Services

One product: a monthly identity governance audit of your Microsoft tenant. What it covers, and what it does not.

In scope

Collected read-only every cycle and compared with the last. Unmarked: automated findings. analyst-reviewed: collected, then reviewed by an analyst. consulting: delivered with you. planned: on the build plan.

Microsoft Entra ID
  • Account inventory: active, dormant, orphaned, guest, unlicensed. Dormant accounts and guests without MFA are automated findings; orphaned and unlicensed are analyst-reviewed.
  • Privileged role assignments and standing privilege, including permanent Global Administrator
  • PIM configuration, with eligible-versus-active analysis analyst-reviewed
  • Conditional Access inventory and gap checks: disabled policies, legacy authentication, MFA gaps
  • Entra ID Protection risk posture, where P2 is held analyst-reviewed
  • MFA and authentication method registration, members and guests
  • Group membership, nesting and dynamic rules analyst-reviewed; paused dynamic rules are automated
  • App registrations and service principals; secret and certificate expiry reviewed monthly analyst-reviewed
  • OAuth consent and permission grants, from Entra ID data
  • Sign-in and audit logs, licence SKUs, authentication method policies
Microsoft Intune
  • Device inventory and join state: Entra joined, hybrid joined, registered
  • Compliance policies and non-compliant devices, including encryption
  • Configuration profile drift and conflict detection
  • Windows LAPS backup health: devices whose password is not backed up to Entra ID or has not rotated in 60 days. Metadata only; we cannot read passwords.
Governance and reporting
  • Joiner-mover-leaver runbook design and maintenance consulting
  • Termination verification in each in-scope tenant consulting
  • Access certification campaigns, run with you, with evidence capture consulting
  • Month-over-month drift detection: every object and property compared, every finding tracked as opened, resolved or persisting. A daily drift digest is planned.
  • Month-over-month trending and governance metrics, from the November 2026 cycle
  • Auditor and examiner evidence package, verifiable without our software. SOC 2 and CMMC mappings from November 2026; HIPAA Security Rule and NIST CSF 2.0 from December 2026 planned. Supports your assessment; does not certify compliance.
  • Licence entitlement vs. capability map (automated), with optimization findings analyst-reviewed
  • Remediation change record: every change we make in your tenant, with your approval consulting

Supplemental, read-only

Consumed into the audit. We do not operate, tune, monitor or respond to it.

Microsoft Defender for Identity

Sensor health review analyst-reviewed: issues that leave identity monitoring blind, where you hold the licence. Validated with each client's first cycle.

Licensing

Findings are bounded by your licensing: PIM, access reviews and ID Protection need Entra ID P2 or Governance; Defender for Identity needs its own licence. The report names checks that could not run.

Quoted separately

On-premises Active Directory and hybrid identity

Consulting, under its own statement of work: AD account and group hygiene, Entra Connect sync, hybrid join, privileged AD groups, stale objects, delegation.

Additional Microsoft tenants

Each tenant is a pricing unit, audited and reported separately.

Pricing by tier and tenant count →

On the roadmap

Not available today, and listed so nobody buys assuming they are. No dates.

  • Daily drift digestA daily summary of configuration changes on every tier. A governance report, not alerting. Monthly until then.
  • Guest and B2B collaboration posture; cross-tenant access settingsNeeds new collection.
  • Local administrator membership on devicesNot collected today; LAPS backup health is.
  • The device-compliance-to-Conditional-Access dependency chainConsulting in your included hours until then.
  • Credential and certificate expiry findingsAnalyst-reviewed monthly until the rule ships.

We do one thing. Here's what we don't do.

Published so nobody finds out during a sales call.

No detection, monitoring, alerting, or incident response

It shows posture and change. Nobody carries a pager.

No Defender for Endpoint operation or alert triage

A separate discipline we do not run.

No email security or anti-phishing operation

Exchange Online Protection and Defender for Office 365 are out of scope.

No Azure resource posture management or CSPM

Only identity that reaches Azure through Entra is audited.

No government clouds

GCC High and DoD tenants are not supported.

No SOC services, no on-call, no round-the-clock coverage

Governance requests in business hours only. Not an incident line.

No general Microsoft 365 administration, licensing procurement, or helpdesk

We say what to fix and help within the included hours. We do not run your tenant.

See what the audit actually produces

Collection, signed evidence, comparison, rules and reproducibility, step by step.

How it works