Services
Three areas of work, all within Microsoft 365. Take them as a short fixed-price project, an assessment, consultancy by the day, or ongoing support. Every engagement is scoped and priced before it starts.
01
Microsoft Entra configured so that access depends on who is signing in, the device they use and how risky the sign-in looks.
Sign-ins are evaluated by Entra ID Protection for risk and checked against Intune device compliance. Higher-risk sign-ins are asked for additional verification, and non-compliant or unmanaged devices are denied access.
Passkeys, Windows Hello for Business and FIDO2 rolled out through registration campaigns. We also disable legacy authentication, which can be used to bypass MFA.
Administrator roles are granted just in time, for a limited period, with approval and an audit record. This removes permanent Global Administrator assignments from everyday accounts.
Access reviews, entitlement management and joiner/mover/leaver automation, so that access stays aligned with people’s current roles.
02
Defender XDR and Sentinel set up so that alerts are correlated, prioritised and assigned to a person.
Signals from endpoints, identities, email and cloud apps are correlated into single incidents, with automated investigation and remediation for common alert types.
A SIEM running in the unified Defender portal, with KQL detection rules tuned to your environment, log ingestion from non-Microsoft sources and automated response playbooks.
Endpoint detection and response, attack-surface-reduction rules and vulnerability management. Device risk is reported back to Conditional Access, so a compromised device loses access automatically.
Safe Links, Safe Attachments, anti-phishing policies and automated investigation for email and Teams.
03
Microsoft Purview configured to classify data, prevent it leaving and keep the audit trail you may later need.
Automatic classification and labelling, with encryption applied to the file itself so it stays protected across devices and tenants.
DLP policies in enforcement across Exchange, SharePoint, Teams and endpoints, with sensible exceptions so they do not get in the way of normal work.
Audit logging, legal hold and content search configured and retained, so the records are available if an investigation or regulator needs them.
Insider-risk policies for data theft around resignations, and retention rules that keep records for as long as they are required and delete them afterwards.
How we work
Not every problem needs a programme. Short projects and day-rate consultancy are as much of what we do as long engagements, and you can move between them.
A defined piece of work with a start, an end, and a fixed price.
Roll out Conditional Access. Migrate to phishing-resistant sign-in. Stand up Sentinel with a first detection set. Get PIM covering every privileged role. Scope is agreed and priced before the work starts, and the engagement closes when the definition of done is met. Typical projects run two to eight weeks.
A review of your tenant, written up, with no obligation to continue.
We look at what is configured today against Microsoft security baselines and your own risk profile, then hand over the findings with a prioritised remediation plan you own. Many clients run the remediation themselves from there; others turn it into a short project. Either is fine.
Access to the same engineers by the day, without a project wrapper.
Design review before you commit to an architecture. A second opinion on a licensing decision. Help through an audit or a security questionnaire. Cover while an internal hire is being recruited. Booked by the day or the half day, used when you need it, with no minimum retainer.
A monthly arrangement for tenants that need a hand on the tiller.
Policy tuning as the estate changes, alert triage, quarterly posture reviews, and someone to call when Microsoft ships a change that affects you. Scoped to the hours you actually need and reviewed every quarter, not locked to a multi-year term.