Deliverables
Audit deliverables
An assessment is only useful if the right people can act on it. The deliverables are written for two audiences: leadership deciding priorities and investment, and the engineers who will make the changes.
This is the proposed engagement model. The exact set of deliverables, their formats, and delivery dates are confirmed in the agreed scope.
Six deliverables
Each one has a defined purpose, audience, and contents.
01
Executive summary
Written for Leadership
The overall position, the most significant risks, and the decisions that need leadership attention, written without product jargon.
- Overall assessment of the in-scope areas
- The most significant risks and why they matter to the business
- Decisions and investment that need leadership attention
02
Findings register
Written for Security and IT
Every finding with its severity, affected area, and business context, in a structure your team can track to closure.
- Finding reference, control area, and title
- Severity, with the business context behind the rating
- Observation, potential impact, and recommended action
03
Supporting configuration evidence
Written for Technical reviewers
The settings, exports, and observations behind each finding, referenced so that any conclusion can be checked independently.
- Evidence references linked to each finding
- The configuration state observed at the time of review
- Notes on any area where evidence was limited
04
Prioritized remediation roadmap
Written for IT leadership
Findings sequenced into waves that account for dependencies, effort, user impact, and the order in which changes can safely be made.
- Findings grouped into sequenced waves
- Dependencies between changes
- Suggested owners and relative effort
05
Technical recommendations
Written for Administrators
Specific configuration guidance for each finding, with considerations for testing and rollout and links to the relevant Microsoft documentation.
- The recommended configuration change
- Testing and rollout considerations
- References to official Microsoft documentation
06
Findings walkthrough
Written for All stakeholders
A working session to go through the results, answer questions, and agree next steps with the people who will act on them.
- Presentation of findings and roadmap
- Questions from leadership and technical teams
- Agreement on owners and next steps
Every finding answers the same five questions
Where is the issue, what was observed, why it matters, what to do about it, and what evidence supports it. A consistent structure lets your team compare findings and track them to closure.
Standing Global Administrator access exceeds operational need
- Control area
- Microsoft Entra ID, privileged access
- Observation
- Six accounts hold permanent Global Administrator assignments. Two show no sign-in activity during the review period.
- Potential impact
- One compromised session on any of these accounts would give tenant-wide administrative control, with no activation or approval step in the way.
- Recommended action
- Limit standing Global Administrator access to documented emergency access accounts. Move daily administration to least-privileged roles with time-bound activation where licensed.
- Validation evidence
- EV-07.1Directory role assignment export
- EV-07.2Sign-in activity for assigned accounts
- EV-07.3Emergency access account register
One register, every finding
The register lists each finding with its reference, severity, place in the roadmap, and a suggested owner, in a structure your team can carry into its own tracking.
| Ref | Finding | Severity | Roadmap | Suggested owner |
|---|---|---|---|---|
| F-03 | Conditional Access exclusion group contains accounts outside its documented purposeIdentity and access | High | Wave 1 | Identity administration |
| F-07 | Standing Global Administrator access exceeds operational needIdentity and access | High | Wave 1 | Identity administration |
| F-11 | DMARC policy for a sending domain is set to monitor onlyEmail protection | Medium | Wave 2 | Messaging |
| F-14 | Users can consent to applications requesting access to their dataApplications and consent | Medium | Wave 2 | Identity administration |
| F-19 | Default sharing link grants access to anyone in the organizationCollaboration and sharing | Low | Wave 3 | Collaboration services |
Sequenced, not just sorted
Findings are grouped into waves. Each wave accounts for dependencies between changes, the effect on users, and how much testing a change needs, so that fixes do not disrupt the business or each other.
Wave 1
Reduce immediate exposure
Changes that close the most direct paths to compromise and have few dependencies.
Wave 2
Strengthen core controls
Changes that need testing, communication to users, or coordination between teams.
Wave 3
Improve governance
Policy, ownership, and lifecycle work that keeps the configuration sound over time.
Waves describe order, not dates. Timing depends on your team’s capacity and change process, and is for you to set.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit