Know exactly whohas access to what.Every month.With proof.
Microsoft Entra ID and Intune identity governance for organizations without an IAM team.
The question nobody can answer
Most Microsoft tenants can't say who has access to what. Leavers keep their service principals. Global Administrator stays permanent. Access is reviewed once a year, in a spreadsheet nobody reads.
It's just nobody's job.
What we do
Your identity and access management function, without a full-time hire.
Most organizations need someone to own identity and access, but not a dedicated IAM specialist at full-time cost. TrogSec takes on that role: access certification, joiner-mover-leaver runbooks, privileged access review and audit evidence, with included hours for advice and remediation.
Our monthly audit pipeline keeps the service consistent. Every cycle compares your tenant, object by object, to the last, so you always know who holds what, what changed and what to fix.
Every figure traces to a signed, write-once collection. Re-run any past cycle and get identical numbers.
Collected read-only, stored in TrogSec's own Azure subscription, never put through an AI tool.
What we cover
Your Microsoft cloud identity every month, with on-premises AD by quote.
Every month
- Microsoft Entra IDAccounts, privileged roles and PIM, Conditional Access gaps, MFA, apps and service principals, OAuth consent, guests.
- Microsoft IntuneDevices, compliance, configuration drift, Windows LAPS backup health.
- Defender for IdentityRead-only sensor health where licensed. Validated with your first cycle.
Also available
- On-premises Active Directory and hybrid identityConsulting, quoted separately.
- Additional Microsoft tenantsEach tenant is priced, audited and reported separately.
Client engagements
Three stages. Each one stands on its own.
Free discovery scan
Built on Maester. You run it as your own administrator; no access is granted. An 8–12 page report and a 30-minute readout. One per organization.
One-time IAM audit
Fixed price, about two weeks, walked through live. Credits in full toward a retainer signed within 60 days.
Monthly retainer
12 months. Monthly audit and drift detection, access certification, joiner-mover-leaver runbooks, evidence packs and included hours.
Why the numbers can be trusted
Read-only permissions backed by integrity assurance for audit-ready reports.
One read-only app you consent to. Managed-identity federation means no password, secret or certificate exists to steal.
Signed when written, so any change is detectable. Kept write-once for your retention period; not even TrogSec can alter it.
Versioned rules with severity, framework mapping and remediation. Not judgment, not a language model.
Every report names its inputs. Re-running a cycle gives identical numbers; changes to our tooling are flagged as ours.
A missing licence or failed check is named, with the reason. Nothing is marked resolved because data went missing.
Never put through an AI tool, by us or anyone we use. Stored in TrogSec's own Azure subscription. In the contract. Where your data goes →
Published pricing
Retainer from $1,800/mo
Retainer from $2,900/mo
Retainer from $6,000/mo
Same features on every tier; choose any tier you fit under. Included hours are per organization, not per tenant. Per month, one tenant, before applicable taxes.
Start with the free scan
Includes CISA's SCuBA checks for Entra ID. Read-only, run by you. It shows configuration gaps; full access reconciliation is the paid audit.
Contact
Remote-first. Clients across the United States.
Email is answered within one business day. The pricing calculator can pre-fill the contact form.
Found a vulnerability in something we run? See our disclosure policy.