What we do in two weeks
Two weeks from kickoff. Async-first; one or two video sessions for kickoff and handoff. All work happens inside your existing tenant — no migrations, no new platforms, no software for you to install.
Tenant inventory
Users, groups, licenses, external sharing, OAuth apps, mail flow rules, and audit logging — mapped so we know what's actually in your tenant before we change anything.
Secure Score baseline
Microsoft Secure Score measured at kickoff so the change after the Sprint is something you can see, not a feeling.
CIS Benchmark Level 1 audit
Your tenant audited against the CIS Microsoft 365 Foundations Benchmark — the public baseline that defines a sane M365 configuration.
Conditional Access + MFA enforcement
Conditional Access policies designed for your team. MFA enforced across all users, including a documented breakglass account stored offline.
Email security baseline
SPF, DKIM, and DMARC published. Anti-phishing, safe attachments, and safe links policies tuned so legitimate mail flows and obvious junk doesn't.
Sharing + collaboration policy
External sharing scope, anonymous link controls, and guest user lifecycle set so a leaving employee or a forgotten link isn't a quiet data leak.
One-page written report
What was changed. Why. What was left out of scope. What it would cost to close the rest. Plain English, in a doc you can hand to anyone.
What changes after we ship
The visible changes are the ones the team notices first. Sign-ins stop being a free-for-all. Suspicious logins from unfamiliar locations get blocked instead of quietly succeeding. External sharing links don't outlive the project they were created for. Audit logs exist, and someone could actually answer a forensic question with them.
The invisible changes are the ones that matter to anyone reviewing your security posture — an insurer renewing your cyber policy, a customer running due diligence, an auditor prepping you for a SOC 2 or HIPAA engagement. Your Microsoft Secure Score moves up meaningfully. Your CIS Benchmark Level 1 alignment is documented. The one-page report tells the rest of the story.
Drift-Watch — keep it tight, month to month
The Sprint is the project. Drift-Watch is the discipline. Tenants drift. Someone enables a new integration, a new admin gets added, a sharing setting gets toggled to ship a client deliverable and never gets toggled back. Without someone watching, the configuration you paid to harden quietly returns to the unsafe defaults.
Drift-Watch is the optional month-to-month retainer that catches it.
- Monthly Secure Score check with a diff report — what changed, what it means.
- Monthly review of new external sharing, new OAuth app grants, new privileged role assignments, and new mail rules.
- Quarterly CIS Benchmark Level 1 re-audit so drift gets caught before it accumulates.
- Anything found inside the retainer scope gets fixed. Out-of-scope findings get a written quote.
Month-to-month. Cancel anytime. No cancellation fee.
Who this is for
US small businesses with 5–50 employees, on Microsoft 365 Business Standard, Business Premium, or E3, with no in-house IT or security team. Strongest fit for professional-services firms and regulated businesses where data exposure is a real concern but headcount won't support a full-time security hire.
If you're on Google Workspace, we run the same engagement on the Workspace equivalents — talk to us about scope.
What we do not do
- We are not your auditor. SOC 2, HIPAA, PCI, and ISO attestations come from accredited firms. We get you ready and hand you off.
- We don't migrate your tenant from another platform. If you're on something else, we'll talk through the right path before we quote anything.
- We don't resell M365 licenses. You buy directly from Microsoft or through your existing reseller. There's no margin or kickback baked into our quote.
- We don't sell hardware, do cabling, or run physical install. The Sprint is fully remote.
How it works
- 01
A free 30-min virtual session, or a written-reply intake.
Whichever you prefer. Both reach the same person. We learn what you have, what you're worried about, and what you've already tried.
- 02
A written quote in plain English.
Fixed price for the Sprint. Drift-Watch priced separately if you want it. No surprise charges, no asterisks. You decide whether to proceed.
- 03
Two-week Sprint, async-first.
Kickoff, two weeks of work inside your tenant, handoff video session, one-page written report. No long contract. No retainer pressure.
Common questions
How long does the Sprint take?
Two weeks from kickoff. Most of the work is async; we'll have one or two video sessions for kickoff and handoff.
What does it cost?
We send a written quote in plain English after a 30-min virtual session or your message through our contact form. Fixed price, no surprise charges.
Do I have to be on Microsoft 365 Business Premium?
No. The Sprint runs on Business Standard, Business Premium, E3, and most equivalent SKUs. We'll flag during the quote if any of the work needs a license you don't have.
Do I need to migrate or change anything before you start?
No. We work inside your existing tenant. No migrations required.
What if you find more work than fits in the Sprint?
Whatever the Sprint covers gets done. Anything beyond that gets documented in the report, with a clear next-step option — Drift-Watch retainer, follow-on project, or no further action.
Want broader context? Read Why every small business needs MFA — and what happens without it or browse the rest of our cybersecurity work. The Sprint audits against the public CIS Microsoft 365 Foundations Benchmark.