Microsoft Entra ID tenant assurance
We read through your Microsoft Entra ID continuously, use AI to do the tireless part, and tell you what actually needs doing. No dashboard to babysit, no thousand-line export to trawl. And the full report is always there behind it, because filtering is not hiding.
What we do
Subtle Cyber exists to answer one question for organisations running Microsoft Entra ID: is the access model in this tenant actually what you think it is? Everything else we sell is a variation on that question.
01
Conditional Access, role assignments and their settings, PIM, group naming and lifecycle policy, legacy authentication, app consent, named locations, security defaults, device registration, on-premises sync. Thirty datasets per tenant, cached to disk, so a re-run reads the cache instead of asking your tenant again.
02
AI does the part no human sustains: reading every policy against every other one, holding the whole tenant in mind at once, and separating the finding that matters from the one that merely technically qualifies. A person checks its work before we send anything.
03
A short list, ranked, each item phrased as an action rather than a category. Then the full report: every check, its evidence, what we could not read and why, and what we deliberately did not raise.
The filtering
Everything 49 signals seen
What a raw tenant assessment produces: findings, near-misses, tooling disagreements, and items that are technically true and practically irrelevant.
Needs action 6 worth your time
What you hear about: the items that change your risk, in plain language, each one verified by a human before it reaches you.
The full report is always available alongside it — every signal we looked at, whether we raised it or not, with the evidence and the timestamps behind each one. Filtering is not hiding.
Our approach — quietly thorough
It means the unglamorous steps are done and recorded, and that we would rather tell you something uncomfortable than round it off. Four rules carry most of the weight.
Warden's collector can only make read calls; write verbs are absent from the code and a test fails the build if anyone adds one. Before collecting anything it inspects the token it was actually given and refuses to run at all if that token holds write permissions it never asked for. A Global Reader can verify the whole thing afterwards in Sign-in logs.
Every finding carries dated evidence blocks with the exact Graph query that produced it, so your identity team can re-run it themselves. No finding is rated on inference alone, and where a rating rests on an assumption, the report says so out loud.
If we could not read something, it becomes a recorded Limitation in the report, never a quiet gap and never an implied pass. A tenant we could not fully assess must not be able to read as a clean one.
Models analyse and draft. They do not sign anything off. When the AI summary cannot run, the report degrades to an explicit template rather than staying silent, so you always know which kind of text you are reading.
Warden signs in to a tenant read-only, caches what it needs, runs the checks, rates each result on impact against likelihood, attaches dated evidence and writes the report. It is the same engine we use on our own engagements, which is why the report reads like an auditor wrote it rather than a scanner.
How to start
We are a small company and we would rather be useful than clever about this.
Path one
Point us at a non-production tenant and we will run the whole thing against it. You see the report format, the evidence quality and the filtering before anyone signs anything, and we both find out whether your identity posture is interesting before it costs you anything.
Ask for a lab runPath two
Create an app registration with the five read scopes, hand us a client secret, and we can assess the live tenant without anyone holding credentials that could change it. The setup takes about ten minutes and we walk your admin through it step by step.
Read the access instructions
