Identity & Privilege
Administrative roles, permanent privileges, MFA, Conditional Access, PIM, break-glass design and dormant identities.
Microsoft 365 Security & Controls
Connect Microsoft 365 configuration to governance and audit evidence.
Review identity, privileged access, user lifecycle, endpoint posture and audit evidence across Entra ID, Microsoft 365, Intune and Defender where in scope.
What the review can cover.
Scope is confirmed before evidence collection. Read-only access, exports, screen-share or client-generated evidence can be used depending on the engagement.
Joiner / Mover / Leaver
Provisioning, role change, offboarding, guest users, service accounts and stale access.
SharePoint & Collaboration
External sharing, site permissions, M365 groups, Teams and ownership patterns.
Intune & Endpoint
Compliance, BitLocker, security baseline, device inventory, patch posture and configuration evidence.
Defender & Logging
Security configuration, alerting, audit logs and evidence retention where licensed and in scope.
Evidence & Governance
Access reviews, approvals, exception records, change history and repeatable evidence generation.
A technical finding should map back to risk.
Configuration screenshots are not the end product. The assessment connects configuration state to control objective, evidence quality, risk and corrective action.
Example
Condition: Multiple permanent privileged role assignments exist without recent review evidence.
Risk: Excessive or stale administrative access can enable unauthorised changes and weakens accountability.
Action: Validate business need, reduce standing privilege, implement an appropriate review cadence, and retain approval evidence.
Role inventoryEvidence
MFA / CA stateEvidence
Approval recordEvidence
Review historyEvidence