Your Microsoft 365tenant, squaredaway
TenantSquared Baseline is a fixed-scope, fixed-price security hygiene review for small defense suppliers. Every finding is mapped to NIST SP 800-171 control families in language your prime understands. Delivered in ten business days. The entire engagement can run in writing.
Every tenant drifts. Yours has too.
GuestsGuest accounts from projects that ended two years ago.
Admin rightsAdmin rights that outlived the reason they were granted.
Legacy authLegacy authentication still switched on.
ForwardingA forwarding rule nobody remembers creating.
LicensesLicenses billing every month for people who left.
The list keeps goingNone of it breaks anything, which is why it accumulates.
Then a prime sends a security questionnaire, or a cyber insurance renewal asks pointed questions, and the drift becomes your answer. CMMC requirements began entering DoD contracts in November 2025, and the questions are not getting softer.
The TenantSquared Baseline
More than 100 automated checks across identity, admin access, email authentication, external sharing, application consent, licensing, and audit logging, plus a manual review pass.
Identity
MFA coverage, Conditional Access, break-glass accounts, and admin role hygiene.
Admin access
Who holds privileged roles, why, and whether the assignments survived their reason.
Email authentication
SPF, DKIM, DMARC on every sending domain, forwarding rules, transport rules.
External sharing
Guest lifecycle, SharePoint and OneDrive defaults, anonymous link expiry.
Application consent
Third-party app grants, enterprise application review, consent policies.
Licensing
Unused seats, plan sprawl, and licenses billing for people who left.
Audit logging
Unified audit log status, retention, risky sign-in review cadence.
Plus the deliverables
A written findings report tied to NIST SP 800-171 Rev 2 control families. A prioritized remediation list in three tiers: fix now, fix next, monitor. A recorded video walkthrough you can replay and share internally. Thirty days of written follow-up questions after delivery.
Four steps. No meetings required.
Fill out the intake form
Ten minutes.
Grant read-only access
Through a Microsoft consent link. Configuration and reporting endpoints only. Mailboxes, files, and messages stay unread.
We run the review
And write the report.
Report and walkthrough arrive
Within ten business days. An optional live close-out call is available at the end if you want one.
Flat. No hourly billing, no scope creep.
In exchange for permission to use anonymized findings and a short testimonial.
- The full Baseline engagement
- Same scope, same deliverables, same ten days
- Three engagements at this rate, then it closes
Flat, fixed scope, fixed price.
- 100+ automated checks plus a manual review pass
- Findings report in NIST SP 800-171 language
- Three-tier remediation list and recorded walkthrough
- Thirty days of written follow-up
TenantSquared Watch, quarterly drift monitoring, opens to Baseline clients first.
Built for small defense suppliers.
You, probably
- US defense suppliers and subcontractors running Microsoft 365
- Roughly 25 to 500 seats
- Facing DFARS flow-downs, CMMC timelines, or prime questionnaires
- Veteran-owned firms getting ready to enter government contracting
Not you
- A full security team on staff
- A GRC platform already running
If that is your shop, you are not the customer, and that is fine.
Brad does. Personally.
Brad Baker. U.S. Army veteran, 82nd Airborne. Twenty years in enterprise IT and a working senior Microsoft 365 administrator.
Patriot 7Six LLC is Texas Veterans Commission verified, based in the San Antonio area, serving suppliers nationwide, fully remote.
Asked and answered.
No. TenantSquared renders no compliance verdicts. The Baseline is how you walk into an assessment, or answer a prime, without surprises.
Read-only administrative access granted through a Microsoft consent link, limited to configuration and reporting endpoints. We never read mailbox contents, files, or messages, and we do not handle CUI.
Ten business days from the moment access is granted.
Then the report is your prioritized to-do list. That is the point of running it now instead of during an assessment.
No. The entire engagement can run in writing. A close-out call is there if you want it.
Brad does, personally. There are no handoffs.
Walk into the next questionnaire without surprises.
Request the Baseline
Ten minutes of intake, a read-only consent link, and ten business days later the report is in your hands.