Identity and access
Admin roles, MFA and sign-in posture, and stale and privileged accounts.
One Microsoft 365 tenant
Identity, Data & AI Security Review
Before more staff and AI tools can reach your client data, know what is exposed and what needs fixing. Switchback provides an independent review of Microsoft 365, identity, sharing, and AI-use controls, with a prioritized plan your existing IT team can carry out. No managed-IT contract or tool purchase is required.
Who it is for
Professional-services firms — law, accounting, engineering, and similar — of roughly 15–75 people, on Microsoft 365, holding client or employee information, without a dedicated security lead.
The usual prompt is a cyber-insurance renewal, a client security questionnaire, or a plan to roll out AI tools such as Copilot.
What you receive
- Executive summary in plain English
- Evidence-backed finding register, with every finding verified by the analyst
- Prioritized 30/60/90-day action plan, written for your IT provider
- Practical AI-use guidance
- A 60-minute walkthrough with you and your IT team
See what you get in a labelled example. The firm in those frames is fictitious.
What is included
One tenant. The review stays inside that boundary.
Guests and external sharing
Who outside the firm can reach what in SharePoint, OneDrive, and Teams.
App permissions
Third-party and OAuth apps with risky access to mail and files.
Logging visibility
What is recorded, and what you could and could not see after an incident.
Sensitive-data flows, sampled
Where client and employee data lives and how it moves, from an agreed sample. Not an exhaustive search.
AI-use inventory
Documented and reported AI tools, plus practical guardrails for staff.
How it works
- Scoping call. Confirm size, trigger, conflicts, and terms.
- Access plan. Approved least-privilege read-only access, or exports you provide. Content collection stays small. Access, retention, and deletion are agreed in writing first.
- Review and verification. Read-only collection. Blind spots are written down.
- Report and walkthrough.
- Close-out. Access is revoked and evidence is deleted on the agreed schedule. An optional 30-day follow-up is available.
Price and timing
From $3,500
Fixed scope for one Microsoft 365 tenant. The final price depends on firm size and scope, and is typically $3,500–$5,500. The quote is fixed after scoping. The timeline starts from a booked slot and depends on access. A typical review is delivered within about 5–7 business days after access is granted, subject to capacity.
The M365 Quick Check is the shorter entry offer: $750–$1,000, about a half day, read-only, with a short written report of the top risks. That fee is credited toward this review if the review is booked within 60 days. See pricing.
You keep your managed relationship and the implementation work. Switchback brings the scoped independent review and a plan we can walk through together.
Not included
These are out of the base review. Where a follow-on is possible, it is quoted separately, read-only, and only with written authorization.
- Penetration testing
- Breach or incident investigation
- Legal or compliance certification
- Exhaustive data discovery
- Public cloud (AWS, Azure, or GCP), except as the add-on below
- Multi-tenant or multi-cloud reviews
- Remediation work
- 24/7 monitoring
Separately scoped add-ons
Neither add-on is part of the review quote (from $3,500, typically $3,500–$5,500). Both are read-only, and both require written scope and authorization before any access. No tenant changes.
On-premises and Active Directory
For a firm that still runs file servers, Active Directory, or a mix of on-premises systems and Microsoft 365. The work is a scoped, read-only look at the systems named in the agreement. It is authorized only. It is not a penetration test, and it does not include changes to those systems.
Small cloud accounts
For a modest footprint in AWS, Azure, or GCP that belongs to the same firm. Read-only access, or exports you provide, under a written scope. One cloud account, not a multi-cloud review. Identity, storage exposure, and logging are typical topics. Quoted separately after scoping.
Quarterly re-check retainers and add-on reviews (on-premises and Active Directory, and small cloud accounts) are available on request. Contact Switchback.
What this review can and cannot tell you
Findings reflect the settings, logs, and samples available during the review. Discovery of unlisted AI tools and sensitive data depends on licensing, logs, and interviews. The report states what was checked and what could not be established.
The Free Exposure Snapshot is a different, narrower product: a passive, public-records-only check of a firm’s domain and email setup, at $0. It is not this review. See a labelled example. The M365 Quick Check ($750–$1,000) is the short read-only step between that snapshot and this review. Pricing FAQ.
About
Logan French
Founder-led. Logan is a cloud and data-security practitioner in East Tennessee. Switchback is independent: it sells no managed services and no tools. Any conflict is disclosed before work starts. From the scoping call through the walkthrough, you work with the person doing the review.
Book a 30-minute scoping call.
Send the firm name, the domain, and what prompted the request. We will confirm whether the M365 Quick Check, the one-tenant review, or an add-on fits.
Book a scoping call