Methodology
Assessment methodology
Every engagement follows four stages, from agreeing scope and access to presenting a prioritized roadmap. Each stage has defined inputs and outputs, so you know what is needed from your team and what you will receive.
Four stages, in order
For each stage: what happens, what is needed from your team, and what you receive.
Stage 01
Define scope and access requirements
Agree which areas are in scope, the questions the assessment should answer, and the access and evidence handling the review needs.
- What happens
- Confirm objectives and in-scope control areas, note constraints such as change freezes, and define the roles, permissions, and evidence handling the review will use.
- What we need from you
- A technical contact, an overview of the tenant and any known concerns, and a decision on who grants access.
- What you receive
- An agreed scope covering areas, deliverables, access, evidence handling, timing, and pricing.
Stage 02
Review agreed configurations and evidence
Examine the configuration of the in-scope areas and record the evidence behind each observation.
- What happens
- Review configuration across the agreed areas using the access and methods set out in the scope, recording evidence for each observation as it is made.
- What we need from you
- Access as agreed, and someone who can explain intent, such as why a policy exception exists.
- What you receive
- Observations with evidence. Anything that appears to need urgent attention is raised with your nominated contact rather than held for the report.
Stage 03
Validate and prioritize findings
Confirm each observation, remove false positives, and rate findings by severity and business context.
- What happens
- Check each observation against its evidence, clarify intent with your team where a setting looks deliberate, rate severity, then adjust priority for business context and dependencies.
- What we need from you
- Short clarification sessions with the owners of affected areas.
- What you receive
- A validated findings register and a draft remediation sequence.
Stage 04
Present recommendations and next steps
Walk through the findings and the recommended sequence of changes with the people who will act on them.
- What happens
- Present findings to leadership and technical teams, explain the roadmap, and agree owners and next steps.
- What we need from you
- Attendance from decision makers and the teams who will carry out changes.
- What you receive
- The final report, remediation roadmap, and findings walkthrough.
Agreed before the review starts
Least privilege and time-bound access are design principles of the method, applied wherever the assessment approach allows.
- Tenant access and permissions
- Which roles are granted, by whom, and for how long.
- Evidence handling
- What is collected, where it is stored, who can see it, and how it is returned or deleted.
- Remediation activity
- Whether any changes are part of the work, and who makes them. Nothing is changed without that agreement.
Access principles
Access is a decision you make, not a default. The roles used, who grants them, and how long they last are recorded in the agreed scope before the review starts.
- Least privilege
- Request the narrowest roles that let the review answer the agreed questions. Read-oriented roles are preferred wherever the assessment method allows.
- Time-bound
- Access has an agreed end date, and its removal is confirmed when the review window closes.
- Agreed in writing
- Roles, duration, and the people involved are recorded in the agreed scope before access is granted.
- Evidence kept to what is needed
- Collect the configuration evidence that supports findings, and no more.
Microsoft Entra ID includes built-in read-oriented roles. Microsoft describes Global Reader, for example, as a role whose users “can read settings and administrative information across Microsoft 365 services but can’t take management actions.” Whether a reader role is sufficient depends on the areas in scope, and this is confirmed during scoping.
Access and information handling
These questions are answered during scoping and recorded in the agreed scope. The answers depend on your environment, your policies, and the assessment method.
What access is required?
The roles and permissions the review needs, who grants them, and for how long. Read-oriented roles are preferred wherever the method allows.
What evidence will be collected?
Which configuration exports, reports, and screenshots are gathered, and which areas are excluded.
Who can access that evidence?
The named people, on both sides, who can view evidence and draft findings.
How will evidence be transferred and retained?
The transfer method, where evidence is stored during the engagement, and what happens to it afterwards.
When will access be revoked?
The date access ends, who removes it, and how removal is confirmed.
How findings are rated
Severity describes the weakness itself. Priority then accounts for your business context, dependencies between changes, and the effort involved, which is why the roadmap order can differ from a simple severity sort.
- Critical
- A weakness that exposes the tenant to compromise or significant data loss with little effort, and should be addressed first.
- High
- A significant weakness that materially increases the likelihood or impact of an incident.
- Medium
- A weakness that raises risk in combination with other conditions, or affects a limited set of users or data.
- Low
- A deviation from recommended practice with limited direct impact.
Changes to your tenant
The review examines and reports on configuration. Nothing is changed without your agreement. If you want help carrying out remediation, that work, who performs it, and how it is tested are agreed separately and in writing before any setting is changed.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit