THE QUESTION THIS NOTE ANSWERS
What is the difference between a Domain Review and a Cloud Review?The Domain Review uses public evidence before authorization to prepare the conversation. The Cloud Review uses customer-approved sources to replace selected assumptions with supported tenant evidence.
What we read / what we never read
Public-domain evidence and customer-approved, read-only tenant evidence have different boundaries. No message bodies, files, chats, documents or prompts. Public availability is not blanket legal clearance; confirm scope and obtain qualified advice.
The Domain Review uses public evidence before authorization to prepare the conversation. The Cloud Review uses customer-approved sources to replace selected assumptions with supported tenant evidence.
Picture two browser tabs before a first meeting. One can read the company's public domain records without asking anyone for access. The other cannot open until a tenant administrator sees the Microsoft consent screen and approves a defined purpose. I treat those as two different moments in the relationship because they use different evidence and support different questions.
The Domain Review happens before authorization. It works from public evidence: DNS, email authentication, certificates, browser protections, exposed services, public technology, and company context. Its job is to create relevance. It helps the MSP walk into the first meeting with legitimate observations, clear unknowns, and better questions.
It cannot tell you exact Conditional Access coverage, enterprise application permissions, actual license assignments, Intune device state, internal OAuth relationships, or tenant sharing configuration. Those are not hidden features waiting for a clever external scanner. They sit behind an authorization boundary.
The Cloud Review begins after the client approves read-only collection. Now the conversation can move from external estimates to supported tenant evidence. Identity, authentication, privileged access, applications, consent, licensing, managed-device context, and other covered conditions can be reviewed with the source, permission, license, and collection limits still visible.
The shorthand is simple: Domain Review supports meeting preparation. Cloud Review helps build the work. The first provides context for a question. The second replaces selected assumptions with supported evidence, with permissions, scope and unread areas visible.
Neither step should manufacture a sales claim. A public observation is not an internal diagnosis, and an internal finding is not a license to sell whatever happens to be on the truck. Legitimate work follows when the evidence identifies a real condition, the MSP validates it, and the client understands the choice.
Use the Domain Review to enter the room with useful context. Use the Cloud Review, with permission, to replace selected assumptions with supported evidence.