How the audit is produced
Collection, comparison and findings run as deterministic automation. Here is each step, in enough detail to evaluate it.
Collection
Data is collected through Microsoft Graph by one read-only application you consent to in your own tenant. It authenticates through Azure managed-identity federation, so there is no password, secret or certificate to steal, and it holds no write permissions.
You get the exact permission list at consent. Remove the application and access ends.
27 Graph endpoints: identity, access, applications, Conditional Access, Intune devices, compliance and configuration, LAPS metadata (never the passwords), sign-in and audit logs, risk data, PIM policies, authentication methods and licences. No mailbox or file content.
Signed, write-once evidence
Every collection is signed when written, with a key held in Azure Key Vault. The signature covers the hash of every page of evidence, so a change to a single byte is detectable.
Collections are kept write-once for your agreed retention period. Not even TrogSec can alter or delete them, so a number from eight months ago still traces to its exact bytes.
Comparison
Each cycle is compared with the last, object by object and property by property: users, groups, roles, devices, applications, service principals, policies. Every difference points to the evidence file on both sides.
Findings are tracked as opened, resolved or persisting. Exceptions you approve are time-bound and expire.
Rule-based findings
Findings come from versioned, declarative rules kept in version control. Each rule has:
- A stable identifier that does not change between releases
- A severity
- A mapping to the compliance frameworks it supports
- Remediation guidance
A finding exists because a rule matched, not because of judgment on the day or a language model. Each report names the rule set version it ran under.
Reproducibility
Every report names its collection, rule set and tool versions. Re-running a past cycle gives identical numbers; this has been reproduced on a second machine.
When a count moves, the report says whether your tenant, the rules or our tooling changed.
Completeness gating
Every endpoint is paged to the end and its outcome recorded: success, skip or failure, with the reason. An incomplete run is refused; you get a notice of what was missing and a re-run, never a partial report.
A skip never reads as a pass, and findings are never marked resolved because data went missing.
Remediation change record
Every remediation action in your tenant is recorded: what changed, who requested, approved and executed it, when, and the rollback plan. All tenant writes need your documented approval.
This is separate from the evidence package's change-control section, which covers changes to the audit platform itself. The next cycle's comparison shows the same change from the collection side.
Verifiable without trusting TrogSec
The evidence package ships with a published verification procedure. An assessor can check the hashes, the signature and the chain from each finding to its evidence on their own machine, with standard tools and no TrogSec software.
The audit's claims do not depend on taking our word for them.
The first evidence package is expected after the November 2026 cycle. Until then, this is a design commitment.
Where your data goes, and where it doesn't
Collected data, evidence and reports are stored in TrogSec's own Azure subscription, in West US 2. Reports reach you by encrypted email and are never stored on the client portal, which holds only engagement records such as tickets and change requests. No other party processes your identity data.
Your tenant data, scan output and reports are never put through an AI tool, by us or anyone we use. That is in the contract, and the pipeline has nowhere for a language model to sit: it is PowerShell and Microsoft Graph automation with deterministic rules.
Two named subprocessors join your inventory: Microsoft (Azure, and the Microsoft 365 mailbox that sends reports) and Frappe Cloud (the portal). Nobody else sees your data.
See the deliverable
A sample monthly report from TrogSec's own lab tenant shows what this pipeline produces.