Skip to content
€499 · two hours live · written pack in 5 days

Architecture & Security
Design Workshop

Two hours live in your Microsoft 365 tenant with a Microsoft-Authorized engineer. You leave with seven items, and a clause that owes them to you.

Late by one day and the €499 comes back in full, as written in the Refund Policy. Credited against implementation booked within 90 days, on the terms in the same section. Card or Maltese VAT-compliant B2B invoice, 14-day terms on request.

What the fee owes you

Seven items, and a clause that owes them to you.

Every item is written to be handed to your own team, or to your next vendor, on the day it lands. Two of them are here because the second hour of the session has to produce something you can send to somebody else.

Written architecture document
Current state, target architecture and migration path, written within 5 business days. Built to be handed to your internal team or any other vendor.
Microsoft 365 security gap analysis
Your agreed security and regulatory control families mapped against the current tenant posture. Critical gaps carry effort tags. Controls use stable ITS-M365 identifiers and public Microsoft, NIST, ENISA and EU sources.
Azure landing-zone sketch and Terraform starter
Phased deployment plan with timelines and cost estimates, plus the Terraform starter skeleton committed to your repository. Optional: it is dropped for the time back if your estate has no Azure in it.
Copilot gate record
Each gate item recorded as met, not met, out of scope or not readable, with the admin surface or Graph endpoint the answer was read from and the UTC minute it was read. Where an item was not readable the record says so and why, because an unread setting written down as met is worse than no record. Then the order the failed items have to be closed in, separating what your licences already cover from what they do not.
AI and tenant evidence register
One row for each question agreed in the session, drawn from the control responsibilities Microsoft hands back to you in its own attestation, or from a document you forward before we meet: the answer, the surface it came from, and when it was read. Questions your tenant cannot answer are listed as unanswered rather than filled in, and questions that are legal or contractual rather than technical are marked and routed out.
Exit Kit handover pack
Credentials map, architecture decision records, infrastructure-as-code state, operational runbooks, vendor and contract map, cost attribution map and a 90-day self-management guide. Transferable on day one. That is the point.
30 days of email support
Questions about the document and about implementation planning stay open for 30 days after the session, by email.

One ITSailor eBook of your choice, Microsoft 365 Tenant Hardening or the DORA and NIS2 Roadmap, picked in the pre-session questionnaire. The pack itself is written into Refund Policy, section 01, item by item, so what is listed above is what the contract owes you.

Before you decide

Read a real deliverable first.

A redacted page of a gap analysis is published on this site. The control identifiers, the severities and the public sources are real and render from the same module the free scorecard uses. Only the findings are illustrative.

ITS-M365-ID-003critical · essential profile

The control

Is Basic and other legacy authentication blocked tenant-wide?

What the document tells you to do

Block Basic and other legacy authentication tenant-wide. Review OAuth-based POP and IMAP use separately and disable unused protocols per mailbox.

Read the redacted gap analysis
landing-zone/ · your repository
landing-zone/
├── main.tf
├── providers.tf
├── variables.tf
├── versions.tf
├── backend.tf
├── terraform.tfvars.example
├── address-space.md
└── modules/
EXIT-KIT.md
00Executive summary
01Credentials map
02Architecture decision records
03Infrastructure as code
04Operational runbooks
05Vendor and contract map
06Cost attribution map
0790-day self-management guide
The terms

How the €499 works.

Pay once

Card checkout or a Maltese VAT-compliant B2B invoice with 14-day payment terms. €499 flat, one time.

Pack in 5 days, or refunded

The pack is due within 5 business days of session close. If it misses that window the EUR 499 is refunded in full and the documents are still yours when they land.

€499 credited to implementation

Book any ITSailor implementation engagement within 90 days of your session and the full EUR 499 is deducted from that quote.

Both terms are written down. Refund Policy, section 01, implementation credit states what the credit does and does not cover, including that it lapses at 90 days and cannot be redeemed against licensing.

The session

Two hours, four blocks.

Each block ends in one of the written items above. Nothing in the two hours exists only as a conversation, and nothing in it is a walkthrough of what ITSailor sells.

  1. 0:00-0:30

    Microsoft 365 Tenant Hardening Audit

    Identity and Conditional Access posture, standing administrator count, device and mail authentication, read against the published ITS-M365 baseline. This is the pass the gap analysis is written from.

  2. 0:30-1:00

    Azure Landing-zone Sketch

    Phased migration plan, identity model, network topology, and a Terraform starter you can deploy. If there is no Azure in your estate this block is dropped rather than filled, and its time goes to the two blocks below. Half an hour is too much to spend on something you are not going to buy.

  3. 1:00-1:30

    What Copilot Would Reach

    First, what is already running: how many Copilot licences are assigned, what the switches governing AI in your tenant are actually set to, which agents exist and who owns them, and whether agent spend can appear without anyone buying a licence. Then what an assistant would reach, read from your sharing defaults, your sensitivity labels, your audit retention, and the Microsoft reports you started days before we met. Copilot inherits permissions rather than creating them, and where licences are assigned the index is built without an administrator asking for it. The handles are which sites stay indexed, which files a policy excludes, and who is on the sharing links, and the first of those takes the site out of its own search as well.

  4. 1:30-2:00

    Who Answers What

    Microsoft already answers part of every security questionnaire you will ever be sent, in an attestation report that costs nothing beyond the subscription you already have and that almost nobody opens. You download it on your own screen, under your own account and on the terms Microsoft attaches to it. We never hold a copy. Then we read the section at the end where Microsoft hands the rest back to you, sort it into what your tenant can answer, what only a document can answer and what nobody can, and work the first pile against your tenant for as long as the half hour lasts. You leave with the split, the register behind it, and the questions written down as unanswered rather than filled in.

Two hours live · the seven-item pack in 5 business days
Your workshop lead

Senior engineer, not a sales rep.

Michal Jatczak, solo founder of ITSailor. Years inside regulated, audit-heavy operations, the kind of environment where auditors actually open the logs and the security clock is always running.

“€499 doesn't buy you another ‘digital transformation’ deck. It buys you a deployable architecture plan for your Cloud, Microsoft 365 and AI automation stack. Plus an Exit Kit that means you keep full Sovereign Mastery over your operation.”
Michal Jatczak · Founder, ITSailor
Microsoft Authorized PartnerMalta VAT Registered

Two registers, each open to you without asking us. The 5-day delivery term and the implementation credit are ours, not a register's, and both are in the clause.

Field results, from prior operating roles

Three engagements, measured.

Measured on real tenants in the founder's prior operating roles, not ITSailor client engagements.

100%
device compliance, inside 30 days

A regulated operator moved off unmanaged BYOD and manual laptop setup to enforceable device compliance, with Intune, BitLocker and Conditional Access.

Measured against that operator's own device estate, which was unmanaged before the rollout. The device count is not published.

Where the 30-day figure comes from
12s
MTTR, simple access requests

Repeat Tier-1 access requests dropped from a 14-hour queue to a 12-second automated flow, with Jira Service Management, n8n and a Slack approval step.

Measured against the same request class before the change, which took 14 hours. It is not an MTTR for anything else.

Where 12 seconds comes from
~€1,500
per month in reclaimed licences

Offboarding became an execution log: HR-triggered session revocation, mailbox conversion, licence recovery and audit trace.

Licence spend that stopped recurring at one operator once offboarding recovered seats on its own. That estate's size and its total licence bill are not published, and this is not a rate quoted for yours.

Where the monthly figure comes from
Frequently asked

Workshop Q&A

Who runs the workshop?
Michal Jatczak, solo founder of ITSailor. Microsoft-Authorized partner, years inside regulated, audit-heavy Maltese operations. No junior handoffs, no sales rep. The person who shipped the production architecture is the person on the call.
What do I get after paying €499?
Immediately: a scheduling link within 24 hours to book your 2-hour live session within the next 14 days. After the workshop: the seven-item pack listed on this page, delivered to your inbox within 5 business days, and the same items are enumerated in Refund Policy section 01, so the contract and the sales page carry one list rather than two. One ITSailor eBook of your choice (Microsoft 365 Tenant Hardening or the DORA & NIS2 Roadmap) comes with the pack as a bonus, picked in the pre-session questionnaire.
What access do you need to my tenant, and can you change anything?
Every read is delegated and read-only, in your session, with your administrator present, and nothing in your tenant is changed. Three reader assignments and nothing else: Global Reader across the admin centres, Entra AI Reader for the Copilot settings, and a Purview reader assignment for the labels and the audit position. Microsoft classifies AI Reader as privileged and it also reads all properties of all users, so that is said here rather than left for you to find out. Two settings live behind a configuration role rather than a reader one, and we do not ask for those: you open that screen yourself and we read it with you. If you would rather grant nothing at all, you drive throughout and we read nothing directly. Three things are deliberately not requested. No app registration holding write scopes, and no unattended job of any kind. No SharePoint Advanced Management Administrator role, because the role that reads the item-level oversharing report can also remove permissions at scale. And no tenant-wide crawl of per-item permissions, which is neither something a two-hour call can produce nor something we ask for the rights to attempt. Where those answers are needed, you run the Microsoft report yourself, under your own entitlement, before we meet, and we read the output together.
Do I have to prepare anything before the session?
Two things, both short, both yours. You answer the pre-session questionnaire, which is where you pick your eBook and tell us what the two hours are for. And your SharePoint Administrator starts two Microsoft reports, because Microsoft takes up to five days to produce the first one and it can be re-run only every 30 days. Nobody can produce them inside a live session, and we cannot start them for you. Two honest caveats. Whether those reports exist in your admin centre depends on your subscription and your licences, so the first thing that email asks you to do is look, and finding out is itself one of the answers. And if you want that half of the block at full strength, book at least two weeks out rather than inside fourteen days; if the reports are not ready the session still runs and the block reads your live settings instead.
Can I see a real deliverable before I buy?
Yes. A redacted page of a real gap analysis is published on this site, with the ITS-M365 control identifiers, the public Microsoft and EU sources and one worked finding intact. Tenant identifiers and the client are removed. It is linked from the deliverable preview above and it is the honest answer to "what am I actually getting", which a table of contents is not.
How does the €499 implementation credit work?
Book any ITSailor implementation engagement within 90 days of your session and the full €499 is deducted from that engagement quote. It applies once, to that engagement, is not cash, is not transferable, cannot be redeemed against Microsoft or other vendor licensing bought through Pax8, and lapses at 90 days. Those limits are written into Refund Policy section 01 rather than only stated here. If you stop after the workshop you keep the whole pack, and there is no obligation to continue.
What happens if the deliverable pack is late?
You get the €499 back. The full seven-item pack is due within 5 business days of session close. If it misses that deadline the fee is refunded in full and the documents are still yours when they land. Business days are working days in Malta, and the window pauses only for time spent waiting on access or information requested from you in writing.
What is the Exit Kit?
A handover pack in eight numbered sections: executive summary, credentials map, architecture decision records, infrastructure as code, operational runbooks, vendor and contract map, cost attribution map, and a 90-day self-management guide. Those are the headings of the master template in the ITSailor delivery repository, not a description of it. The promise is that within 24 hours of receiving it, your team or any other vendor can operate the stack without ITSailor. This is Sovereign Mastery. You own everything that gets built.
Is this a sales pitch for your services?
No. The architecture document and Exit Kit are yours regardless of whether you engage ITSailor for implementation. Many clients use them with their internal team or another provider. If we are the right fit for the implementation, you will know by the end of the workshop, and you will own the assets either way.
If I buy licences through you, am I locked in?
You are not required to buy a licence at all. The workshop, the pack and the implementation credit are available without moving a single subscription, and the credit deliberately cannot be spent on licensing, which is written into Refund Policy section 01 rather than only stated here. If you do move licensing later, ITSailor bills it through the Pax8 marketplace as a Microsoft CSP Indirect Reseller, and Terms section 3.4 sets out what that means, including that the vendor keeps licence ownership. Moving away again runs on Microsoft new-commerce transfer rules rather than on ours, and the Exit Kit carries the tenant and subscription identifiers your next provider needs in order to start it.
Can we pay by invoice instead of card?
Yes. B2B buyers can request a Maltese VAT-compliant Stripe invoice with 14-day payment terms instead of card checkout. Ask via the contact form and the scheduling link goes out as soon as the invoice is paid.
What is the difference between the free scan and the paid workshop?
The AI Readiness Scan is a free 18-question self-assessment across six dimensions (use case, data, governance, security, architecture, operations) that scores your readiness and recommends a workshop focus. The €499 workshop is two hours live in your actual tenant with a senior engineer who works through your specific infrastructure, compliance requirements, and deployment strategy, and you walk away with deployable code, not a PDF.
Not ready to book

Take the templates instead.

Free packs from the same delivery repository the workshop draws on. Delivered by email, no payment.

Stop renting permission to operate.
Start owning your architecture.

€499. Two hours live in your tenant. The seven-item pack within 5 business days. You own everything that gets built.

Every session is run live by the founder. What the fee owes you, what happens if it is late, and what the credit does and does not cover are all in Refund Policy, section 01.