Fixed-scope project
Microsoft 365 Security Hardening
Close the gaps, and prove they are closed.
Read the scopeManaged service
Your tenant, run to a written baseline.
We take ownership of Microsoft 365 as an operated environment. Identity, devices, mail and collaboration, all held to a configuration you can read.
Service
Microsoft 365 Management
Engagement
Managed service
Onboarding
2 – 3 weeks
The problem
Most tenants drift
A Microsoft 365 tenant, or M365 as most people write it, is rarely built once and left alone. Licenses get added, policies get exceptions, a device enrollment breaks and someone works around it. Two years on, nobody can say with confidence what the configuration is or why. The answer is not more tickets. It is a written baseline and someone accountable for holding the estate to it.
Scope
What the engagement covers.
Anything outside this list is quoted separately rather than absorbed quietly.
Entra ID identity, groups, licensing and lifecycle
Conditional Access and multi-factor authentication policy
Intune device enrollment, configuration and compliance
Exchange Online, SharePoint, OneDrive and Teams configuration
Defender for Office 365 mail flow and threat policy
Tenant health monitoring, patch posture and service advisories
Onboarding and offboarding runbooks your staff can execute
Deliverables
What you are left holding.
Every item here is an artifact you own, in your systems, readable by someone who was not in the room.
01
Configuration baseline
A written record of every deliberate setting in the tenant and the reason it is set that way. Version controlled, so drift is visible.
02
Monthly estate report
What changed, what is at risk, what we recommend next. One page, no filler.
03
Runbooks
Joiner, mover and leaver procedures written so someone other than us can run them.
04
A named engineer
The person who designed your environment is the person who answers when it misbehaves.
Onboarding: 2 – 3 weeks
Discovery and baseline documentation first, then transition. Ongoing management is monthly.
Fit
Who this is for, and who it is not.
We would rather lose the engagement at this paragraph than three weeks in.
A good fit if
- You run 25 – 500 seats and have outgrown ad-hoc administration
- You have no internal Microsoft 365 specialist, or one who is stretched
- You need the configuration documented for an auditor, an insurer or a buyer
Not a fit if
- You want a help desk that answers end-user password resets. That is a different service, and we will refer you
- You want the cheapest per-seat number on the market
Questions
About Microsoft 365 management.
Do you replace our help desk?
No. We manage the platform: identity, policy, device configuration and mail security. End-user support is not part of it. Many clients keep an internal or outsourced help desk and use us as the engineering layer above it. We will write the escalation path between the two.
What happens if we leave?
You keep everything. The baseline document, the runbooks and the configuration are yours, in your tenant and your repository, from day one. There is no proprietary tooling to unwind and no knowledge that lives only with us.
Can you work alongside our existing IT provider?
Yes. We define the boundary in writing before we start, so there is no ambiguity about who owns which change.
Often paired with
What this usually runs alongside.
These are the combinations that come up most often, not an upsell list.
Retained advisory
InfoSec Consulting
Security judgment, on retainer.
Read the scopeRetained advisory
Compliance & Audit Readiness
Ready for the audit, not just papered for it.
Read the scopeMicrosoft 365 Management
Thirty minutes, no pitch.
Tell us what the environment looks like today. We will tell you what we would change first, and whether this is the right engagement for it.