Offboarding
A leaver's access gone in one run, with the record an auditor asks for.
- ·Seven steps in order: sign-out everywhere, disable, remove app access, forward mail, out-of-office, hand the OneDrive to the manager, free the licences.
- ·A dry run first, every time — it shows exactly what would change before anything does.
- ·A PDF of every run, and an evidence pack per period that says who was offboarded, how, by whom and how quickly.
- ·Import the HR leaver list and see who left and can still sign in.
Consent: Stepix Core + Stepix Offboarding
Onboarding and role changes
New starters and movers set up from a role, not from memory.
- ·Role templates per client: groups, licences, job details.
- ·A dry run that names every group Microsoft will refuse, and why, before the account exists.
- ·It cannot create or delete groups, or touch groups that admin roles can be assigned to.
Consent: Stepix Core + Stepix Joiner and Mover
Licences
The seats you pay for and nobody uses, in your own prices.
- ·Bought and unassigned, held by disabled accounts, held by people who have not signed in for 90 days — kept apart, because they are not equally certain.
- ·Free and company-wide subscriptions never counted as waste.
- ·A ledger of what offboarding reclaimed.
Consent: Stepix Core
Conditional Access Analyzer
See the policy gap before somebody else finds it.
- ·22 checks against Microsoft's own guidance — MFA for admins and everyone, legacy authentication, device code flow, guests, break-glass accounts.
- ·A what-if simulator: who a sign-in would let in, and which policy decided.
- ·Drift: every policy change since the last nightly scan.
Consent: Stepix Core + Stepix CA Analyzer
Admins and MFA
Who holds an admin role, and whether they could be phished.
- ·Every admin role holder and how they sign in.
- ·A new Global Administrator is on Home the morning after — the first thing an intruder creates.
- ·With Advanced security: permanent admins who could be eligible through PIM, recent activations, and accounts Microsoft considers at risk.
Consent: Stepix Core
App consents
Which apps can read your tenant, and who let them.
- ·Every app registration and its credentials, expiring and expired.
- ·Consents users granted themselves, and revoking one in a click.
Consent: Stepix Core + Stepix App Hygiene
Guests
External accounts nobody remembers inviting.
- ·Dormant guests, what they can still reach, and who owns the groups they are in.
- ·The report needs no extra access; removal is its own small consent.
Consent: Stepix Core + Stepix Guest Lifecycle
Devices
Compliance and encryption from Intune, per client.
- ·Non-compliant, unencrypted and silent devices, and the policies behind them.
- ·Read-only: it cannot wipe, lock or change a device.
Consent: Stepix Devices
Security
Defender's incidents and the mail settings attackers try first.
- ·Open incidents and alerts, polled every fifteen minutes, with Secure Score as a to-do list.
- ·SPF, DKIM and DMARC for every domain, judged by Microsoft's guidance — including domains that send through another service.
- ·With Advanced security: 5 read-only hunting queries — password spray, risky sign-ins that succeeded, mail forwarding, critical vulnerabilities, encoded PowerShell.
Consent: Stepix Core + Stepix Defender
Changes and reports
What changed in each client's tenant, and a report you can send them.
- ·Admin roles, sign-in policy, app grants, federation and partners — from the audit log, kept beyond Microsoft's seven days.
- ·A monthly PDF per client: people, admins, changes, security, mail, licences.
- ·A Monday e-mail of what needs doing, as counts — never names.
Consent: Stepix Core