Practical resources for stronger IT operations.

Contents

2-hour live session · written pack due within 5 business days

• Microsoft 365 security gap analysis
• Copilot gate record
• Exit Kit handover pack

Limits. For organisations on Microsoft 365. I read with delegated read-only access during the session and change nothing in your tenant.

Contents

29 pages · 12 chapters · named primary sources

• 12 chapters
• Source references
• Operational decision guidance

Limits. Framework mapping is operational guidance, not certification or legal advice.

Contents

69 pages · 10 chapters · named primary sources

• 10 chapters
• Source references
• Operational decision guidance

Limits. Framework mapping is operational guidance, not certification or legal advice.

Contents

6 working templates · drill evidence · recovery validation

• Backup and DR baseline checklist
• Recovery drill and tabletop runbooks
• RPO/RTO validation procedure
• DR drill report and crisis communications

Limits. Adapt recovery objectives, escalation paths and communication duties to the environment before use.

Contents

6-sheet Excel model · formulas · prioritised savings backlog

• Spend Baseline + Waste Flags
• Commitment Break-Even Calculator
• Savings Backlog Tracker

Limits. Outputs depend on the accuracy and completeness of the billing exports supplied.

Contents

6 working templates · renewal calendar · audit and reclaim procedures

• Renewal calendar
• Licensing audit worksheet
• Vendor intake and leaver reclaim runbooks
• Monthly report and renewal notice templates

Limits. Commercial terms, tax treatment, vendor rules and usage data must be verified for each agreement.

Contents

7 working templates · cutover gates · rollback procedure

• Discovery questionnaire
• Wave plan and cutover checklist
• Pilot, rollback and hypercare runbooks
• Day-one communication template

Limits. Tooling, coexistence, data protection and rollback criteria require workload-specific validation.

Contents

3 KQL samples · 2 runbooks · monthly operating review

• 3 starter KQL detections
• Detection catalogue template
• False-positive tuning and threat-hunt runbooks
• Monthly SIEM review template

Limits. Validate schemas, thresholds, data coverage and response ownership before enabling alerts.

Contents

Gap analysis · compliance mapping · incident taxonomy

• Gap Analysis Sheet
• Compliance Mapping
• Incident Taxonomy

Limits. Templates support evidence collection. They do not establish legal compliance.

Contents

2 read-only Graph scripts · 1 KQL query · permissions guide

• Secure Score snapshot script
• Inactive licensed-user audit script
• Failed sign-in burst KQL
• Permissions and data-handling guide

Limits. Exports can contain personal and security data. Confirm authority, Graph permissions, storage and retention before use.

Contents

4 neutral templates · ownership map · handover and supplier-exit checks

• Exit Kit template
• System context and dependency map
• Handover evidence checklist
• Supplier exit question set

Limits. Contract, data-protection and regulatory exit duties require legal and environment-specific review.

Contents

7 working templates · 4 response procedures · review records

• Defender deployment baseline
• Incident triage and device isolation
• Email purge and identity compromise
• Detection tuning and monthly review records

Limits. Response authority, licensing and portal capabilities must be confirmed before an incident.

Contents

6 planning templates · policy intent · operating review

• Discovery questionnaire
• Architecture decision template
• Security baseline and policy initiative
• Break-glass and monthly review procedures

Limits. Planning templates only, no Terraform. Validate controls against the tenant, subscriptions and regulatory scope.

Contents

48 source-linked checks · permission audit · gap analysis

• 48-check Security Review
• Permission Audit
• Gap Analysis

Limits. Validate every control against current Microsoft guidance, tenant licensing, applicability and risk.

Contents

2 sanitised n8n exports · triage runbook · operating notes

• CSP order workflow structure
• Pax8 catalogue sync structure
• Broken-flow triage runbook
• Flow naming and adaptation notes

Limits. Credentials and implementation code are removed. Rebuild authentication, validation and error handling for your environment.

Contents

18 declared controls, a risk register and a 30/60/90 plan

• You enter: Your answers on 18 deployment controls.
• You get: A verdict, a risk register and a 30/60/90 plan, with a PDF.

Limits. Scored from your answers, not from your systems: a self-assessment, not an audit.

Contents

Your own baseline of six inputs, three cases and 7 scored questions of 10

• You enter: Six operating numbers for one workflow.
• You get: A low, centre and high annual value with every assumption printed.

Limits. The range is only as good as the six numbers you enter. It does not measure the workflow itself.

Contents

Microsoft's export schemas, parsed in your browser

• You enter: A Cost Management export file, or Reader access to a subscription.
• You get: Cost findings that name the column or API each figure came from.

Limits. Reads one export or one subscription. It cannot see other subscriptions or commitments agreed outside Azure.

Contents

Live DNS checks of 8 record types and 29 DKIM selectors

• You enter: A domain name.
• You get: SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, MX and blacklist results.

Limits. Reads public DNS records and blocklists only. It cannot see mailbox filtering, sender reputation or message content.

Contents

28 add-ons, each verdict linked to the Microsoft page it was read from

• You enter: The plan you hold and a few answers about the estate.
• You get: A sourced verdict on 28 add-ons.

Limits. Covers the add-ons it lists, from Microsoft's published plan contents. It names no price, and where the sources do not settle a pair it says so.

Contents

Ordered leaver steps, PowerShell with sources and an evidence record

• You enter: The departure type and a few facts about your estate.
• You get: Ordered leaver steps with commands and checks, and an evidence record to keep.

Limits. It builds the steps from the facts you give it and runs no command. The optional read-only sign-in changes nothing.

Contents

Three scan paths; CSV exports are processed in your browser

• You enter: A users export, a spend export or an SSO export.
• You get: Licence waste, spend and shadow IT findings, with a PDF.

Limits. Sees only what the export or the Graph read contains. A tool paid on a personal card or used without SSO will not appear.

Contents

48 checks in 6 areas, each linked to its Microsoft source

• You enter: Your answers on 48 Microsoft 365 controls, or a read-only connection.
• You get: A ranked list of what to fix first, with the fix and a Microsoft Learn link on every gap.

Limits. Answered by hand, it scores your answers, not your tenant. Connected read-only, it reads settings and changes nothing.