MFA Readiness Audit
Full per-account breakdown: who's registered, with which methods (Authenticator, passkey, SMS, TOTP), who's partially protected, and the exact list of accounts that will be locked out on enforcement day. Includes per-capability coverage and a 90-day registration trend.
Stale & Inactive Accounts
Dormant accounts with no sign-in in 90/180/365 days, stale guest invites still valid, and orphaned service principals nobody remembers creating. Each finding with last-activity data and a suggested action.
License True-Up Exposure
Unused E3/E5 seats, shadow Teams phone add-ons, dormant mailboxes still consuming a license, and shared mailboxes over-licensed. Quantified in money, per month — so you walk into the true-up knowing your number.
Secure Score Benchmark
Your current Entra ID secure score, the industry median for your tenant size, and the three fastest wins that close the gap. Trend line against the last four quarters.
Teams & SharePoint Growth
Storage consumption trend per quarter, the top-50 sites by growth, and a projection of when you'll cross your allocation — with the billing impact.
Legacy Auth Blockers
Every POP/IMAP/SMTP basic-auth flow, app password, and third-party client still using legacy endpoints — the things that silently break the day MFA gets enforced. Grouped by owner so you know exactly who to notify.