283 lines
16 KiB
Markdown
283 lines
16 KiB
Markdown
# Investigation: EntraID & Azure AD Audit-as-a-Service (spark-029)
|
||
|
||
**Analyst:** ARI
|
||
**Date:** 2026-02-14
|
||
**Classification:** Business Opportunity Assessment
|
||
**Verdict:** CONDITIONAL GO — viable but requires differentiation beyond basic scanning
|
||
**Conviction:** 6/10
|
||
|
||
---
|
||
|
||
## CONTEXT
|
||
|
||
DJ is evaluating a productized service: automated EntraID/Azure AD security audits for mid-market companies (500–5,000 employees). Client grants read-only tenant access, agent team runs identity security assessment, delivers branded report with risk scores and remediation. Pricing: $1,500–3,000 per audit, $500/quarter ongoing.
|
||
|
||
---
|
||
|
||
## FINDINGS
|
||
|
||
### 1. Market Size & TAM
|
||
|
||
**[MEDIUM CONFIDENCE]**
|
||
|
||
- Microsoft claims 720M+ Entra ID users across millions of organizations (2025 figures)
|
||
- Mid-market segment (500–5,000 employees): estimated 80,000–120,000 companies in North America use M365/Entra ID
|
||
- Most mid-market companies lack dedicated identity security staff — typically 1-3 IT generalists managing M365
|
||
- **Addressable market estimate:** If 10% would buy an external audit at $2,000 avg = ~$16M–$24M TAM in North America
|
||
- **Serviceable market (realistic reach):** 50–200 clients in year 1 = $100K–$600K revenue opportunity
|
||
- The real TAM expansion is ongoing monitoring ($500/quarter × clients = recurring revenue)
|
||
|
||
### 2. Competition — THIS IS THE KEY RISK
|
||
|
||
**[HIGH CONFIDENCE]**
|
||
|
||
**Free/Open-Source Tools (DIRECT THREAT):**
|
||
- **Maester.dev** — Open-source Entra ID security testing framework. Built on Pester + Microsoft Graph. Pre-built tests, maps to MITRE ATT&CK, generates interactive HTML reports. Free. Actively maintained. This does 70–80% of what the proposed service would do.
|
||
- **CISA ScubaGear** — Free US government tool that evaluates M365 tenant configuration against CISA's Secure Configuration Baselines. Visual reports. Actively maintained since 2022.
|
||
- **Microsoft Secure Score** — Built into every M365 tenant. Free. Covers identity, data, device, apps.
|
||
- **Entra ID Security Config Analyzer (EIDSCA)** — Free, integrated into Maester
|
||
|
||
**Commercial Competitors:**
|
||
- **Varonis** — DatAdvantage for Azure AD. Enterprise pricing ($50K+/year). Not mid-market friendly.
|
||
- **CrowdStrike Falcon Identity** — Identity threat detection. Enterprise. $15–25/endpoint/year.
|
||
- **Semperis** — AD security specialist. Purple Knight (free AD assessment tool). Directory Services Protector (paid).
|
||
- **Trellix/CoreSecurity** — Identity governance tools
|
||
- **Boutique MSPs/MSSPs** — Many offer "M365 security assessments" as loss-leaders to sell managed services. Pricing: $0–$5,000.
|
||
- **CIS Benchmarks** — Free configuration benchmarks for Azure AD
|
||
|
||
**Assessment:** The scanning/reporting layer is heavily commoditized. Free tools exist. The value must come from interpretation, remediation guidance, and ongoing relationship.
|
||
|
||
### 3. Regulatory Drivers
|
||
|
||
**[HIGH CONFIDENCE — Strong tailwinds]**
|
||
|
||
- **SOC 2 Type II** — Requires identity access controls review. Annual audits need evidence of access reviews, MFA enforcement, privileged access management.
|
||
- **HIPAA** — Access controls (§164.312(d)) require unique user identification, emergency access, automatic logoff, encryption.
|
||
- **NIST 800-53 / NIST CSF** — Identity management controls (IA family) are foundational.
|
||
- **Cyber Insurance** — Increasingly requires MFA evidence, privileged access controls, identity security posture documentation. This is the #1 growth driver. Insurers are mandating identity security assessments before binding/renewing policies.
|
||
- **PCI DSS 4.0** — Enhanced identity/authentication requirements effective 2025.
|
||
- **State Privacy Laws** — CCPA, CPRA, growing state-level requirements driving audit demand.
|
||
- **SEC Cybersecurity Rules** — Public companies must disclose material cyber incidents; drives downstream vendor/partner audits.
|
||
|
||
**Assessment:** Regulatory/insurance pressure is the strongest demand driver. Companies NEED documentation proving their identity posture is sound. Free tools generate reports but don't generate compliance artifacts with professional attestation.
|
||
|
||
### 4. Technical Feasibility — Microsoft Graph API Read-Only Access
|
||
|
||
**[HIGH CONFIDENCE]**
|
||
|
||
With read-only application permissions, you can audit:
|
||
|
||
**Fully Accessible (Read-Only):**
|
||
- ✅ User accounts, guest accounts, disabled accounts, stale accounts
|
||
- ✅ Group memberships (security groups, M365 groups, dynamic groups)
|
||
- ✅ Directory roles and privileged role assignments (Global Admin, etc.)
|
||
- ✅ Conditional Access policies (read all policies, evaluate coverage gaps)
|
||
- ✅ Application registrations and service principals (OAuth app sprawl)
|
||
- ✅ Authentication methods per user (MFA status, passwordless, FIDO2)
|
||
- ✅ Sign-in logs and audit logs (risky sign-ins, impossible travel)
|
||
- ✅ Access reviews configuration
|
||
- ✅ Named locations, trusted IPs
|
||
- ✅ Administrative units
|
||
- ✅ License assignments
|
||
- ✅ Password policies (tenant-level)
|
||
- ✅ Identity Protection risk detections and risky users
|
||
|
||
**Partially Accessible:**
|
||
- ⚠️ PIM (Privileged Identity Management) — read eligible/active assignments, but some PIM features require P2 license on the tenant
|
||
- ⚠️ Entitlement Management — access packages readable but complex
|
||
- ⚠️ Cross-tenant access settings — readable but interpretation requires context
|
||
|
||
**Not Accessible / Limitations:**
|
||
- ❌ Cannot read actual password hashes or password quality
|
||
- ❌ Cannot test Conditional Access enforcement (only read policies, not simulate)
|
||
- ❌ Cannot access on-premises AD sync details deeply (hybrid complexity)
|
||
- ❌ Cannot read some security defaults without admin consent
|
||
- ❌ Mail flow rules, Exchange transport rules (separate Exchange permissions)
|
||
- ❌ SharePoint/OneDrive sharing settings (separate permissions)
|
||
- ❌ Intune device compliance (separate permissions, but available)
|
||
|
||
**Required Permissions (Application, Read-Only):**
|
||
```
|
||
Directory.Read.All
|
||
AuditLog.Read.All
|
||
Policy.Read.All
|
||
IdentityRiskyUser.Read.All
|
||
IdentityRiskEvent.Read.All
|
||
UserAuthenticationMethod.Read.All
|
||
AccessReview.Read.All
|
||
EntitlementManagement.Read.All
|
||
PrivilegedAccess.Read.AzureAD
|
||
Application.Read.All
|
||
```
|
||
|
||
**Assessment:** Technical feasibility is strong. Graph API provides comprehensive read access for a meaningful security audit. The key limitation is that you're reading configuration, not testing enforcement — but that's true of most audit approaches.
|
||
|
||
### 5. DJ's Moat — EntraID + PeopleSoft HCM Expertise
|
||
|
||
**[MEDIUM CONFIDENCE]**
|
||
|
||
- **EntraID expertise alone:** Common among M365 admins. Not a moat. Thousands of people can run Maester or ScubaGear.
|
||
- **PeopleSoft HCM + EntraID combo:** Genuinely rare. PeopleSoft HCM is a legacy Oracle product used by ~3,000–5,000 organizations globally (mostly large enterprises, government, higher ed). People who understand both identity lifecycle (HCM → provisioning → EntraID) are scarce.
|
||
- **Where the combo creates value:**
|
||
- Joiner/mover/leaver lifecycle audits — do accounts get disabled when people leave PeopleSoft?
|
||
- Role mining — do EntraID group memberships align with HR job codes?
|
||
- Orphaned account detection — PeopleSoft terminations vs. active EntraID accounts
|
||
- Compliance evidence — proving HR-driven access governance
|
||
- **How rare?** Estimated <500 people in the US have deep expertise in both PeopleSoft HCM identity processes AND modern EntraID security. Most PeopleSoft admins don't touch identity. Most identity engineers don't know PeopleSoft.
|
||
- **Limitation:** The overlap market (companies using BOTH PeopleSoft HCM and EntraID) is shrinking as companies migrate off PeopleSoft to Workday/SuccessFactors.
|
||
|
||
**Assessment:** The moat exists but is narrow and declining. It's a niche differentiator for ~2,000–3,000 potential clients, not a broad market advantage. Use it for initial credibility and case studies, don't build the whole business on it.
|
||
|
||
### 6. Pricing Validation
|
||
|
||
**[MEDIUM CONFIDENCE]**
|
||
|
||
| Service | Price Range | Notes |
|
||
|---------|-------------|-------|
|
||
| MSP "free" M365 assessment | $0 | Loss leader to sell managed services |
|
||
| Boutique security assessment | $2,000–$10,000 | One-time, includes remediation consulting |
|
||
| Varonis/enterprise tools | $50,000+/year | Enterprise only |
|
||
| Penetration test (identity-focused) | $10,000–$30,000 | Much broader scope |
|
||
| Virtual CISO (ongoing) | $3,000–$10,000/month | Includes identity + everything else |
|
||
| Compliance audit prep | $5,000–$15,000 | SOC2/HIPAA readiness |
|
||
|
||
**$1,500–$3,000 for an automated audit:** This is the danger zone. It's:
|
||
- Too expensive for what a free tool (Maester) can do with a $150/hr consultant running it
|
||
- Too cheap to signal "premium expert assessment"
|
||
- Competing with MSPs who give it away free to win managed service contracts
|
||
|
||
**Recommended pricing pivot:**
|
||
- **Lead magnet:** Free automated scan (Maester-based) → generates leads
|
||
- **Paid tier:** $3,000–$5,000 "Expert Identity Security Assessment" with human analysis, prioritized remediation roadmap, 1-hour walkthrough call, and compliance-ready documentation
|
||
- **Ongoing:** $1,000–$2,000/quarter monitoring with alerting and quarterly review call
|
||
|
||
### 7. Employment Agreement Risk
|
||
|
||
**[MEDIUM CONFIDENCE]**
|
||
|
||
- **Non-compete clauses:** Common in enterprise IT. Typically restrict working for direct competitors, NOT starting a side consulting practice in a different market segment. However, if DJ's employer is an MSP or consulting firm, conflict risk is higher.
|
||
- **Moonlighting restrictions:** ~40–50% of large employers have moonlighting policies. Many require disclosure but don't prohibit. Key risk: if the side work uses skills/knowledge from the day job.
|
||
- **IP assignment clauses:** Many employment agreements assign ALL work-related IP to the employer, even if created on personal time. If DJ builds audit tooling using knowledge from his employer's EntraID environment, this is a gray area.
|
||
- **Client solicitation:** If any audit clients overlap with DJ's employer's clients, this is high-risk.
|
||
- **Mitigation:**
|
||
1. Read employment agreement carefully (specifically: non-compete, moonlighting, IP assignment, non-solicitation)
|
||
2. Never use employer's systems, data, or client lists
|
||
3. Operate under an LLC
|
||
4. Consider disclosing to employer if agreement requires it
|
||
5. Target different market segment than employer serves
|
||
|
||
### 8. Revenue Projections
|
||
|
||
**Conservative (solo, nights/weekends, slow start):**
|
||
| Metric | 6 Months | 12 Months |
|
||
|--------|----------|-----------|
|
||
| Audits/month | 1 | 2 |
|
||
| Avg price | $2,500 | $3,000 |
|
||
| Monitoring clients | 0 | 3 |
|
||
| Monthly revenue | $2,500 | $7,500 |
|
||
| **Annual run rate** | **$30,000** | **$90,000** |
|
||
|
||
**Moderate (part-time dedicated, some marketing):**
|
||
| Metric | 6 Months | 12 Months |
|
||
|--------|----------|-----------|
|
||
| Audits/month | 3 | 5 |
|
||
| Avg price | $3,500 | $4,000 |
|
||
| Monitoring clients | 3 | 10 |
|
||
| Monthly revenue | $12,000 | $25,000 |
|
||
| **Annual run rate** | **$144,000** | **$300,000** |
|
||
|
||
**Aggressive (full-time, strong referral network, content marketing):**
|
||
| Metric | 6 Months | 12 Months |
|
||
|--------|----------|-----------|
|
||
| Audits/month | 8 | 15 |
|
||
| Avg price | $4,000 | $5,000 |
|
||
| Monitoring clients | 10 | 30 |
|
||
| Monthly revenue | $37,000 | $90,000 |
|
||
| **Annual run rate** | **$444,000** | **$1,080,000** |
|
||
|
||
**Key assumption:** Moderate and aggressive require quitting the day job or hiring. Conservative is the only scenario compatible with full-time employment.
|
||
|
||
### 9. Synergies with Other Ideas
|
||
|
||
- **spark-002 (Consulting):** Direct synergy. Audit service is a productized entry point to broader consulting. Audit → find problems → sell remediation consulting at $200–300/hr. This is the classic "land and expand" model.
|
||
- **spark-012 (Migration Assessments):** Strong synergy. Companies doing identity audits often discover they need to migrate from legacy AD to pure Entra ID, or from PeopleSoft to modern HR. Assessment → migration project ($50K–$200K).
|
||
- **Combined play:** Position as "Identity Lifecycle Specialist" — audit → remediate → migrate → monitor. Full lifecycle captures 10x the revenue of audit alone.
|
||
|
||
### 10. Key Risks & Mitigations
|
||
|
||
| Risk | Severity | Mitigation |
|
||
|------|----------|------------|
|
||
| Free tools commoditize scanning | HIGH | Differentiate on interpretation, compliance docs, human expertise |
|
||
| MSPs give away assessments free | HIGH | Target companies without MSPs, or companies unhappy with MSP |
|
||
| Employment agreement conflict | MEDIUM | Legal review, LLC, separate market segment |
|
||
| Client acquisition cost | MEDIUM | Content marketing, LinkedIn, referral partnerships with M365 VARs |
|
||
| Liability/E&O insurance | MEDIUM | Professional liability insurance ($1,000–$3,000/year) |
|
||
| PeopleSoft market shrinking | LOW | Don't over-index on PeopleSoft angle |
|
||
|
||
---
|
||
|
||
## ANALYSIS
|
||
|
||
This is a **viable but crowded** opportunity. The core scanning/reporting layer is commoditized by free tools (Maester, ScubaGear, Microsoft Secure Score). However, there are three genuine value layers above the commodity:
|
||
|
||
1. **Expert interpretation** — Free tools generate findings. Mid-market companies can't interpret them. "You have 47 findings — which 5 actually matter for your business?" That's worth $3,000–$5,000.
|
||
|
||
2. **Compliance documentation** — SOC2 auditors, cyber insurance underwriters, and HIPAA assessors want professional-grade documentation, not a Maester HTML report. Branded, formatted, attestation-quality deliverables are the product.
|
||
|
||
3. **Ongoing relationship** — Quarterly monitoring with human review creates sticky recurring revenue and positions for upsell to remediation/migration projects.
|
||
|
||
The danger is positioning this as "we run a scanner and give you the output." That's a race to zero. The positioning must be "identity security expertise delivered as a service, backed by automated scanning."
|
||
|
||
---
|
||
|
||
## CONFIDENCE
|
||
|
||
- Market exists: **HIGH** — regulatory and insurance drivers are real and growing
|
||
- Technical feasibility: **HIGH** — Graph API provides excellent read-only audit capabilities
|
||
- Competitive differentiation possible: **MEDIUM** — requires deliberate positioning above free tools
|
||
- Pricing works at $3K–$5K with human analysis: **MEDIUM** — validated by comparable services
|
||
- DJ can execute while employed: **LOW-MEDIUM** — depends on employment agreement and available time
|
||
- Revenue hits $100K+ in year 1: **LOW** — requires significant sales effort and pipeline
|
||
|
||
**Overall conviction: 6/10** — Good idea, real market, but execution risk is high and differentiation requires more than scanning.
|
||
|
||
---
|
||
|
||
## SO WHAT
|
||
|
||
**Do this IF:**
|
||
- Employment agreement allows it (check FIRST)
|
||
- You position above the commodity layer (expert analysis + compliance docs, not just scan results)
|
||
- You price at $3,000–$5,000 (not $1,500) to signal expertise
|
||
- You use audits as a wedge to sell higher-value consulting and migration work
|
||
- You build a content/referral engine (LinkedIn, M365 community, VAR partnerships)
|
||
|
||
**Don't do this IF:**
|
||
- You plan to compete on automation/price alone (free tools win)
|
||
- Employment agreement has broad non-compete or IP assignment
|
||
- You can't commit 10+ hours/week to sales and delivery
|
||
|
||
---
|
||
|
||
## MONEY
|
||
|
||
- **Startup costs:** ~$2,000–$5,000 (LLC, E&O insurance, branding, basic tooling)
|
||
- **Marginal cost per audit:** ~2–4 hours of DJ's time + tool costs (~$50). High margin.
|
||
- **Break-even:** 2–3 audits covers startup costs
|
||
- **Best case 12-month:** $300K revenue, $250K+ profit (moderate scenario)
|
||
- **Worst case 12-month:** $30K revenue, $25K profit (conservative, side hustle)
|
||
- **Recommended next step:** Review employment agreement, then build one sample audit report using Maester + custom analysis template on a test tenant. Use that as the sales demo.
|
||
|
||
---
|
||
|
||
## RECOMMENDATION
|
||
|
||
**CONDITIONAL GO** — Proceed to validation phase.
|
||
|
||
1. **Week 1:** Review employment agreement for restrictions
|
||
2. **Week 2:** Build sample audit on personal/test tenant using Maester + custom report template
|
||
3. **Week 3:** Show sample to 3–5 contacts in mid-market IT for pricing feedback
|
||
4. **Week 4:** Go/no-go decision on launching LLC and first paid client
|
||
|
||
The idea has legs, but only if DJ executes above the commodity layer. The PeopleSoft angle is a nice niche differentiator for initial clients but not the long-term moat. The long-term moat is "trusted identity security advisor" with recurring monitoring relationships.
|