What access and staff time are needed?
A tenant owner and approved read-only exports or supervised configuration review. Do not send passwords, tokens, or unrestricted administrator access through the website. Name an identity owner for kickoff, evidence questions, and the findings review. Bring a business owner when a proposed change affects access or support procedures.
How is the work scheduled?
Scope and evidence request, configuration review, validation of findings, then a walkthrough of the action plan. The proposal confirms dates and client effort after tenant and application scope are agreed.
What is outside this engagement?
Production policy changes, application migrations, penetration testing, and certification are not included unless separately agreed.
How is the fee determined?
The quote depends on tenant count, applications, privileged roles, evidence availability, and whether implementation support is needed. Agree scope, fee, and schedule before work starts.