Tenant security review
Consented, read-only configuration and metadata · no mail, files, or content
The Domain Review uses public evidence before authorization to prepare the conversation. The Cloud Review uses customer-approved sources to replace selected assumptions with supported tenant evidence.
Picture two browser tabs before a first meeting. One can read the company's public domain records without asking anyone for access. The other cannot open until a tenant administrator sees the Microsoft consent screen and approves a defined purpose. I treat those as two different moments in the relationship because they use different evidence and support different questions.
The Domain Review happens before authorization. It works from public evidence: DNS, email authentication, certificates, browser protections, exposed services, public technology, and company context. Its job is to create relevance. It helps the MSP walk into the first meeting with legitimate observations, clear unknowns, and better questions.
It cannot tell you exact Conditional Access coverage, enterprise application permissions, actual license assignments, Intune device state, internal OAuth relationships, or tenant sharing configuration. Those are not hidden features waiting for a clever external scanner. They sit behind an authorization boundary.
The Cloud Review begins after the client approves read-only collection. Now the conversation can move from external estimates to supported tenant evidence. Identity, authentication, privileged access, applications, consent, licensing, managed-device context, and other covered conditions can be reviewed with the source, permission, license, and collection limits still visible.
The shorthand is simple: Domain Review helps set the appointment. Cloud Review helps build the work. The first earns the right to ask. The second replaces assumptions with evidence strong enough to support recommendations.
Neither step should manufacture a sales claim. A public observation is not an internal diagnosis, and an internal finding is not a license to sell whatever happens to be on the truck. Legitimate work follows when the evidence identifies a real condition, the MSP validates it, and the client understands the choice.
Use the Domain Review to enter the room with useful context. Use the Cloud Review, with permission, to replace selected assumptions with supported evidence.