattform — ikke avgjort fra DNS alene"
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mail.so-hf.no",
          "source": "dig MX sykehuset-ostfold.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Unknown",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@sykehuset-ostfold.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Unknown: ingen Microsoft-leietaker",
          "confidence": 0.1,
          "platform": null
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Akershus universitetssykehus HF",
      "domain": "ahus.no",
      "website_domain": "ahus.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX ahus.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.sykehuspartner.no include:_spf.sndr.no -all\" \"v=spf1 ip4:83.118.180.10 ip4:83.118.180.114 ip4:83.118.180.115 ip4:153.110.241.86 ip4:153.110.241.87 include:_netblockssikt.sykehuspartner.no include:spf.qb-feedback.com include:spf.protection.outlook.com -all\" \"v=spf1 ip4:193.69.50.16/28 ip4:193.71.134.192/28 ~all\"",
          "source": "dig TXT ahus.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Finnmarkssykehuset HF",
      "domain": "finnmarkssykehuset.no",
      "website_domain": "finnmarkssykehuset.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 finnmarkssykehuset-no.mail.protection.outlook.com",
          "source": "dig MX finnmarkssykehuset.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helgelandssykehuset HF",
      "domain": "helgelandssykehuset.no",
      "website_domain": "helgelandssykehuset.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helgelandssykehuset-no.mail.protection.outlook.com",
          "source": "dig MX helgelandssykehuset.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.hnikt.no -all\" \"v=spf1 include:spf.protection.outlook.com include:_spf.vendors.hnikt.no ip4:91.186.76.20 ip4:91.186.76.148 ip4:91.186.77.211 ip4:91.186.77.150 ip4:91.186.77.151 ip4:91.186.77.152/29 -all\"",
          "source": "dig TXT helgelandssykehuset.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Bergen HF",
      "domain": "helse-bergen.no",
      "website_domain": "helse-bergen.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helsebergen-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-bergen.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 ip4:185.201.93.122 ip4:161.4.88.20/30 ip4:167.89.59.190 a:smtp.nethome.no include:_spf.nhn.no include:msg-out._spf.onevoice.no include:servers.mcsv.net include:_spf.sndr.no include:spf.protection.outlook.com include:mail.webropolsurveys.com -all\" \"v=spf1 ip4:91.186.65.63 ip4:91.186.65.64 ip4:83.118.184.66 ip4:83.118.185.225 ip4:83.118.166.62 ip4:83.118.166.63 ip4:83.118.189.225 ip4:83.118.189.126 ip4:83.118.189.127 ip4:83.118.189.114 ip4:83.118.189.115 ~all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\" \"v=spf1 ip4:193.69.50.16/28 ip4:193.71.134.192/28 ~all\"",
          "source": "dig TXT helse-bergen.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.helse-bergen.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Fonna HF",
      "domain": "helse-fonna.no",
      "website_domain": "helse-fonna.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helsefonna-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-fonna.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 ip4:185.201.93.122 ip4:161.4.88.20/30 include:_spf.nhn.no include:msg-out._spf.onevoice.no include:spf.protection.outlook.com -all\" \"v=spf1 ip4:91.186.65.63 ip4:91.186.65.64 ip4:83.118.184.66 ip4:83.118.185.225 ip4:83.118.166.62 ip4:83.118.166.63 ip4:83.118.189.225 ip4:83.118.189.126 ip4:83.118.189.127 ip4:83.118.189.114 ip4:83.118.189.115 ~all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT helse-fonna.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for helse-fonna.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.helse-fonna.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Førde HF",
      "domain": "helse-forde.no",
      "website_domain": "helse-forde.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helseforde-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-forde.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 ip4:185.201.93.122  ip4:161.4.88.20/30 include:_spf.nhn.no include:msg-out._spf.onevoice.no include:_spf.anpdm.com include:spf.protection.outlook.com include:_spf.sndr.no -all\" \"v=spf1 ip4:91.186.65.63 ip4:91.186.65.64 ip4:83.118.184.66 ip4:83.118.185.225 ip4:83.118.166.62 ip4:83.118.166.63 ip4:83.118.189.225 ip4:83.118.189.126 ip4:83.118.189.127 ip4:83.118.189.114 ip4:83.118.189.115 ~all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\" \"v=spf1 ip4:91.227.208.0/24 ip4:185.64.72.0/24 ip4:185.64.73.0/24 ip4:185.64.74.0/24 ip4:52.17.51.198 -all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT helse-forde.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for helse-forde.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.helse-forde.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Midt-Norge RHF",
      "domain": "helse-midt.no",
      "website_domain": "helse-midt.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "5 helsemidt-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-midt.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.helsemn.no include:_spf2.helsemn.no include:spf.protection.outlook.com ~all\" \"v=spf1 ip4:91.186.72.51 ip4:91.186.72.34 ip4:91.186.72.35 ip4:91.186.65.63 ip4:91.186.65.64 ip4:31.25.221.112 ip4:83.118.184.66 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 ip4:91.186.72.55 ~all\" \"v=spf1 include:_spf.questback.com ~all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT helse-midt.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for helse-midt.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Møre og Romsdal HF",
      "domain": "helse-mr.no",
      "website_domain": "helse-mr.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "5 helsemr-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-mr.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.helsemn.no include:_spf2.helsemn.no include:spf.protection.outlook.com ip4:195.244.107.235 ip4:195.244.107.236 ip4:195.244.107.237 ip4:217.144.78.98 -all\" \"v=spf1 ip4:91.186.72.51 ip4:91.186.72.34 ip4:91.186.72.35 ip4:91.186.65.63 ip4:91.186.65.64 ip4:31.25.221.112 ip4:83.118.184.66 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 ip4:91.186.72.55 ~all\" \"v=spf1 include:_spf.questback.com ~all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT helse-mr.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for helse-mr.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Nord RHF",
      "domain": "helse-nord.no",
      "website_domain": "helse-nord.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helsenord-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-nord.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.hnikt.no include:sendgrid.net -all\" \"v=spf1 include:spf.protection.outlook.com include:_spf.vendors.hnikt.no ip4:91.186.76.20 ip4:91.186.76.148 ip4:91.186.77.211 ip4:91.186.77.150 ip4:91.186.77.151 ip4:91.186.77.152/29 -all\"",
          "source": "dig TXT helse-nord.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Nord-Trøndelag HF",
      "domain": "hnt.no",
      "website_domain": "hnt.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "0 hnt-no.mail.protection.outlook.com",
          "source": "dig MX hnt.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.helsemn.no include:spf.protection.outlook.com -all\" \"v=spf1 ip4:91.186.72.51 ip4:91.186.72.34 ip4:91.186.72.35 ip4:91.186.65.63 ip4:91.186.65.64 ip4:31.25.221.112 ip4:83.118.184.66 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 ip4:91.186.72.55 ~all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT hnt.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for hnt.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Stavanger HF",
      "domain": "sus.no",
      "website_domain": "sus.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 sus-no.mail.protection.outlook.com",
          "source": "dig MX sus.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 ip4:161.4.88.20/30 ip4:185.201.93.122 include:_spf.nhn.no include:msg-out._spf.onevoice.no ip4:192.254.125.69 include:spf.protection.outlook.com -all\" \"v=spf1 ip4:91.186.65.63 ip4:91.186.65.64 ip4:83.118.184.66 ip4:83.118.185.225 ip4:83.118.166.62 ip4:83.118.166.63 ip4:83.118.189.225 ip4:83.118.189.126 ip4:83.118.189.127 ip4:83.118.189.114 ip4:83.118.189.115 ~all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\"",
          "source": "dig TXT sus.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for sus.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.sus.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Sør-Øst RHF",
      "domain": "helse-sorost.no",
      "website_domain": "helse-sorost.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX helse-sorost.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.sykehuspartner.no include:_spf.anpdm.com include:spf.protection.outlook.com include:_spf.enternett.no -all\" \"v=spf1 ip4:83.118.180.10 ip4:83.118.180.114 ip4:83.118.180.115 ip4:153.110.241.86 ip4:153.110.241.87 include:_netblockssikt.sykehuspartner.no include:spf.qb-feedback.com include:spf.protection.outlook.com -all\" \"v=spf1 ip4:91.227.208.0/24 ip4:185.64.72.0/24 ip4:185.64.73.0/24 ip4:185.64.74.0/24 ip4:52.17.51.198 -all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\" \"v=spf1 ip4:193.93.252.70 ip4:193.93.253.37 ip4:193.93.253.38 ip4:193.93.253.36 ip4:193.93.253.35 ip4:193.93.253.34 ip4:185.145.190.37 ip4:185.145.190.38 ip4:193.93.253.33 ip4:193.93.253.32 ip4:193.93.253.48 ip4:193.93.253.49 ip4:49.13.104.96/27\"",
          "source": "dig TXT helse-sorost.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for helse-sorost.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.helse-sorost.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Helse Vest RHF",
      "domain": "helse-vest.no",
      "website_domain": "helse-vest.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 helsevest-no01c.mail.protection.outlook.com",
          "source": "dig MX helse-vest.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 ip4:185.201.93.122 ip4:161.4.88.20/30 include:_spf.nhn.no include:msg-out._spf.onevoice.no include:_spf.sndr.no include:_spf.anpdm.com include:spf.protection.outlook.com -all\" \"v=spf1 ip4:91.186.65.63 ip4:91.186.65.64 ip4:83.118.184.66 ip4:83.118.185.225 ip4:83.118.166.62 ip4:83.118.166.63 ip4:83.118.189.225 ip4:83.118.189.126 ip4:83.118.189.127 ip4:83.118.189.114 ip4:83.118.189.115 ~all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\" \"v=spf1 ip4:193.69.50.16/28 ip4:193.71.134.192/28 ~all\" \"v=spf1 ip4:91.227.208.0/24 ip4:185.64.72.0/24 ip4:185.64.73.0/24 ip4:185.64.74.0/24 ip4:52.17.51.198 -all\"",
          "source": "dig TXT helse-vest.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.helse-vest.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Nordlandssykehuset HF",
      "domain": "nordlandssykehuset.no",
      "website_domain": "nordlandssykehuset.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 nordlandssykehuset-no.mail.protection.outlook.com",
          "source": "dig MX nordlandssykehuset.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.hnikt.no ip4:91.186.76.69 include:spf.ilnet.se -all\" \"v=spf1 include:spf.protection.outlook.com include:_spf.vendors.hnikt.no ip4:91.186.76.20 ip4:91.186.76.148 ip4:91.186.77.211 ip4:91.186.77.150 ip4:91.186.77.151 ip4:91.186.77.152/29 -all\" \"v=spf1 ip4:93.190.199.140 ip4:93.190.199.141 ip4:192.71.135.177 ip4:192.71.135.178 ip4:192.71.135.179 ip4:192.71.135.180 ip4:192.71.135.181 ip4:192.71.135.182 ip4:93.190.199.157 ip4:93.190.199.177 ip4:93.190.199.178 ip4:139.116.71.0/25 ~all\"",
          "source": "dig TXT nordlandssykehuset.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Oslo universitetssykehus HF",
      "domain": "oslo-universitetssykehus.no",
      "website_domain": "oslo-universitetssykehus.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "dkim",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 1.0,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX oslo-universitetssykehus.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 redirect=_spf.sykehuspartner.no\"",
          "source": "dig TXT oslo-universitetssykehus.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF uten gjenkjent plattform",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "dkim",
          "observation": "selector1-oslouniversitetssykehus-no01b._domainkey.hsorhf.onmicrosoft.com selector2-oslouniversitetssykehus-no01b._domainkey.hsorhf.onmicrosoft.com",
          "source": "dig CNAME selector1/2._domainkey.oslo-universitetssykehus.no",
          "observed_at": "2026-06-29",
          "inference": "DKIM-selektor → *.onmicrosoft.com: airtight Microsoft 365",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Managed",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@oslo-universitetssykehus.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Managed: aktiv Microsoft 365 sky-leietaker",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "St. Olavs hospital HF",
      "domain": "stolav.no",
      "website_domain": "stolav.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "5 stolav-no.mail.protection.outlook.com",
          "source": "dig MX stolav.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.helsemn.no include:_spf.questback.com include:spf.protection.outlook.com include:spf.infostorm.no include:_spf.sndr.no ip4:217.144.78.98 ~all\" \"v=spf1 ip4:91.186.72.51 ip4:91.186.72.34 ip4:91.186.72.35 ip4:91.186.65.63 ip4:91.186.65.64 ip4:31.25.221.112 ip4:83.118.184.66 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 ip4:91.186.72.55 ~all\" \"v=spf1 ip4:91.217.141.0/24 ip4:87.79.30.0/25 ip4:193.66.190.13 ip4:89.250.60.42 ip4:5.250.160.26 ip4:89.250.48.136 ip4:194.116.128.11 ip4:82.147.60.210 ip4:130.61.132.10 ip4:193.122.14.67 ip4:152.70.162.25 ip4:51.120.120.172 ~all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\" \"v=spf1 ip4:195.254.214.0/28 ip4:146.192.177.0/27 include:spf-mr.infostorm.no include:spf.mailanyone.net ~all\"",
          "source": "dig TXT stolav.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for stolav.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sykehusapotekene HF",
      "domain": "sykehusapotekene.no",
      "website_domain": "sykehusapotekene.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "0 sykehusapotekene-no.mail.protection.outlook.com",
          "source": "dig MX sykehusapotekene.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:spf.protection.outlook.com include:_spf.sndr.no include:_spf.atlassian.net include:msg-out._spf.onevoice.no -all\" \"v=spf1 ip4:40.92.0.0/15 ip4:40.107.0.0/16 ip4:52.100.0.0/15 ip4:52.102.0.0/16 ip4:52.103.0.0/17 ip4:104.47.0.0/17 ip6:2a01:111:f400::/48 ip6:2a01:111:f403::/49 ip6:2a01:111:f403:8000::/51 ip6:2a01:111:f403:c000::/51 ip6:2a01:111:f403:f000::/52 -all\" \"v=spf1 ip4:193.69.50.16/28 ip4:193.71.134.192/28 ~all\" \"v=spf1 ip4:167.89.0.0/17 ip4:168.245.0.0/17 include:amazonses.com -all\" \"v=spf1 ip4:185.38.121.6 ip4:185.38.121.7 ip4:185.38.121.8 ip4:185.38.121.20/30 ip6:2a04:6fb0:121::/124 ip6:2a04:6fb0:121::21/126 ip4:194.187.25.111 ip4:151.252.13.148 -all\"",
          "source": "dig TXT sykehusapotekene.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf_ip",
          "observation": "40.92.0.0/15",
          "source": "ip4 i SPF for sykehusapotekene.no ∈ Microsoft EOP-områder",
          "observed_at": "2026-06-29",
          "inference": "Microsoft EOP-IP 40.92.0.0/15 inlinet i flatet SPF — bevis for Microsoft",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.outlook.com",
          "source": "dig CNAME autodiscover.sykehusapotekene.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover → outlook.com: Microsoft 365-leietaker",
          "confidence": 0.8,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sykehuset Innlandet HF",
      "domain": "sykehuset-innlandet.no",
      "website_domain": "sykehuset-innlandet.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX sykehuset-innlandet.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spfmailgw.ntnu.no include:_spf.sykehuspartner.no -all\" \"v=spf1 ip4:129.241.14.142 ip4:129.241.34.135 ip4:129.241.34.136 ip4:129.241.34.138 ip4:129.241.34.133 ip4:129.241.56.7 ip6:2001:700:300:3::7 ip4:129.241.56.133 ip6:2001:700:300:3::133 ip4:129.241.56.134 ip6:2001:700:300:3::134 ip4:129.241.56.135 ip6:2001:\" \"700:300:3::135 ip4:129.241.56.136 ip6:2001:700:300:3::136 ip4:129.241.56.150 ip6:2001:700:300:3::150 ip4:129.241.56.174 ip6:2001:700:300:3::174 ip4:129.241.56.176 ip6:2001:700:300:3::176 ip4:129.241.56.177 ip6:2001:700:300:3::177 ip4:129.241.56.178 ip6:20\" \"01:700:300:3::178 ip4:129.241.56.179 ip6:2001:700:300:3::179 ip4:129.241.56.182 ip6:2001:700:300:3::182 ip4:129.241.56.215 ip6:2001:700:300:3::215 ip4:129.241.57.164 ip6:2001:700:300:31::164 ip4:129.241.56.183 ip6:2001:700:300:3::183 ip4:129.241.57.166 ip\" \"6:2001:700:300:31::166 -all\" \"v=spf1 ip4:83.118.180.10 ip4:83.118.180.114 ip4:83.118.180.115 ip4:153.110.241.86 ip4:153.110.241.87 include:_netblockssikt.sykehuspartner.no include:spf.qb-feedback.com include:spf.protection.outlook.com -all\"",
          "source": "dig TXT sykehuset-innlandet.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.sykehuset-innlandet.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sykehuset Telemark HF",
      "domain": "sthf.no",
      "website_domain": "sthf.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "dkim",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 1.0,
        "uavklart": false,
        "note": "Leietaker bevist via føderering; e-post antatt høy-sannsynlig"
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX sthf.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 redirect=_spf.sykehuspartner.no\"",
          "source": "dig TXT sthf.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF uten gjenkjent plattform",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.sthf.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "dkim",
          "observation": "selector1-sthf-no._domainkey.hsorhf.onmicrosoft.com selector2-sthf-no._domainkey.hsorhf.onmicrosoft.com",
          "source": "dig CNAME selector1/2._domainkey.sthf.no",
          "observed_at": "2026-06-29",
          "inference": "DKIM-selektor → *.onmicrosoft.com: airtight Microsoft 365",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Federated",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@sthf.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Federated: Azure AD-leietaker finnes (e-post antatt, ikke ren sky-leietaker)",
          "confidence": 0.6,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sykehuset i Vestfold HF",
      "domain": "siv.no",
      "website_domain": "siv.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "dkim",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 1.0,
        "uavklart": false,
        "note": "Leietaker bevist via føderering; e-post antatt høy-sannsynlig"
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX siv.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 redirect=_spf.sykehuspartner.no\"",
          "source": "dig TXT siv.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF uten gjenkjent plattform",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.siv.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "dkim",
          "observation": "selector1-siv-no._domainkey.hsorhf.onmicrosoft.com selector2-siv-no._domainkey.hsorhf.onmicrosoft.com",
          "source": "dig CNAME selector1/2._domainkey.siv.no",
          "observed_at": "2026-06-29",
          "inference": "DKIM-selektor → *.onmicrosoft.com: airtight Microsoft 365",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Federated",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@siv.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Federated: Azure AD-leietaker finnes (e-post antatt, ikke ren sky-leietaker)",
          "confidence": 0.6,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sykehuspartner HF",
      "domain": "sykehuspartner.no",
      "website_domain": "sykehuspartner.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "dkim",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 1.0,
        "uavklart": false,
        "note": "Leietaker bevist via føderering; e-post antatt høy-sannsynlig"
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX sykehuspartner.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 redirect=_spf.sykehuspartner.no\"",
          "source": "dig TXT sykehuspartner.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF uten gjenkjent plattform",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "dkim",
          "observation": "selector1-sykehuspartner-no._domainkey.hsorhf.onmicrosoft.com selector2-sykehuspartner-no._domainkey.hsorhf.onmicrosoft.com",
          "source": "dig CNAME selector1/2._domainkey.sykehuspartner.no",
          "observed_at": "2026-06-29",
          "inference": "DKIM-selektor → *.onmicrosoft.com: airtight Microsoft 365",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Federated",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@sykehuspartner.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Federated: Azure AD-leietaker finnes (e-post antatt, ikke ren sky-leietaker)",
          "confidence": 0.6,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Sørlandet sykehus HF",
      "domain": "sshf.no",
      "website_domain": "sshf.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX sshf.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.sykehuspartner.no include:spf-eu.exlibrisgroup.com -all\" \"v=spf1 ip4:83.118.180.10 ip4:83.118.180.114 ip4:83.118.180.115 ip4:153.110.241.86 ip4:153.110.241.87 include:_netblockssikt.sykehuspartner.no include:spf.qb-feedback.com include:spf.protection.outlook.com -all\" \"v=spf1 ip4:95.172.90.143 ip4:95.172.90.156 ip4:216.147.218.8/30 -all\"",
          "source": "dig TXT sshf.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.sshf.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Universitetssykehuset Nord-Norge HF",
      "domain": "unn.no",
      "website_domain": "unn.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "mx/spf",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 0.95,
        "uavklart": false,
        "note": null
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 unn-no.mail.protection.outlook.com",
          "source": "dig MX unn.no",
          "observed_at": "2026-06-29",
          "inference": "MX leverer e-post til Microsoft 365",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 include:_spf.hnikt.no include:spf.ilnet.se -all\" \"v=spf1 include:spf.protection.outlook.com include:_spf.vendors.hnikt.no ip4:91.186.76.20 ip4:91.186.76.148 ip4:91.186.77.211 ip4:91.186.77.150 ip4:91.186.77.151 ip4:91.186.77.152/29 -all\" \"v=spf1 ip4:93.190.199.140 ip4:93.190.199.141 ip4:192.71.135.177 ip4:192.71.135.178 ip4:192.71.135.179 ip4:192.71.135.180 ip4:192.71.135.181 ip4:192.71.135.182 ip4:93.190.199.157 ip4:93.190.199.177 ip4:93.190.199.178 ip4:139.116.71.0/25 ~all\"",
          "source": "dig TXT unn.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF autoriserer Microsoft (spf.protection.outlook.com)",
          "confidence": 0.95,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    },
    {
      "category": "helse",
      "name": "Vestre Viken HF",
      "domain": "vestreviken.no",
      "website_domain": "vestreviken.no",
      "platform": "US_MICROSOFT",
      "jurisdiction": "United States (CLOUD Act)",
      "governance": {
        "country": "United States",
        "index": "Freedom House (Freedom in the World)",
        "score": 81,
        "status": "Free",
        "tier": "democracy",
        "sourceUrl": "https://freedomhouse.org/country/united-states/freedom-world/2026",
        "year": 2026
      },
      "alternative": "openDesk (Open-Xchange + Nextcloud) / LibreOffice",
      "behind_gateway": false,
      "fingerprint": "dkim",
      "flags": [],
      "verdict": {
        "platform": "US_MICROSOFT",
        "label": "Microsoft 365",
        "confidence": 1.0,
        "uavklart": false,
        "note": "Leietaker bevist via føderering; e-post antatt høy-sannsynlig"
      },
      "evidence": [
        {
          "signal_type": "mx",
          "observation": "10 mx.sykehuspartner.no",
          "source": "dig MX vestreviken.no",
          "observed_at": "2026-06-29",
          "inference": "Ukjent eller gateway-maskert MX — plattform ikke avgjort",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "spf",
          "observation": "\"v=spf1 redirect=_spf.sykehuspartner.no\"",
          "source": "dig TXT vestreviken.no (v=spf1)",
          "observed_at": "2026-06-29",
          "inference": "SPF uten gjenkjent plattform",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "autodiscover",
          "observation": "autodiscover.sykehuspartner.no",
          "source": "dig CNAME autodiscover.vestreviken.no",
          "observed_at": "2026-06-29",
          "inference": "autodiscover-CNAME uten Microsoft-mål",
          "confidence": 0.3,
          "platform": null
        },
        {
          "signal_type": "dkim",
          "observation": "selector1-vestreviken-no._domainkey.hsorhf.onmicrosoft.com selector2-vestreviken-no._domainkey.hsorhf.onmicrosoft.com",
          "source": "dig CNAME selector1/2._domainkey.vestreviken.no",
          "observed_at": "2026-06-29",
          "inference": "DKIM-selektor → *.onmicrosoft.com: airtight Microsoft 365",
          "confidence": 1.0,
          "platform": "US_MICROSOFT"
        },
        {
          "signal_type": "getuserrealm",
          "observation": "Federated",
          "source": "GET login.microsoftonline.com/getuserrealm.srf?login=test@vestreviken.no",
          "observed_at": "2026-06-29",
          "inference": "getuserrealm=Federated: Azure AD-leietaker finnes (e-post antatt, ikke ren sky-leietaker)",
          "confidence": 0.6,
          "platform": "US_MICROSOFT"
        }
      ],
      "sourceDate": "2026-06-29"
    }
  ]
}