Skip to content
€499 · two hours live · written pack in 5 days

Architecture & Security
Design Workshop

Two hours live in your Microsoft 365 tenant with a Microsoft-Authorized engineer. You leave with six written artefacts, and a clause that owes them to you.

Late by one day and the €499 comes back in full, as written in the Refund Policy. Credited against implementation booked within 90 days, on the terms in the same section. Card or Maltese VAT-compliant B2B invoice, 14-day terms on request.

Field results, from prior operating roles

Three engagements, measured.

Measured on real tenants in the founder's prior operating roles, not ITSailor client engagements.

100%
device compliance, inside 30 days

A regulated operator moved off unmanaged BYOD and manual laptop setup to enforceable device compliance, with Intune, BitLocker and Conditional Access.

Measured against that operator's own device estate, which was unmanaged before the rollout. The device count is not published.

Where the 30-day figure comes from
12s
MTTR, simple access requests

Repeat Tier-1 access requests dropped from a 14-hour queue to a 12-second automated flow, with Jira Service Management, n8n and a Slack approval step.

Measured against the same request class before the change, which took 14 hours. It is not an MTTR for anything else.

Where 12 seconds comes from
~€1,500
per month in reclaimed licences

Offboarding became an execution log: HR-triggered session revocation, mailbox conversion, licence recovery and audit trace.

Licence spend that stopped recurring at one operator once offboarding recovered seats on its own. That estate's size and its total licence bill are not published, and this is not a rate quoted for yours.

Where the monthly figure comes from
What the fee owes you

Six artefacts, and a clause that owes them to you.

Deployable artefacts, not slides. Every item transfers to your team or your next vendor on the day it lands.

Written architecture document
Current state, target architecture and migration path, written within 5 business days. Built to be handed to your internal team or any other vendor.
Microsoft 365 security gap analysis
Your agreed security and regulatory control families mapped against the current tenant posture. Critical gaps carry effort tags. Controls use stable ITS-M365 identifiers and public Microsoft, NIST, ENISA and EU sources.
Azure landing-zone sketch and Terraform starter
Phased deployment plan with timelines and cost estimates, plus the Terraform starter skeleton committed to your repository. Optional: it is dropped for the time back if your estate has no Azure in it.
AI deployment roadmap
Which AI workloads fit your environment and in what order, grounded in your own data. Names the prerequisites each one has, including the ones you do not meet yet.
Exit Kit handover pack
Credentials map, architecture decision records, infrastructure-as-code state, operational runbooks, vendor and contract map, cost attribution map and a 90-day self-management guide. Transferable on day one. That is the point.
30 days of email support
Questions about the document and about implementation planning stay open for 30 days after the session, by email.

One ITSailor eBook of your choice, Microsoft 365 Tenant Hardening or the DORA and NIS2 Roadmap, picked in the pre-session questionnaire. The pack itself is written into Refund Policy, section 01, item by item, so what is listed above is what the contract owes you.

Before you decide

Read a real deliverable first.

A redacted page of a gap analysis is published on this site. The control identifiers, the severities and the public sources are real and render from the same module the free scorecard uses. Only the findings are illustrative.

ITS-M365-ID-003critical · essential profile

The control

Is Basic and other legacy authentication blocked tenant-wide?

What the document tells you to do

Block Basic and other legacy authentication tenant-wide. Review OAuth-based POP and IMAP use separately and disable unused protocols per mailbox.

Read the redacted gap analysis
landing-zone/ · your repository
landing-zone/
├── main.tf
├── providers.tf
├── variables.tf
├── versions.tf
├── backend.tf
├── terraform.tfvars.example
├── address-space.md
└── modules/
EXIT-KIT.md
00Executive summary
01Credentials map
02Architecture decision records
03Infrastructure as code
04Operational runbooks
05Vendor and contract map
06Cost attribution map
0790-day self-management guide
The terms

How the €499 works.

Pay once

Card checkout or a Maltese VAT-compliant B2B invoice with 14-day payment terms. €499 flat, one time.

Pack in 5 days, or refunded

The pack is due within 5 business days of session close. If it misses that window the EUR 499 is refunded in full and the documents are still yours when they land.

€499 credited to implementation

Book any ITSailor implementation engagement within 90 days of your session and the full EUR 499 is deducted from that quote.

Both terms are written down. Refund Policy, section 01, implementation credit states what the credit does and does not cover, including that it lapses at 90 days and cannot be redeemed against licensing.

The session

Two hours, four blocks.

  1. 0:00-0:30

    Microsoft 365 Tenant Hardening Audit

    Live in your tenant: security baseline review, Conditional Access policy review, and Defender XDR onboarding sequence check.

  2. 0:30-1:00

    Azure Landing-zone Sketch

    Phased migration plan, identity model, network topology, and a Terraform starter you can deploy. References Founders Hub credit pathway where applicable.

  3. 1:00-1:30

    AI Deployment Strategy

    Which HOIST (autonomous IT support), DECKLOG (Copilot readiness), or SEAWALL (FinOps) workloads fit your environment, grounded in your data, never the public internet.

  4. 1:30-2:00

    Convert Path + Exit Kit Walkthrough

    Pax8-routed managed services vs. Azure migration project: which lane fits. Demo of the Exit Kit pack you receive on day one.

Two hours live · the six-item pack in 5 business days
Your workshop lead

Senior engineer, not a sales rep.

Michal Jatczak, solo founder of ITSailor. Years inside regulated, audit-heavy operations, the kind of environment where auditors actually open the logs and the security clock is always running.

“€499 doesn't buy you another ‘digital transformation’ deck. It buys you a deployable architecture plan for your Cloud, Microsoft 365 and AI automation stack. Plus an Exit Kit that means you keep full Sovereign Mastery over your operation.”
Michal Jatczak · Founder, ITSailor
Microsoft Authorized PartnerPax8 Marketplace · CSPMalta VAT Registered

Three registers, each open to you without asking us. The 5-day delivery term and the implementation credit are ours, not a register's, and both are in the clause.

Frequently asked

Workshop Q&A

Who runs the workshop?
Michal Jatczak, solo founder of ITSailor. Microsoft-Authorized partner, years inside regulated, audit-heavy Maltese operations. No junior handoffs, no sales rep. The person who shipped the production architecture is the person on the call.
What do I get after paying €499?
Immediately: a scheduling link within 24 hours to book your 2-hour live session within the next 14 days. After the workshop: the six-item pack listed on this page, delivered to your inbox within 5 business days, and the same six items are enumerated in Refund Policy section 01, so the contract and the sales page carry one list rather than two. One ITSailor eBook of your choice (Microsoft 365 Tenant Hardening or the DORA & NIS2 Roadmap) comes with the pack as a bonus, picked in the pre-session questionnaire.
Can I see a real deliverable before I buy?
Yes. A redacted page of a real gap analysis is published on this site, with the ITS-M365 control identifiers, the public Microsoft and EU sources and one worked finding intact. Tenant identifiers and the client are removed. It is linked from the deliverable preview above and it is the honest answer to "what am I actually getting", which a table of contents is not.
How does the €499 implementation credit work?
Book any ITSailor implementation engagement within 90 days of your session and the full €499 is deducted from that engagement quote. It applies once, to that engagement, is not cash, is not transferable, cannot be redeemed against Microsoft or other vendor licensing bought through Pax8, and lapses at 90 days. Those limits are written into Refund Policy section 01 rather than only stated here. If you stop after the workshop you keep the whole pack, and there is no obligation to continue.
What happens if the deliverable pack is late?
You get the €499 back. The full six-item pack is due within 5 business days of session close. If it misses that deadline the fee is refunded in full and the documents are still yours when they land. Business days are working days in Malta, and the window pauses only for time spent waiting on access or information requested from you in writing.
What is the Exit Kit?
A handover pack in eight numbered sections: executive summary, credentials map, architecture decision records, infrastructure as code, operational runbooks, vendor and contract map, cost attribution map, and a 90-day self-management guide. Those are the headings of the master template in the ITSailor delivery repository, not a description of it. The promise is that within 24 hours of receiving it, your team or any other vendor can operate the stack without ITSailor. This is Sovereign Mastery. You own everything that gets built.
Is this a sales pitch for your services?
No. The architecture document and Exit Kit are yours regardless of whether you engage ITSailor for implementation. Many clients use them with their internal team or another provider. If we are the right fit for the implementation, you will know by the end of the workshop, and you will own the assets either way.
How does Pax8 marketplace fit in?
For ongoing licensing (Microsoft 365, Azure, backup, security tooling), we route through Pax8 marketplace at wholesale, with no MSP markup. Every licence is transferable to client-direct billing via the Exit Kit on day one. You never pay a margin tax to ITSailor for software you can buy yourself.
Can we pay by invoice instead of card?
Yes. B2B buyers can request a Maltese VAT-compliant Stripe invoice with 14-day payment terms instead of card checkout. Ask via the contact form and the scheduling link goes out as soon as the invoice is paid.
What is the difference between the free scan and the paid workshop?
The AI Readiness Scan is a free 18-question self-assessment across six dimensions (use case, data, governance, security, architecture, operations) that scores your readiness and recommends a workshop focus. The €499 workshop is two hours live in your actual tenant with a senior engineer who works through your specific infrastructure, compliance requirements, and deployment strategy, and you walk away with deployable code, not a PDF.
Not ready to book

Take the templates instead.

Free packs from the same delivery repository the workshop draws on. Delivered by email, no payment.

Stop renting permission to operate.
Start owning your architecture.

€499. Two hours live in your tenant. The six-item pack within 5 business days. You own everything that gets built.

Every session is run live by the founder. What the fee owes you, what happens if it is late, and what the credit does and does not cover are all in Refund Policy, section 01.