Identity controls you can show an auditor.

• Identity and authentication

  Authentication methods, legacy protocols, session controls and Conditional Access prerequisites are reviewed as one system.

  • Authentication method registration and coverage
  • Legacy authentication and protocol exposure
  • Conditional Access dependencies and exclusions
  • Session and sign-in controls for sensitive access

• Privileged access

  Admin roles are reduced to named duties, with stronger authentication and activation controls where licensing supports them.

  • Permanent, eligible and unused role assignments
  • Separate daily and administrative identities
  • Phishing-resistant authentication for administrators
  • PIM and access reviews where Entra licensing permits

• Recovery, audit and visibility

  Emergency access, audit settings and verification records are built into the plan instead of being left for an incident.

  • Two cloud-only emergency access accounts
  • Alerting and scheduled recovery-path tests
  • Entra, Microsoft 365 and Purview audit coverage
  • Before and after evidence with named owners

• Devices and access context

  Where devices are enrolled, access policy can use compliance and risk signals. Where they are not, the gap is recorded as readiness work.

  • Intune enrolment and compliance coverage
  • BYOD and application protection boundaries
  • Device-based Conditional Access dependencies
  • Endpoint readiness and remediation backlog

• Apps and consent

  Enterprise apps and registrations are treated as privileged access paths, not as an inventory footnote.

  • Service principals and app registrations
  • High-impact delegated and application permissions
  • Ownerless apps and expiring credentials
  • Consent policy, workflow and publisher signals

• Email and domains

  Mail protection starts with a complete sender inventory, then aligns Defender settings and domain authentication without breaking legitimate senders.

  • SPF, DKIM and staged DMARC posture
  • Anti-phishing and impersonation protection
  • External forwarding and mailbox rule exposure
  • Preset security policies and exceptions

• Collaboration and data

  SharePoint, OneDrive, Teams and guest access are aligned to the intended external boundary and data handling model.

  • Anonymous links and default sharing levels
  • Guest lifecycle and external collaboration
  • Teams federation and external access
  • Sensitivity, retention and DLP readiness

The method is built to reduce that risk: read-only discovery first, named emergency access exclusions, pilot users, report-only evaluation where Microsoft supports it, agreed change windows and a sign-in review after each change. No method can promise zero disruption, so before enforcement each control's dependencies go into the control register and its reversal path into the change and verification log.

The assessment works with the tenant and licences you already have, and the target state is licence-aware. Conditional Access needs Entra ID P1, which Business Premium, E3 and E5 include. Risk-based policies need Entra ID P2, which E5 includes and other plans can add. PIM needs Entra ID P2 or Entra ID Governance, and full access reviews need Entra ID Governance. Controls that are not licensed become explicit gaps, not surprise upsells.

No. Secure Score is a useful directional signal and does not show that the tenant is secure. Success is measured against the agreed control register, verified policy state, tested access paths, resolved high-risk findings and documented exceptions.

No. This is an engineering and evidence engagement, not a certification audit, legal opinion or regulator attestation. I can map technical evidence to an agreed framework so your compliance, legal or audit team has a stronger record to review.

Not safely. A multi-tenant programme uses a shared control catalogue, then applies a tenant-specific overlay for licences, identity model, applications, external collaboration, regulated data and accepted exceptions. A representative pilot is completed before wider rollout.

The access model is agreed during discovery. Where partner access is suitable, GDAP is preferred over broad standing delegated access, with least-privilege roles, a defined duration and no automatic extension. Client-issued access can also be used. I do not take the Global Administrator role. Tenant identifiers, exports and credentials should never be submitted through the public contact form.

The architecture workshop is two hours live, followed by a written pack, and nothing in your tenant is changed. This service makes the changes: discovery, decisions, approved configuration work, verification and evidence handover.

A single-tenant engagement covers 10 business days. The signed statement of work sets the start date and the stage dates, which move by the time spent waiting for your approvals, access and change windows. A tenant portfolio is scoped per tenant after a pilot. Before any production change you receive a written scope, delivery sequence and fixed proposal.