Identity is the perimeter. Most mid-market tenants have a Conditional Access policy set, an MFA story and a privileged access posture — none of which has been formally reviewed in eighteen months. We assess what's there, then fix what matters.
Why this matters
Most Conditional Access policy sets we review were authored years ago, by someone who's since left, against a tenant that's since changed shape. Privileged accounts have accumulated without owners. Legacy authentication is quietly still on.
We assess against the frameworks Australian mid-market organisations actually have to evidence — Essential Eight, SMB1001, ISO 27001, NIST CSF — prioritise findings against actual exposure, and remediate. Without ripping up what's already working.
What it includes
Every CA policy reviewed against intent, coverage gaps and conflicts; a target policy set designed and documented.
Privileged Identity Management, role assignments, break-glass design and approval workflows assessed and remediated.
MFA coverage, phishing-resistant methods (FIDO2, Windows Hello), and a path off SMS where applicable.
Microsoft Defender for Identity, Endpoint and Cloud Apps reviewed; secure score and exposure findings prioritised.
Current maturity mapped to Essential Eight, SMB1001 and ISO 27001 — with a remediation plan to a target level boards and cyber insurers will accept.
Engineering delivery of the highest-priority findings, with internal IT in the room throughout.
Engagement sequence
Tenant configuration, CA policies, privileged roles and MFA coverage extracted and analysed.
Findings prioritised against exposure and Essential Eight maturity. Remediation plan signed off.
CA target policy set, PIM, break-glass and phishing-resistant MFA delivered.
Defender tuning, Essential Eight / SMB1001 / ISO 27001 uplift, and operating model handed to internal IT.
Outcomes
Configuration, findings and remediation evidenced — defensible to a board, an auditor, or a cyber insurer.
Current and target maturity mapped against Essential Eight, SMB1001 and ISO 27001 — with the gap closed where it matters most.
Copilot and other AI workloads inherit a tenant that has been assessed — not assumed.
Other foundations services
The next step
Forty-five minutes with a senior architect. We'll ask about your tenant, your Conditional Access posture and your privileged access reality — and tell you honestly where the gaps are most likely to be.