Free discovery scan
A read-only configuration scan of one Microsoft tenant, built on Maester, run by you in your tenant. You get an 8–12 page report and a 30-minute readout.
What it checks
Built on Maester, an open-source Microsoft 365 test framework (not a Microsoft product, and not ours), including CISA's SCuBA baseline for Entra ID, EIDSCA and CIS checks. Our wrapper runs only the identity suites.
How it runs
- We send a short wrapper script that installs a pinned Maester version and runs the identity suites.
- You check its hash against the one below, then run it read-only as your own administrator. Your tenant may ask you to consent to Microsoft's Graph Command Line Tools app; that app is Microsoft's.
- You review the output and send us the JSON and HTML files.
- We produce the report and schedule the readout.
No access is granted to TrogSec and no credentials change hands. Only the output you choose to send leaves your environment.
Verify the script before you run it
Each script version is published here with its SHA-256 hash. If yours does not match, do not run it; contact us.
The first version is being finalised. Its version and SHA-256 hash will be published here before it is sent to anyone. Requests are queued in order.
To check a file's hash in PowerShell:
Get-FileHash .\TrogSec-Scan.ps1 -Algorithm SHA256
What it is not
The scan reports configuration gaps. It does not reconcile who holds what access, what changed, or which findings opened or resolved. That is the paid audit.
A clean scan means your configuration is in reasonable shape, not that you know who has access to what.
One tenant. If you run several, pick the one you are least sure about.
Your scan output is stored in TrogSec's own Azure subscription, the report comes from our own template code, and none of it goes through an AI tool. Client data statement →
Request the scan
Only what we need to qualify the request: no tenant IDs, domain names or anything like a credential.