Audit evidence kits
Stop screenshotting the admin center before every audit.
Each kit is an Azure Logic App you deploy into your own subscription. On a schedule, it reads your Microsoft 365 configuration through Microsoft Graph and saves dated JSON and CSV files, plus a run manifest, to a SharePoint library you choose. When an assessor asks what MFA looked like in March, you open the March folder.
It runs in your tenant, not mine. The Logic App uses its own managed identity with read-only Microsoft Graph permissions and write access to one SharePoint site. No data comes to RVA Tech Visions, and there are no secrets to store.
Complete Evidence Collector
All six collectors in one deployment: identity and MFA, Conditional Access, privileged access, devices, audit logs and guest access.
Identity and MFA Evidence
Users, account status, last sign-in and MFA registration details, saved daily.
Conditional Access Evidence
Dated snapshots of your Conditional Access policies, named locations, authentication strengths and security defaults.
Privileged Access Evidence
Who holds Entra admin roles, including PIM eligible and active assignments where licensed.
Device Compliance Evidence
Intune managed devices with compliance and encryption state, plus your compliance policies.
Audit Activity Evidence
Your own daily copy of Entra directory audit logs, and sign-in logs where licensed, kept beyond Microsoft's 7 or 30 days.
Guest and External Access Evidence
Guest accounts and their last activity, plus your guest invitation and cross-tenant access settings.
What you get
- An ARM template you deploy with the Azure portal's "Deploy a custom template" or the Azure CLI.
- A permissions script that grants exactly the read-only Graph permissions the kit needs, with a -WhatIf preview.
- A control map linking each evidence file to NIST SP 800-171 Rev 2 requirements, written as supporting evidence, not proof of compliance.
- Setup, test and removal steps. Logic Apps Consumption costs are typically pennies to a dollar or two a month.
Which edition?
Single organization covers one company's own tenant. MSP edition lets a managed service provider deploy it across its own clients. Neither allows resale of the kit itself.
Requirements
An Azure subscription, a SharePoint site for the evidence, and a Global Administrator or Privileged Role Administrator to run the permissions script once. Some data needs Entra ID P1 or P2, or Intune; when a license is missing the kit records "not available" and keeps going.
Want it set up for you?
I can deploy the kits, confirm the first run with you, and walk your assessor through the folder structure. Email me and I'll scope it.