Identity-First MSP Demo

Narrative arc

Three months later

Three months later, the conversation is no longer about discovery. It is about operating control. The data is richer, the residual risk is narrower, and the board can now see measurable improvement instead of broad reassurance.

Executive metrics

Measured movement over repeated runs

Open findings

42 to 18

Reduction across six MRI checkpoints

MFA-enforced users

10 to 1,084

From admins only to a broad phased user baseline

ADFS trusts

14 to 2

Residual operational dependencies only

Audit evidence coverage

38% to 84%

Now usable in board and audit discussion

Trend view

The platform now tells an operating story

Current state

Still real, just better governed

Posture

74/100

After six measured checkpoints

Open findings

Residual issues, not generic noise

MFA coverage

72%

Strong progress, not full completion

Audit evidence

84%

Board and audit-ready rhythm

Trend summaries

What has improved

High-risk exposure is materially lower, not artificially gone
Critical and high findings fell from 18 to 7 as stale accounts, federation sprawl and standing privilege were reduced.
MFA moved from ten protected administrators to a credible phased user baseline
Coverage rose from 1% to 72% using P1-based controls, which is strong progress without pretending the rollout is complete.
Evidence quality now supports calmer board discussion
Audit evidence coverage rose from 38% to 84% because the platform now has repeat runs, better ownership and fresher control evidence.
Residual risk is now concentrated into known workstreams
Guest lifecycle, legacy federation and narrow provisioning exceptions remain, but they are now governable rather than hidden.

Behaviour baseline

The noise now has context

Branch and servicing sign-ins now have a stable operating pattern
Branch operations and servicing users cluster between 06:30 and 19:00 UK time, which makes exceptions easier to challenge than they were in January.
Privileged activity is now concentrated into named maintenance windows
Azure and Entra admin activity is mainly visible on Tuesdays to Thursdays during office hours, with far fewer unexplained out-of-hours changes.
ADFS usage is no longer generic noise
The remaining federation activity now maps mainly to two legacy line-of-business applications, which keeps the retirement plan honest.
Supplier and guest collaboration drift follows business cycles
External access rises around tender support, data-sharing deadlines and specialist advisory engagements, which gives the service partner a predictable review rhythm.

Repeated patterns

Residual issues that justify the service

Guest lifecycle remains the main source of residual access drift
Supplier, adviser and project guest accounts still need a disciplined monthly review to avoid drift reappearing.
Two ADFS-dependent application paths still require careful retirement
The remaining trusts are now narrow and well understood, but they still matter because they support operationally important workflows.
A small number of MIM-driven exceptions still affect older servicing applications
This is no longer broad uncertainty; it is bounded legacy clean-up that can be reported and managed.
Residual privileged-access hygiene still needs active challenge
Most standing access has gone, but a small emergency-operational pattern remains under monthly scrutiny.

Audit and governance

Board-level control signals

Monthly access reviews completed
Three consecutive cycles completed with 91% attestation coverage across privileged, guest and high-risk access domains.
Evidence freshness is now credible for board and audit use
Twenty-eight of thirty-three mapped control areas now have evidence refreshed within the last 30 days.
Lifecycle evidence quality improved materially
Joiner, mover and leaver evidence is now strong enough to support a repeatable control discussion rather than ad hoc assurance.
Board reporting is now routine
A monthly identity-assurance pack has been produced to schedule for the last three months, with visible movement and residual-risk commentary.

Current priority findings

The remaining list is narrower and more specific

criticalPrivilegedAccess

One shared emergency administration pattern still remains in weekend operations support

Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend support and remains the clearest residual control weakness.

Business impact

The issue matters because accountability and investigation are still weaker than they should be in one corner of the estate.

Recommended action

Replace the shared pattern with named accountable access and keep the residual exposure visible until it is gone.

Owner: Security operations

highGuestAccess

Supplier and adviser lifecycle remains the main recurring source of residual access drift

The issue is smaller and more measurable than it was in January, but it still repeats often enough to justify a standing managed review service.

Business impact

Without cadence, access drift will return even if today’s list is cleaned up.

Recommended action

Keep a monthly guest and supplier review with contract-end closure evidence and named owners.

Owner: Service partner lead

mediumFederation

Two ADFS trusts still support regulated branch-servicing workflows

The federation footprint is materially smaller, though two line-of-business paths still require controlled retirement rather than forced removal.

Business impact

This preserves realism. The environment is healthier, but not magically modernised.

Recommended action

Complete the application-by-application retirement plan and track the remaining trusts monthly.

Owner: Infrastructure engineering

mediumProvisioning

A narrow MIM exception still drives inherited roles into older servicing applications

Only a small number of legacy workflows remain dependent on historic MIM logic, but they still need manual oversight.

Business impact

Residual legacy provisioning is now a bounded operational issue rather than a hidden unknown.

Recommended action

Keep the exception list visible and retire the remaining rules as application dependencies are removed.

Owner: Identity engineering

Recurring MSP value

This is where the demo becomes sticky

Managed identity assurance cadence

A monthly retained service covering privileged access, stale identity closure, guest lifecycle and MFA rollout tracking.

Hybrid federation and provisioning retirement

A bounded workstream around ADFS reduction and MIM exception clean-up, kept honest by repeat evidence.

Supplier and guest governance pack

A recurring review service for adviser, supplier and contractor access across M365, ServiceNow and other business tooling.

Quarterly board and audit reporting

An executive reporting layer that turns technical identity work into visible commercial value for the service partner and the client.

Narrative arc

Three months later

Executive metrics

Measured movement over repeated runs

Open findings

42 to 18

Reduction across six MRI checkpoints

MFA-enforced users

10 to 1,084

From admins only to a broad phased user baseline

ADFS trusts

14 to 2

Residual operational dependencies only

Audit evidence coverage

38% to 84%

Now usable in board and audit discussion

Trend view

The platform now tells an operating story

Current state

Still real, just better governed

Posture

74/100

After six measured checkpoints

Open findings

Residual issues, not generic noise

MFA coverage

72%

Strong progress, not full completion

Audit evidence

84%

Board and audit-ready rhythm

Trend summaries

What has improved

High-risk exposure is materially lower, not artificially gone
Critical and high findings fell from 18 to 7 as stale accounts, federation sprawl and standing privilege were reduced.
MFA moved from ten protected administrators to a credible phased user baseline
Coverage rose from 1% to 72% using P1-based controls, which is strong progress without pretending the rollout is complete.
Evidence quality now supports calmer board discussion
Audit evidence coverage rose from 38% to 84% because the platform now has repeat runs, better ownership and fresher control evidence.
Residual risk is now concentrated into known workstreams
Guest lifecycle, legacy federation and narrow provisioning exceptions remain, but they are now governable rather than hidden.

Behaviour baseline

The noise now has context

Branch and servicing sign-ins now have a stable operating pattern
Branch operations and servicing users cluster between 06:30 and 19:00 UK time, which makes exceptions easier to challenge than they were in January.
Privileged activity is now concentrated into named maintenance windows
Azure and Entra admin activity is mainly visible on Tuesdays to Thursdays during office hours, with far fewer unexplained out-of-hours changes.
ADFS usage is no longer generic noise
The remaining federation activity now maps mainly to two legacy line-of-business applications, which keeps the retirement plan honest.
Supplier and guest collaboration drift follows business cycles
External access rises around tender support, data-sharing deadlines and specialist advisory engagements, which gives the service partner a predictable review rhythm.

Repeated patterns

Residual issues that justify the service

Guest lifecycle remains the main source of residual access drift
Supplier, adviser and project guest accounts still need a disciplined monthly review to avoid drift reappearing.
Two ADFS-dependent application paths still require careful retirement
The remaining trusts are now narrow and well understood, but they still matter because they support operationally important workflows.
A small number of MIM-driven exceptions still affect older servicing applications
This is no longer broad uncertainty; it is bounded legacy clean-up that can be reported and managed.
Residual privileged-access hygiene still needs active challenge
Most standing access has gone, but a small emergency-operational pattern remains under monthly scrutiny.

Audit and governance

Board-level control signals

Monthly access reviews completed
Three consecutive cycles completed with 91% attestation coverage across privileged, guest and high-risk access domains.
Evidence freshness is now credible for board and audit use
Twenty-eight of thirty-three mapped control areas now have evidence refreshed within the last 30 days.
Lifecycle evidence quality improved materially
Joiner, mover and leaver evidence is now strong enough to support a repeatable control discussion rather than ad hoc assurance.
Board reporting is now routine
A monthly identity-assurance pack has been produced to schedule for the last three months, with visible movement and residual-risk commentary.

Current priority findings

The remaining list is narrower and more specific

criticalPrivilegedAccess

One shared emergency administration pattern still remains in weekend operations support

Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend support and remains the clearest residual control weakness.

Business impact

The issue matters because accountability and investigation are still weaker than they should be in one corner of the estate.

Recommended action

Replace the shared pattern with named accountable access and keep the residual exposure visible until it is gone.

Owner: Security operations

highGuestAccess

Supplier and adviser lifecycle remains the main recurring source of residual access drift

The issue is smaller and more measurable than it was in January, but it still repeats often enough to justify a standing managed review service.

Business impact

Without cadence, access drift will return even if today’s list is cleaned up.

Recommended action

Keep a monthly guest and supplier review with contract-end closure evidence and named owners.

Owner: Service partner lead

mediumFederation

Two ADFS trusts still support regulated branch-servicing workflows

The federation footprint is materially smaller, though two line-of-business paths still require controlled retirement rather than forced removal.

Business impact

This preserves realism. The environment is healthier, but not magically modernised.

Recommended action

Complete the application-by-application retirement plan and track the remaining trusts monthly.

Owner: Infrastructure engineering

mediumProvisioning

A narrow MIM exception still drives inherited roles into older servicing applications

Only a small number of legacy workflows remain dependent on historic MIM logic, but they still need manual oversight.

Business impact

Residual legacy provisioning is now a bounded operational issue rather than a hidden unknown.

Recommended action

Keep the exception list visible and retire the remaining rules as application dependencies are removed.

Owner: Identity engineering

Recurring MSP value

This is where the demo becomes sticky

Managed identity assurance cadence

A monthly retained service covering privileged access, stale identity closure, guest lifecycle and MFA rollout tracking.

Hybrid federation and provisioning retirement

A bounded workstream around ADFS reduction and MIM exception clean-up, kept honest by repeat evidence.

Supplier and guest governance pack

A recurring review service for adviser, supplier and contractor access across M365, ServiceNow and other business tooling.

Quarterly board and audit reporting

An executive reporting layer that turns technical identity work into visible commercial value for the service partner and the client.

A calmer, boardroom-grade demo built around the real MRI-led product experience.

Three months later

Measured movement over repeated runs

The platform now tells an operating story

Still real, just better governed

What has improved

The noise now has context

Residual issues that justify the service

Board-level control signals

The remaining list is narrower and more specific

One shared emergency administration pattern still remains in weekend operations support

Supplier and adviser lifecycle remains the main recurring source of residual access drift

Two ADFS trusts still support regulated branch-servicing workflows

A narrow MIM exception still drives inherited roles into older servicing applications

This is where the demo becomes sticky

A calmer, boardroom-grade demo built around the real MRI-led product experience.

Three months later

Measured movement over repeated runs

The platform now tells an operating story

Still real, just better governed

What has improved

The noise now has context

Residual issues that justify the service

Board-level control signals

The remaining list is narrower and more specific

One shared emergency administration pattern still remains in weekend operations support

Supplier and adviser lifecycle remains the main recurring source of residual access drift

Two ADFS trusts still support regulated branch-servicing workflows

A narrow MIM exception still drives inherited roles into older servicing applications

This is where the demo becomes sticky