Conversational identity hygiene and privilege auditing across Microsoft 365, run and verified with Sia.

You build the tenant right. Roles are mapped, conditional access is configured, and security boxes are ticked.

But inside a workforce of a few thousand people, identity drift is inevitable. A developer gets temporary Exchange Admin rights for a migration. A contractor is granted User Administrator access for a weekend project. A service account is exempted from MFA to avoid breaking a script.

The project ends. The ticket closes. The elevated permissions, stale passwords, and MFA bypasses remain.

Across an enterprise with thousands of accounts, finding these silent security gaps isn't hard because the data is missing, it's hard because nobody has the hours to hunt for them.

Tracking who holds privileged access, checking whose password has quietly passed your 90-day rotation threshold, and verifying whether every single elevated account has active MFA requires jumping across portals, running custom PowerShell queries, and stitching together spreadsheets.

The tooling was never the gap. The manual effort required to keep a growing directory hygienic was.

The audit nobody has time to run

Finding the developer's Exchange Admin access three months after the migration wrapped. Finding the contractor's User Administrator role after the weekend project ended and the contract did too. Finding the service account still exempted from MFA a year after the script it was protecting got fixed. None of these show up on their own. Somebody has to go looking, role by role, across a portal, a script, or a spreadsheet nobody remembers updating.

Checking MFA registration against whatever list finally gets pulled, one account at a time. Skip one, and the number reported to compliance is wrong, and nobody finds out until the account without a second factor is the one that gets compromised.

Catching the guest account that picked up a privileged role somewhere along the way and never got reviewed back out. It survives audit after audit because nobody thought to check that box first.

Writing all of it up somewhere someone can actually act on. A screenshot in a chat thread does not tell compliance which accounts are fixed and which are still open.

None of this is hard. All of it is repetitive, and it stops scaling by hand well before the org crosses a few hundred people, let alone a few thousand. The finding most likely to get buried, a privileged account with no second factor and a password sitting past its rotation threshold, is the one that decides whether a single stolen credential takes down one mailbox or the whole tenant.

What we asked Sia to do

Here is that same problem, run against one privileged role and one hygiene check, handed to Sia as one plain-English instruction, typed into the Sia CLI against a live Microsoft 365 tenant. No portal opened. No script written. No export filtered by hand.

"Run an identity security audit on Microsoft 365 Entra ID users. List all users holding the Global Administrator standing privilege, and flag any active internal account running without MFA enabled."

Sia broke the request into four tasks and ran them in order. It pulled every user holding the Global Administrator role. It checked MFA registration, conditional access, and security defaults against each active internal account. Then it checked its own findings before handing back a result.

The report named the users holding standing Global Administrator access on this one role alone, including a guest account that should not have had it in the first place. 10 of the tenant's 22 internal active accounts, 45%, had no MFA registered at all. One finding stood on its own: a named Global Administrator, still active, still unprotected by a second factor. A single compromised password was enough to compromise the whole tenant. No second factor stood in the way.

Sia did not stop at naming the problem. It attached a remediation plan to the report: enforce MFA registration for the exposed admin, review the guest account holding Global Administrator access, and require MFA registration across the remaining privileged accounts within a set window.

Asked to put that report into a PDF and save it locally, Sia generated a two page, color coded report with all five sections intact and saved it to the desktop. Opening it showed the same findings, the same critical flags, the same remediation plan, written up in a document ready to hand to an auditor, not a screenshot that needs explaining.

The same pattern covers the checks that did not make it into this walkthrough. Swap Global Administrator for User Administrator, Exchange Administrator, or any other privileged role, and the query runs the same way. Ask which privileged accounts have a password older than 90 days, and get that answer too. "Show me every guest account with any standing privileged role." Done. No PDF export needed for those, just the same short loop: ask, get the real answer, decide what to do about it.

Watch it happen

The full audit above, run and verified live against Entra ID.

Before Sia, with Sia

Before Sia: open the portal, or write the script, filter by role, and write down every privileged account by hand, one role at a time.
With Sia: say it once on the CLI, and the full list comes back with MFA status and password age already attached.

Before Sia: the contractor's weekend User Administrator access is still active six months after the contract ended, because nobody circled back to remove it.
With Sia: ask which elevated roles were granted for a project that already closed, and get the answer today.

Before Sia: find out a guest account has admin rights at the next access review, months after it was granted.
With Sia: ask right now, and get the real answer back in minutes.

Before Sia: find out a privileged account's password is over a year old during a breach investigation.
With Sia: ask which privileged accounts are past your rotation window, any day you want the answer.

Before Sia: build a compliance report by stitching screenshots into a document and hoping the numbers still match.
With Sia: a formatted, color coded PDF, generated and saved before the coffee goes cold.

Before Sia: email the exposed admin, hope they turn on MFA, check back next week to see if they did.
With Sia: the remediation plan sits right next to the finding, one recommendation per account, ready to assign.

Before Sia: discover at next year's audit that MFA coverage quietly slipped.
With Sia: ask right now, instead of waiting for the audit to find it.

What Sia actually touches

Sia works directly against Microsoft Entra ID: the user directory, directory role assignments including Global Administrator and the other privileged roles, MFA and authentication method registration, password age and rotation status, conditional access policies, security defaults, and guest account status. This walkthrough covered one privileged role and one hygiene check, Global Administrator and MFA. The same query pattern covers any directory role or account attribute that lives in Entra ID.

Reading that data does not require a human sitting in the portal, or at a keyboard writing PowerShell, with standing admin rights open for longer than the audit takes. Sia is the one touching Microsoft Graph. You just say what you need. Every query Sia runs, and any change it is later asked to make, like enforcing MFA on an exposed account, goes through the same governance that lets Sia act on identity in production: a mutation gate with three verdicts, allow, require approval, or block, sensitive changes queued for a human, destructive operations blocked outright, and every action written to an append-only, HMAC-signed audit log that exports with its signatures intact. When compliance asks who holds a privileged role and whether they have MFA, the answer is a query against a signed record, not a portal screenshot from three months ago.

This is not only an IT admin's job anymore

None of this needs an IT admin at the keyboard for every check. A compliance lead can ask Sia directly, no portal login, no script, for the current state of privileged access, on demand, instead of waiting on the identity team to run a report. A department manager can ask whether their own team's accounts have MFA registered, scoped to their own team and nothing past it. Ask Sia to pull privileged role status for a department outside your own scope, and it will not. Access control did not disappear. Sia runs inside the role-based scope you set, so the permission model moves from a human clicking with admin rights to an agent acting within a policy you defined.

It is the same Sia whether the request comes in through the command line, the web, or the desktop app. The surface is just the door.

What this actually changes

Privileged roles stop being accounts nobody can name on demand, whatever role they sit under, without anyone opening the portal or writing a script to find out. MFA gaps get found the week they open, not the audit cycle after. Passwords that should have rotated get caught before they turn into the way in. Guest accounts with privileged access get caught before they turn into a finding somebody has to explain. And the report that used to take an afternoon of portal filtering and screenshots is ready before the meeting starts.

Your tenant was never as exposed as an unchecked box makes it look. It was just never checked in time.

Availability

Identity hygiene and privilege auditing runs on the Microsoft 365 integration that is in Sia now, across the Sia CLI, the Sia Desktop App, and the web. We deliver Sia as part of the Scogo platform to enterprise customers, so there is no public download.

If your team is still tracking privileged roles, MFA status, and password age through the portal or a script somebody has to remember to run, across a directory too large to eyeball, we want to put Sia in front of your tenant.

Start with a pilot at scogo.ai/request-demo.

Autonomous where it is safe, governed where it matters, on the record everywhere.