Controls the Microsoft practice can scope
Identity and authentication
Entra ID, Conditional Access, multi-factor authentication, guest access and role reviews.
Privileged access
Role inventory, least-privilege redesign, Privileged Identity Management, just-in-time administration and documented emergency access.
Managed devices
Intune compliance and configuration profiles, Windows and mobile-device policies, Autopilot provisioning and BitLocker requirements.
Microsoft security alignment
Tenant security baselines and Defender for Identity or Endpoint alignment where licensed and included in the scope.
A defined owner for each change
Your proposal identifies who requests and approves policy changes, which accounts and devices are covered and how privileged access is arranged. A tenant-hardening or access redesign can be a fixed project; recurring administration names the ongoing tasks and reviews your team wants covered.
How a security scope review proceeds
- Review the environment. Identify tenants, endpoint enrollment, current licenses, privileged roles and existing providers' responsibilities.
- Prioritize the agreed controls. Select the identity, access, device or tenant changes to be included and identify who can approve them.
- Prepare approved changes. Record the access method, pilot or validation checks, emergency-access procedure and changes affecting users.
- Document the handover. Retain the agreed configuration records, open risks, procedures and responsibility for further review.
Make the operating boundary explicit
- Systems and licensed controls included in the engagement.
- Who approves privileged access and user-impacting policy changes.
- The recurring administration, review and escalation tasks assigned to each team.
- Monitoring coverage and response targets where specifically contracted.
- Any backup, recovery or incident work that requires its own scope.
- Evidence and procedures retained after a project or review.
Questions buyers ask
Which Microsoft security areas can you help with?
The portfolio covers Entra ID, Conditional Access, MFA, privileged access, guest and role reviews, Intune device policies and tenant security baselines. Defender for Identity or Endpoint work depends on licensing and the agreed scope.
Can you review standing administrator access?
Yes. A scoped engagement can review roles, least-privilege requirements, PIM, just-in-time access and emergency-access procedures. Approvals and the changes included are documented before implementation.
Can this work alongside our IT or security provider?
Yes. Name the controls, approvals and escalation responsibilities each team retains so access changes and device policies have an agreed owner.
What evidence should we request in the proposal?
Ask for the covered systems, planned control changes, validation checks, approval process, retained procedures and follow-up responsibilities. Any monitoring or incident-response commitment should name its hours, authority and scope.
Related services
Request a Microsoft security scope review
Share tenant and device counts, current Microsoft licenses, existing IT responsibilities and the identity or endpoint work you need reviewed. Arrange sensitive evidence and access separately.
Remote delivery across the United States and Canada. Hours, price, on-site exceptions and recovery responsibilities are confirmed in your written proposal.
Updated October 15, 2026. Monitoring, support response and project work have distinct scopes. Capability and credential information · Company details.