Skip to content
€499 including VAT · two hours live · written pack within 5 business days

Architecture & Security Design Workshop

Two hours live in your Microsoft 365 tenant. I run it myself. Within 5 business days you get the seven items below.

€499 including VAT; an EU business whose VAT number checks in VIES pays the same total with no VAT charged. If the pack is late, I refund the €499 in full, as written in the Refund Policy. Credited against implementation booked within 90 days, on the terms in the same section. Card, or an invoice for businesses, 14-day terms on request.

Before you book

Who it is for and how it works

Who it is for
IT managers, owners and compliance leads at EU organisations on Microsoft 365.
Who runs it
Me, Michal Jatczak, a Polish engineer based in Malta. I run every session and write every document.
Language
English or Polish.
Price
€499 including VAT, paid once by card, or by invoice with 14-day terms.
How booking works
You get a scheduling link within 24 hours of payment and book a session at any time in the next 60 days. If you want the two Microsoft reports ready, book at least two weeks ahead.
What I need from you
One administrator on the call, delegated read-only access during the session, and two Microsoft reports started before we meet.
What I never do
I change nothing in your tenant, and I hold no copy of your Microsoft attestation report.
What you get

Seven items within 5 business days

Every item is written to be handed to your own team, or to your next supplier, on the day it lands.

Written architecture document
Current state, target architecture and migration path, written within 5 business days. Built to be handed to your internal team or any other vendor.
Microsoft 365 security gap analysis
Your agreed security and regulatory control families mapped against the current tenant posture. Critical gaps carry effort tags. Controls use stable ITS-M365 identifiers and public Microsoft, NIST, ENISA and EU sources.
Azure landing-zone sketch and Terraform starter
A phased plan with timings and cost estimates, plus a Terraform starter skeleton (provider, backend and variable files and an address plan) committed to your repository. It is a starting point, not a finished landing zone. If your estate has no Azure, I drop this item and spend its half hour on the Copilot and questionnaire blocks.
Copilot gate record
A list of the conditions that should be true before you switch Copilot on, such as sharing defaults, sensitivity labels and audit retention. Each is recorded as met, not met, out of scope or not readable, with the admin surface or Graph endpoint it was read from and the UTC minute. An unreadable item is written down as unread, never as met. Then the order the failed items have to be closed in, separating what your licences already cover from what they do not.
AI and tenant evidence register
One row for each question agreed in the session, drawn from the control responsibilities Microsoft hands back to you in its own attestation, or from a document you forward before we meet: the answer, the surface it came from, and when it was read. Questions your tenant cannot answer are listed as unanswered rather than filled in, and questions that are legal or contractual rather than technical are marked and routed out.
Exit Kit handover pack
Credentials map, architecture decision records, infrastructure-as-code state, operational runbooks, vendor and contract map, cost attribution map and a 90-day self-management guide, written so your team or another supplier can take over from the day it lands.
30 days of email support
Questions about the document and about implementation planning stay open for 30 days after the session, by email.

The Tenant Hardening for Microsoft 365 field guide comes with the pack, as a bonus. The pack itself is written into Refund Policy, section 01, item by item, so what is listed above is what the contract owes you.

Before you decide

Read a sample deliverable first.

One page of a gap analysis is published on this site. The control identifiers, the severities and the public sources are real and render from the same module the free scorecard uses. The findings are illustrative, and no client's data was used.

ITS-M365-ID-003critical · essential profile

The control

Is Basic and other legacy authentication blocked tenant-wide?

What the document tells you to do

Block legacy authentication with a Conditional Access policy (or Security defaults if you have no Conditional Access), then disable unused POP and IMAP per mailbox as a separate hygiene step.

Read the sample gap analysis
landing-zone/ · Terraform starter skeleton
landing-zone/
├── main.tf
├── providers.tf
├── variables.tf
├── versions.tf
├── backend.tf
├── terraform.tfvars.example
├── address-space.md
└── modules/
EXIT-KIT.md
00Executive summary
01Credentials map
02Architecture decision records
03Infrastructure as code
04Operational runbooks
05Vendor and contract map
06Cost attribution map
0790-day self-management guide
The terms

How the €499 works.

Pay once

€499 including VAT, one payment, by card or by invoice with 14-day terms. A business with an EU VAT number outside Malta that checks in VIES pays the same total with no VAT charged.

Pack within 5 business days, or refunded

The pack is due within 5 business days of session close. If it is late, I refund the €499 in full and the documents are still yours when they land. The clock pauses only while I wait for access or information you agreed to give.

€499 credited to implementation

Book any ITSailor implementation engagement within 90 days of your session and the full €499 is deducted from that quote.

Both terms are written down. Refund Policy, section 01, implementation credit states what the credit does and does not cover, including that it lapses at 90 days and cannot be redeemed against licensing. If the findings call for changes in your tenant, the tenant hardening service does that work.

The session

Two hours in four blocks

Each block ends in one of the written items above.

  1. 0:00-0:30

    Tenant hardening review

    I read identity and Conditional Access, standing administrator roles, devices and mail authentication against the published ITS-M365 baseline. I record each gap with its severity and its public source. The gap analysis is written from this half hour.

  2. 0:30-1:00

    Azure landing zone sketch

    We sketch the identity model, the network layout and the migration phases for Azure. I record the decisions and the open questions. You get the phased plan and a Terraform starter skeleton; if you have no Azure, I drop this block and give its time to the next two.

  3. 1:00-1:30

    Copilot readiness

    I read your Copilot licences, AI settings and agents, your sharing defaults, sensitivity labels and audit retention, and the two Microsoft reports you started before we met. I record each condition as met, not met, out of scope or not readable. You leave with the Copilot gate record and the order to close the gaps in.

  4. 1:30-2:00

    Security questionnaire answers

    You download Microsoft's attestation report on your own screen, and I never hold a copy. We sort the controls Microsoft hands back to you into what your tenant can answer, what only a document can answer and what nobody can. You leave with the evidence register and the unanswered questions written down as unanswered.

Two hours live · the seven-item pack in 5 business days
Who runs it

I run every session myself

I am Michal Jatczak, a Polish engineer based in Malta, trading as ITSailor. I run every session, in English or Polish, and I write every document in the pack.

“€499 doesn't buy you another ‘digital transformation’ deck. It buys you a deployable architecture plan for your Cloud, Microsoft 365 and AI automation stack. Plus an Exit Kit that means you keep full Sovereign Mastery over your operation.”
Michal Jatczak · Founder, ITSailor
Microsoft Authorized PartnerMalta VAT Registered

Both are public registers you can check yourself: the Microsoft partner directory lists Partner Location Account 7113951, and the EU VIES register lists the VAT registration. The 5-business-day delivery term and the implementation credit are mine, not a register's, and both are in the clause.

Questions

Questions before you book

Who runs the workshop?
I do: Michal Jatczak, a Polish engineer based in Malta, trading as ITSailor, a Microsoft Authorized Partner (Partner Location Account 7113951). I run every session myself, in English or Polish, and I write every document in the pack.
What do I get after paying €499?
Within 24 hours, a scheduling link to book your 2-hour live session at any time in the next 60 days. After the session, the seven-item pack listed on this page, by email within 5 business days. Refund Policy section 01 lists the same items. The Tenant Hardening for Microsoft 365 field guide comes with the pack, as a bonus.
What access do you need to my tenant, and can you change anything?
Every read is delegated and read-only, in your session, with your administrator present, and nothing in your tenant is changed. Three reader assignments and nothing else: Global Reader across the admin centres, Entra AI Reader for the Copilot settings, and a Purview reader assignment for the labels and the audit position. Microsoft classifies AI Reader as privileged and it also reads all properties of all users. Two settings live behind a configuration role rather than a reader one, and I do not ask for those: you open that screen yourself and we read it together. If you would rather grant nothing at all, you drive throughout and I read nothing directly. Three things are deliberately not requested. No app registration holding write scopes, and no unattended job of any kind. No SharePoint Advanced Management Administrator role, because the role that reads the item-level oversharing report can also remove permissions at scale. And no tenant-wide crawl of per-item permissions, which is neither something a two-hour call can produce nor something we ask for the rights to attempt. Where those answers are needed, you run the Microsoft report yourself, under your own entitlement, before we meet, and we read the output together.
Do I have to prepare anything before the session?
Two things. You answer the pre-session questionnaire, which tells me what the two hours are for. And your SharePoint Administrator starts two Microsoft reports, because Microsoft takes up to five days to produce the first one and it can be re-run only every 30 days; I cannot start them for you. Whether those reports exist in your admin centre depends on your subscription and licences, so the first email asks you to look. If you want them ready, book the session at least two weeks ahead. If they are not ready, the session still runs and the Copilot block reads your live settings instead.
Can I see a sample deliverable before I buy?
Yes. One page of the gap analysis is published on this site. The control identifiers, severities and sources are the ones I use on every review. The findings are invented to show the format, and no client data was used. It is linked from the deliverable preview above.
How does the €499 implementation credit work?
Book any ITSailor implementation engagement within 90 days of your session and the full €499 is deducted from that engagement quote. It applies once, to that engagement, is not cash, is not transferable, cannot be redeemed against Microsoft or other vendor licensing bought through Pax8, and lapses at 90 days. Those limits are in Refund Policy section 01. If you stop after the workshop you keep the whole pack, and there is no obligation to continue.
What happens if the deliverable pack is late?
You get the €499 back. The full seven-item pack is due within 5 business days of session close. If it is late, I refund the fee in full and the documents are still yours when they land. Business days are working days in Malta, and the window pauses only while I wait for access or information I asked you for in writing.
What is the Exit Kit?
A handover pack in eight numbered sections: executive summary, credentials map, architecture decision records, infrastructure as code, operational runbooks, vendor and contract map, cost attribution map, and a 90-day self-management guide. They are the headings of the template I fill in for every handover. Within 24 hours of receiving it, your team or any other supplier can operate the stack without me. This is Sovereign Mastery: everything that gets built is yours to use, change and hand to another supplier, for good.
Is this a sales pitch for your services?
No. The architecture document and the Exit Kit are yours whether or not you hire me for the implementation, and they are written so your own team or another supplier can work from them. If I am the right fit for the implementation, you will know by the end of the session.
If I buy licences through you, am I locked in?
You are not required to buy a licence at all. The workshop, the pack and the implementation credit are available without moving a single subscription, and the credit cannot be spent on licensing (Refund Policy section 01). If you do move licensing later, ITSailor bills it through the Pax8 marketplace as a Microsoft CSP Indirect Reseller, and Terms section 04 and the CSP Marketplace Terms set out what that means, including that the vendor keeps licence ownership. Moving away again runs on Microsoft new-commerce transfer rules rather than on ours, and the Exit Kit carries the tenant and subscription identifiers your next provider needs in order to start it.
Can we pay by invoice instead of card?
Yes. A business can ask for an invoice issued through Stripe with 14-day payment terms instead of card checkout. Ask through the contact form; the scheduling link goes out as soon as the invoice is paid.
What is the difference between the free scan and the paid workshop?
The AI Readiness Scan is a free 18-question self-assessment across six dimensions (use case, data, governance, security, architecture, operations), scored from your answers. The workshop is two hours live in your own tenant with me, reading the settings themselves, and it ends in the seven written items listed on this page.
Not ready to book

Take the templates instead

Free template packs, downloaded directly. No email needed.

Book the workshop

€499. Two hours live in your tenant. The seven-item pack within 5 business days. Everything that gets built is yours to use, change and hand to another supplier, for good.

I run every session live. What the fee owes you, what happens if it is late, and what the credit does and does not cover are all in Refund Policy, section 01.