Diagnostic
Identity & Insurance Evidence Pack
Prove your access controls before an audit, insurance renewal, or incident forces the question.
"Our cyber-insurance renewal asks whether everyone has MFA and admin accounts are locked down, and we cannot prove either answer."
Fixed fee
$5,950Renewal already on the calendar? The Compact scope answers the questionnaire itself: every control question the carrier asks, answered from your own tenant, with the evidence attached. from $2,500, for eligible bounded environments.
5.0out of 5
Top Rated on Upwork · 100% Job Success · on every client-rated engagement, scored by Upwork. Delivered work →
What moves the number: tenants, sign-in, how many apps sign in through Microsoft 365, mail, Azure and endpoints. Headcount is only one of them. The scope-fit check tells you where you land →
What you walk away with
What you keep when this is done
You keep a written record of what is broken, what it is costing you, and what it costs to fix, in a form your leadership can act on. It also sets the fixed price of the fix, so nothing after this is open ended.
- A grid of what your sign-in rules actually cover, group by group: administrators, staff, outside guests, and the accounts that run in the background, with every gap marked.
- A named list of every person and account that can still sign in without a second step, so the MFA question on a renewal or audit form gets a documented answer instead of a guess.
- A register of the emergency accounts that get you back in if a sign-in rule locks everyone out of Microsoft 365, whether they are protected, and whether anyone is alerted when one is used.
- Every outside app that can reach your mail and files, what each one is allowed to do once it is in, and a keep or revoke call on it.
- The openings an attacker would look for: accounts that keep admin powers switched on all the time, and older sign-in methods that bypass your rules, in the order to close them before your renewal.
How the diagnostic works
01Read-only inspection
Your live environment is inspected directly, read-only. Nothing changes and nothing breaks.
02Findings, scored and priced
You see what is actually risky, what it is costing you, and a fixed quote to fix what matters. Ranked in plain language.
03Your plan, either way
The remediation plan is yours to keep. Take the fix at the quoted price, or hand the plan to your own team or another vendor.
This is for you if
- You have a real decision or risk on the line: an audit, a renewal, a migration, a board question, or an AI rollout.
- You want findings at the sample report's level of specificity: named roles, quantified waste, tested assumptions.
- You want the price fixed in writing before the work starts.
It is not for you if
- You need a quick checkbox scan rather than findings you plan to act on.
- You are looking for open-ended staff augmentation with no defined finish line.
After the diagnostic
Remediation is scoped from the evidence
Remediation is quoted as a fixed scope rather than open-ended hours. The diagnostic shows exactly which of these you need, and what it should cost.
Stabilize
Close the urgent gaps the evidence surfaced, on a fixed scope, before they become an incident.
Control
Stand up the controls and operating model the environment was missing, in staged, measurable releases.
Oversee
Fractional Architecture Oversight once the foundation is in place: scheduled senior review on a defined monthly cadence, offered as a follow-on. Implementation is separately scoped.
Delivery, access, and scope boundaries
Typical delivery
10 business days, elapsed. The window begins after the scope is confirmed, the kickoff is complete, required access works, and requested exports and documentation have been provided. Client, licensing, or third-party delays pause the timeline.
Access needed
Read-only access to Entra ID, Conditional Access, authentication methods, privileged roles, sign-in reporting, and relevant Microsoft security reports. Access is time-limited, protected with MFA, and read-only wherever the platform allows. Credentials should never be submitted through the website.
Not included
No Conditional Access enforcement, MFA rollout, identity remediation, penetration testing, or any guarantee that an insurer or auditor will approve the environment.
Every assessment includes one kickoff and one findings review; extra workshops or revision rounds are a change order. Unless the signed statement of work says otherwise, no assessment includes production changes, remediation, implementation, emergency incident response, 24/7 availability, software or licensing costs, legal attestation, or third-party vendor fees. The signed statement of work controls if it differs from this page.
Other diagnostics
See all →Microsoft Estate Risk Ledger
Find the risk, waste, and missing ownership across Microsoft 365, Azure, identity, licensing, and infrastructure.
Copilot & Shadow AI Exposure Report
See what Copilot and other AI tools can reach before you roll them out, including the AI nobody approved.
Migration & Cutover Plan
Plan the migration, rollback, and reconciliation before anything moves: mailboxes, tenants, SharePoint, Teams, Slack, Azure.
$5,950
Identity & Insurance Evidence Pack