# Investigation: EntraID & Azure AD Audit-as-a-Service (spark-029)

**Analyst:** ARI  
**Date:** 2026-02-14  
**Classification:** Business Opportunity Assessment  
**Verdict:** CONDITIONAL GO — viable but requires differentiation beyond basic scanning  
**Conviction:** 6/10  

---

## CONTEXT

DJ is evaluating a productized service: automated EntraID/Azure AD security audits for mid-market companies (500–5,000 employees). Client grants read-only tenant access, agent team runs identity security assessment, delivers branded report with risk scores and remediation. Pricing: $1,500–3,000 per audit, $500/quarter ongoing.

---

## FINDINGS

### 1. Market Size & TAM

**[MEDIUM CONFIDENCE]**

- Microsoft claims 720M+ Entra ID users across millions of organizations (2025 figures)
- Mid-market segment (500–5,000 employees): estimated 80,000–120,000 companies in North America use M365/Entra ID
- Most mid-market companies lack dedicated identity security staff — typically 1-3 IT generalists managing M365
- **Addressable market estimate:** If 10% would buy an external audit at $2,000 avg = ~$16M–$24M TAM in North America
- **Serviceable market (realistic reach):** 50–200 clients in year 1 = $100K–$600K revenue opportunity
- The real TAM expansion is ongoing monitoring ($500/quarter × clients = recurring revenue)

### 2. Competition — THIS IS THE KEY RISK

**[HIGH CONFIDENCE]**

**Free/Open-Source Tools (DIRECT THREAT):**
- **Maester.dev** — Open-source Entra ID security testing framework. Built on Pester + Microsoft Graph. Pre-built tests, maps to MITRE ATT&CK, generates interactive HTML reports. Free. Actively maintained. This does 70–80% of what the proposed service would do.
- **CISA ScubaGear** — Free US government tool that evaluates M365 tenant configuration against CISA's Secure Configuration Baselines. Visual reports. Actively maintained since 2022.
- **Microsoft Secure Score** — Built into every M365 tenant. Free. Covers identity, data, device, apps.
- **Entra ID Security Config Analyzer (EIDSCA)** — Free, integrated into Maester

**Commercial Competitors:**
- **Varonis** — DatAdvantage for Azure AD. Enterprise pricing ($50K+/year). Not mid-market friendly.
- **CrowdStrike Falcon Identity** — Identity threat detection. Enterprise. $15–25/endpoint/year.
- **Semperis** — AD security specialist. Purple Knight (free AD assessment tool). Directory Services Protector (paid).
- **Trellix/CoreSecurity** — Identity governance tools
- **Boutique MSPs/MSSPs** — Many offer "M365 security assessments" as loss-leaders to sell managed services. Pricing: $0–$5,000.
- **CIS Benchmarks** — Free configuration benchmarks for Azure AD

**Assessment:** The scanning/reporting layer is heavily commoditized. Free tools exist. The value must come from interpretation, remediation guidance, and ongoing relationship.

### 3. Regulatory Drivers

**[HIGH CONFIDENCE — Strong tailwinds]**

- **SOC 2 Type II** — Requires identity access controls review. Annual audits need evidence of access reviews, MFA enforcement, privileged access management.
- **HIPAA** — Access controls (§164.312(d)) require unique user identification, emergency access, automatic logoff, encryption.
- **NIST 800-53 / NIST CSF** — Identity management controls (IA family) are foundational.
- **Cyber Insurance** — Increasingly requires MFA evidence, privileged access controls, identity security posture documentation. This is the #1 growth driver. Insurers are mandating identity security assessments before binding/renewing policies.
- **PCI DSS 4.0** — Enhanced identity/authentication requirements effective 2025.
- **State Privacy Laws** — CCPA, CPRA, growing state-level requirements driving audit demand.
- **SEC Cybersecurity Rules** — Public companies must disclose material cyber incidents; drives downstream vendor/partner audits.

**Assessment:** Regulatory/insurance pressure is the strongest demand driver. Companies NEED documentation proving their identity posture is sound. Free tools generate reports but don't generate compliance artifacts with professional attestation.

### 4. Technical Feasibility — Microsoft Graph API Read-Only Access

**[HIGH CONFIDENCE]**

With read-only application permissions, you can audit:

**Fully Accessible (Read-Only):**
- ✅ User accounts, guest accounts, disabled accounts, stale accounts
- ✅ Group memberships (security groups, M365 groups, dynamic groups)
- ✅ Directory roles and privileged role assignments (Global Admin, etc.)
- ✅ Conditional Access policies (read all policies, evaluate coverage gaps)
- ✅ Application registrations and service principals (OAuth app sprawl)
- ✅ Authentication methods per user (MFA status, passwordless, FIDO2)
- ✅ Sign-in logs and audit logs (risky sign-ins, impossible travel)
- ✅ Access reviews configuration
- ✅ Named locations, trusted IPs
- ✅ Administrative units
- ✅ License assignments
- ✅ Password policies (tenant-level)
- ✅ Identity Protection risk detections and risky users

**Partially Accessible:**
- ⚠️ PIM (Privileged Identity Management) — read eligible/active assignments, but some PIM features require P2 license on the tenant
- ⚠️ Entitlement Management — access packages readable but complex
- ⚠️ Cross-tenant access settings — readable but interpretation requires context

**Not Accessible / Limitations:**
- ❌ Cannot read actual password hashes or password quality
- ❌ Cannot test Conditional Access enforcement (only read policies, not simulate)
- ❌ Cannot access on-premises AD sync details deeply (hybrid complexity)
- ❌ Cannot read some security defaults without admin consent
- ❌ Mail flow rules, Exchange transport rules (separate Exchange permissions)
- ❌ SharePoint/OneDrive sharing settings (separate permissions)
- ❌ Intune device compliance (separate permissions, but available)

**Required Permissions (Application, Read-Only):**
```
Directory.Read.All
AuditLog.Read.All  
Policy.Read.All
IdentityRiskyUser.Read.All
IdentityRiskEvent.Read.All
UserAuthenticationMethod.Read.All
AccessReview.Read.All
EntitlementManagement.Read.All
PrivilegedAccess.Read.AzureAD
Application.Read.All
```

**Assessment:** Technical feasibility is strong. Graph API provides comprehensive read access for a meaningful security audit. The key limitation is that you're reading configuration, not testing enforcement — but that's true of most audit approaches.

### 5. DJ's Moat — EntraID + PeopleSoft HCM Expertise

**[MEDIUM CONFIDENCE]**

- **EntraID expertise alone:** Common among M365 admins. Not a moat. Thousands of people can run Maester or ScubaGear.
- **PeopleSoft HCM + EntraID combo:** Genuinely rare. PeopleSoft HCM is a legacy Oracle product used by ~3,000–5,000 organizations globally (mostly large enterprises, government, higher ed). People who understand both identity lifecycle (HCM → provisioning → EntraID) are scarce.
- **Where the combo creates value:**
  - Joiner/mover/leaver lifecycle audits — do accounts get disabled when people leave PeopleSoft?
  - Role mining — do EntraID group memberships align with HR job codes?
  - Orphaned account detection — PeopleSoft terminations vs. active EntraID accounts
  - Compliance evidence — proving HR-driven access governance
- **How rare?** Estimated <500 people in the US have deep expertise in both PeopleSoft HCM identity processes AND modern EntraID security. Most PeopleSoft admins don't touch identity. Most identity engineers don't know PeopleSoft.
- **Limitation:** The overlap market (companies using BOTH PeopleSoft HCM and EntraID) is shrinking as companies migrate off PeopleSoft to Workday/SuccessFactors.

**Assessment:** The moat exists but is narrow and declining. It's a niche differentiator for ~2,000–3,000 potential clients, not a broad market advantage. Use it for initial credibility and case studies, don't build the whole business on it.

### 6. Pricing Validation

**[MEDIUM CONFIDENCE]**

| Service | Price Range | Notes |
|---------|-------------|-------|
| MSP "free" M365 assessment | $0 | Loss leader to sell managed services |
| Boutique security assessment | $2,000–$10,000 | One-time, includes remediation consulting |
| Varonis/enterprise tools | $50,000+/year | Enterprise only |
| Penetration test (identity-focused) | $10,000–$30,000 | Much broader scope |
| Virtual CISO (ongoing) | $3,000–$10,000/month | Includes identity + everything else |
| Compliance audit prep | $5,000–$15,000 | SOC2/HIPAA readiness |

**$1,500–$3,000 for an automated audit:** This is the danger zone. It's:
- Too expensive for what a free tool (Maester) can do with a $150/hr consultant running it
- Too cheap to signal "premium expert assessment"
- Competing with MSPs who give it away free to win managed service contracts

**Recommended pricing pivot:**
- **Lead magnet:** Free automated scan (Maester-based) → generates leads
- **Paid tier:** $3,000–$5,000 "Expert Identity Security Assessment" with human analysis, prioritized remediation roadmap, 1-hour walkthrough call, and compliance-ready documentation
- **Ongoing:** $1,000–$2,000/quarter monitoring with alerting and quarterly review call

### 7. Employment Agreement Risk

**[MEDIUM CONFIDENCE]**

- **Non-compete clauses:** Common in enterprise IT. Typically restrict working for direct competitors, NOT starting a side consulting practice in a different market segment. However, if DJ's employer is an MSP or consulting firm, conflict risk is higher.
- **Moonlighting restrictions:** ~40–50% of large employers have moonlighting policies. Many require disclosure but don't prohibit. Key risk: if the side work uses skills/knowledge from the day job.
- **IP assignment clauses:** Many employment agreements assign ALL work-related IP to the employer, even if created on personal time. If DJ builds audit tooling using knowledge from his employer's EntraID environment, this is a gray area.
- **Client solicitation:** If any audit clients overlap with DJ's employer's clients, this is high-risk.
- **Mitigation:**
  1. Read employment agreement carefully (specifically: non-compete, moonlighting, IP assignment, non-solicitation)
  2. Never use employer's systems, data, or client lists
  3. Operate under an LLC
  4. Consider disclosing to employer if agreement requires it
  5. Target different market segment than employer serves

### 8. Revenue Projections

**Conservative (solo, nights/weekends, slow start):**
| Metric | 6 Months | 12 Months |
|--------|----------|-----------|
| Audits/month | 1 | 2 |
| Avg price | $2,500 | $3,000 |
| Monitoring clients | 0 | 3 |
| Monthly revenue | $2,500 | $7,500 |
| **Annual run rate** | **$30,000** | **$90,000** |

**Moderate (part-time dedicated, some marketing):**
| Metric | 6 Months | 12 Months |
|--------|----------|-----------|
| Audits/month | 3 | 5 |
| Avg price | $3,500 | $4,000 |
| Monitoring clients | 3 | 10 |
| Monthly revenue | $12,000 | $25,000 |
| **Annual run rate** | **$144,000** | **$300,000** |

**Aggressive (full-time, strong referral network, content marketing):**
| Metric | 6 Months | 12 Months |
|--------|----------|-----------|
| Audits/month | 8 | 15 |
| Avg price | $4,000 | $5,000 |
| Monitoring clients | 10 | 30 |
| Monthly revenue | $37,000 | $90,000 |
| **Annual run rate** | **$444,000** | **$1,080,000** |

**Key assumption:** Moderate and aggressive require quitting the day job or hiring. Conservative is the only scenario compatible with full-time employment.

### 9. Synergies with Other Ideas

- **spark-002 (Consulting):** Direct synergy. Audit service is a productized entry point to broader consulting. Audit → find problems → sell remediation consulting at $200–300/hr. This is the classic "land and expand" model.
- **spark-012 (Migration Assessments):** Strong synergy. Companies doing identity audits often discover they need to migrate from legacy AD to pure Entra ID, or from PeopleSoft to modern HR. Assessment → migration project ($50K–$200K).
- **Combined play:** Position as "Identity Lifecycle Specialist" — audit → remediate → migrate → monitor. Full lifecycle captures 10x the revenue of audit alone.

### 10. Key Risks & Mitigations

| Risk | Severity | Mitigation |
|------|----------|------------|
| Free tools commoditize scanning | HIGH | Differentiate on interpretation, compliance docs, human expertise |
| MSPs give away assessments free | HIGH | Target companies without MSPs, or companies unhappy with MSP |
| Employment agreement conflict | MEDIUM | Legal review, LLC, separate market segment |
| Client acquisition cost | MEDIUM | Content marketing, LinkedIn, referral partnerships with M365 VARs |
| Liability/E&O insurance | MEDIUM | Professional liability insurance ($1,000–$3,000/year) |
| PeopleSoft market shrinking | LOW | Don't over-index on PeopleSoft angle |

---

## ANALYSIS

This is a **viable but crowded** opportunity. The core scanning/reporting layer is commoditized by free tools (Maester, ScubaGear, Microsoft Secure Score). However, there are three genuine value layers above the commodity:

1. **Expert interpretation** — Free tools generate findings. Mid-market companies can't interpret them. "You have 47 findings — which 5 actually matter for your business?" That's worth $3,000–$5,000.

2. **Compliance documentation** — SOC2 auditors, cyber insurance underwriters, and HIPAA assessors want professional-grade documentation, not a Maester HTML report. Branded, formatted, attestation-quality deliverables are the product.

3. **Ongoing relationship** — Quarterly monitoring with human review creates sticky recurring revenue and positions for upsell to remediation/migration projects.

The danger is positioning this as "we run a scanner and give you the output." That's a race to zero. The positioning must be "identity security expertise delivered as a service, backed by automated scanning."

---

## CONFIDENCE

- Market exists: **HIGH** — regulatory and insurance drivers are real and growing
- Technical feasibility: **HIGH** — Graph API provides excellent read-only audit capabilities
- Competitive differentiation possible: **MEDIUM** — requires deliberate positioning above free tools
- Pricing works at $3K–$5K with human analysis: **MEDIUM** — validated by comparable services
- DJ can execute while employed: **LOW-MEDIUM** — depends on employment agreement and available time
- Revenue hits $100K+ in year 1: **LOW** — requires significant sales effort and pipeline

**Overall conviction: 6/10** — Good idea, real market, but execution risk is high and differentiation requires more than scanning.

---

## SO WHAT

**Do this IF:**
- Employment agreement allows it (check FIRST)
- You position above the commodity layer (expert analysis + compliance docs, not just scan results)
- You price at $3,000–$5,000 (not $1,500) to signal expertise
- You use audits as a wedge to sell higher-value consulting and migration work
- You build a content/referral engine (LinkedIn, M365 community, VAR partnerships)

**Don't do this IF:**
- You plan to compete on automation/price alone (free tools win)
- Employment agreement has broad non-compete or IP assignment
- You can't commit 10+ hours/week to sales and delivery

---

## MONEY

- **Startup costs:** ~$2,000–$5,000 (LLC, E&O insurance, branding, basic tooling)
- **Marginal cost per audit:** ~2–4 hours of DJ's time + tool costs (~$50). High margin.
- **Break-even:** 2–3 audits covers startup costs
- **Best case 12-month:** $300K revenue, $250K+ profit (moderate scenario)
- **Worst case 12-month:** $30K revenue, $25K profit (conservative, side hustle)
- **Recommended next step:** Review employment agreement, then build one sample audit report using Maester + custom analysis template on a test tenant. Use that as the sales demo.

---

## RECOMMENDATION

**CONDITIONAL GO** — Proceed to validation phase.

1. **Week 1:** Review employment agreement for restrictions
2. **Week 2:** Build sample audit on personal/test tenant using Maester + custom report template
3. **Week 3:** Show sample to 3–5 contacts in mid-market IT for pricing feedback
4. **Week 4:** Go/no-go decision on launching LLC and first paid client

The idea has legs, but only if DJ executes above the commodity layer. The PeopleSoft angle is a nice niche differentiator for initial clients but not the long-term moat. The long-term moat is "trusted identity security advisor" with recurring monitoring relationships.