What we do

Sign-ins are evaluated by Entra ID Protection for risk and checked against Intune device compliance. Higher-risk sign-ins are asked for additional verification, and non-compliant or unmanaged devices are denied access.

Passkeys, Windows Hello for Business and FIDO2 rolled out through registration campaigns. We also disable legacy authentication, which can be used to bypass MFA.

Administrator roles are granted just in time, for a limited period, with approval and an audit record. This removes permanent Global Administrator assignments from everyday accounts.

Access reviews, entitlement management and joiner/mover/leaver automation, so that access stays aligned with people’s current roles.

Signals from endpoints, identities, email and cloud apps are correlated into single incidents, with automated investigation and remediation for common alert types.

A SIEM running in the unified Defender portal, with KQL detection rules tuned to your environment, log ingestion from non-Microsoft sources and automated response playbooks.

Endpoint detection and response, attack-surface-reduction rules and vulnerability management. Device risk is reported back to Conditional Access, so a compromised device loses access automatically.

Safe Links, Safe Attachments, anti-phishing policies and automated investigation for email and Teams.

Automatic classification and labelling, with encryption applied to the file itself so it stays protected across devices and tenants.

DLP policies in enforcement across Exchange, SharePoint, Teams and endpoints, with sensible exceptions so they do not get in the way of normal work.

Audit logging, legal hold and content search configured and retained, so the records are available if an investigation or regulator needs them.

Insider-risk policies for data theft around resignations, and retention rules that keep records for as long as they are required and delete them afterwards.