Choose a representative client
Pick a client you are authorised to assess, with a known environment and someone who can confirm the source identities. Start with one technical question, such as administrator MFA registration or backup recency. Add a manual review when the broader question cannot be answered by an observation alone.
For a Microsoft client outside your Partner Center, review the Direct connection option before assuming delegated access will work.
Complete five checkpoints
1
Establish a trustworthy connection
Follow the setup wizard, confirm the client mapping and inspect completed collection. Verify a known account or device belongs to that client.Evidence of completion: you can identify the source, subject and observation time. A saved credential is not enough.
2
Explain one assessment
Follow Your first assessment. Check the enabled standard, the control’s population and its effective settings. Inspect the result and supporting observations.Evidence of completion: a reviewer can explain why the result is pass, fail or unknown. Do not make a pilot successful by relaxing a threshold until it passes.
3
Exercise the gap-handling path
Inspect any real missing evidence or unsupported requirement. Trace the source capability, mapping and freshness using troubleshooting. Where human judgement is needed, use a separate manual check.Evidence of completion: each unknown has a cause or an investigation owner. Do not manufacture a production failure or remove evidence to demonstrate this step.
4
Turn a finding into owned work
Choose the appropriate route: triage, manual follow-up, a supported remediation, or a risk/roadmap decision.Evidence of completion: the next action and owner are clear. An approved proposal does not prove delivery, and completed work still needs verification.
5
Prepare something you can discuss
Save a client report with known failures and gaps intact. Use the client-meeting playbook to explain the result and agree next steps.Evidence of completion: another person can understand the evidence, its limits and the proposed decision without reconstructing your setup.