Microsoft security
Security for Microsoft 365 and Azure
Bearclave designs and builds security architecture on the Microsoft stack for regulated environments. What you get is not a document full of recommendations but a working configuration in version-controlled code — auditable, portable and restorable at any time.
Services
Five services, each of them starts with an analysis
The analysis has a fixed scope and a fixed price. It shows where the environment stands, what is missing and in what order to deal with it.
01
Microsoft Sentinel — cost and detection optimisation
A breakdown of ingest cost, table tiering and a review of the analytics rules. It shows what you are really paying for, which data serves no purpose and which detections only create noise.
Who it is for: Sentinel is in place and it is expensive or noisy.
What it covers → Sample deliverable (PDF, Czech)02
Hardening M365 and Azure
A security analysis of the configuration shows what is exposed to the outside, what is merely unfinished and in what order to deal with it.
Who it is for: the environment has grown for years without a plan, a new security lead is starting, an audit is coming.
What it covers → Sample deliverable (PDF, Czech)03
NIS2 and DORA — compliance of the Microsoft environment
A translation of the obligations under the Czech Cybersecurity Act No. 264/2025 Coll. (NIS2) and the DORA regulation into specific settings in Entra, Defender, Purview and logging. The output is the specific setting that is missing.
Who it is for: you have self-identified as a regulated entity, or a questionnaire has arrived from a customer.
What it covers → Sample deliverables (3 PDFs, Czech)04
Microsoft Purview — classification and DLP
From finding out where classification stands today, through a plan on paper, to implementation and a gradual rollout. Labels the business agrees with, and data protection people can live with.
Who it is for: data is not classified, or labels exist and nobody uses them.
What it covers → Sample deliverable (PDF, Czech)05
M365 and Azure architecture
A design of the target environment and landing zones where security is part of the foundation. A machine-readable output that can be deployed as it stands.
Who it is for: you are building Azure from scratch, migrating from on-premises, or the environment has grown without a hierarchy.
What it covers → Sample deliverable (PDF, Czech)Prices exclude VAT and apply to the analysis. Every engagement gets an individual quote based on the scope agreed on the intro call.
What we do
Expertise across the whole Microsoft stack
The services above are the most frequent briefs. Underneath them sits a broader knowledge of the environment, which can be assembled into an engagement that fits none of them.
Dealing with something that is not on the list? Most engagements start with a question that fits no category. If it concerns the security of Microsoft 365 or Azure, get in touch — the call will show whether it is work for us.
Deliverables
What the customer gets
The same format across all services, so that it is clear what is handed over before the engagement even starts.
A PDF report
Findings with a priority and a link to a specific setting, not to a general principle.
Configuration in version-controlled code
Wherever something changes. Auditable, portable and restorable at any time.
A simple summary for the board
Where you stand, the three biggest risks, what to do about them. Nothing more, so that someone reads it.
A handover record
What changed, why, and what was left open.
Every finding carries a priority and an effort estimate. That is what separates a usable output from a yes-no table nobody opens twice.
Working with us
How we treat your environment
Whoever has access to your tenant becomes part of your risk. That is why six rules apply.
NDA first, access second
We sign an NDA and a data processing agreement before we see anything of your environment. We have our own, and we will sign yours.
Read-only, and only for the work
For assessments, a named account with read-only roles that you remove after the handover. Where the environment allows it, permissions are activated through PIM or Azure Lighthouse only for the duration of the work. Nothing is permanent.
Phishing-resistant sign-in
No shared accounts and no passwords by e-mail. We sign in with phishing-resistant authentication and only from managed, encrypted devices.
Data stays in the EU
Material from your environment stays in our Microsoft 365 tenant with data in the EU. We delete it when the engagement ends.
Every change is traceable
Changes to your environment go through code and approval. Who changed what and why is traceable, and every change can be rolled back.
We fill in your supplier questionnaire
For regulated organisations we complete the supplier assessment questionnaire under NIS2 or DORA.
From practice
Six things most often missing in Microsoft environments
Findings that repeat across industries and sizes. If you recognise any of them, the environment is worth a proper look.
Conditional Access has gaps nobody knows about
Exceptions for service accounts that nobody ever removes, missing coverage of legacy protocols and policies left in report-only mode. It looks secure, but it can be worked around.
You pay for data that is never used
The most expensive tables tend to be the ones no rule and no query ever reads. At the same time the sources a regulator would want to see are missing. The bill grows and visibility does not.
Rules fire, but nobody knows what to do with them
Detections switched on from a template without tuning to the environment. The share of false positives grows, the team gets used to closing incidents in bulk and a real finding gets lost.
Applications hold permissions nobody granted on purpose
Registrations with access to all mail or all files, secrets close to expiry and consents users granted themselves. The quietest path to data there is.
Nobody labelled the sensitive files, so nothing protects them
Without classification, data protection has nothing to build on and compliance cannot be evidenced. The usual finding is a taxonomy introduced years ago that nobody uses.
The environment has more public doors than anyone thinks
Test resources exposed to the internet, network rules opened “temporarily” two years ago and diagnostics missing exactly where you would look after an incident.
Why Bearclave
Four things it rests on
01The design comes from real incidents
Years of analyst practice investigating incidents. That is where you learn what survives in production and what falls apart in the first month.
02Everything as code, Sentinel included
Tenant settings and infrastructure in version-controlled code. Deployment is reproducible, changes are auditable and the environment can be restored, not just described.
03Regulation is translated into configuration
The output is a configured Entra, Defender, Purview and logging setup where compliance can be evidenced by an export rather than by a claim.
04An outside view
The assessment is done by someone who did not build the environment and has no earlier decisions to defend.
Behind the company stands Matěj Hrabálek
Azure Security Architect and managing director of Bearclave. A master's degree in cybersecurity, professional certifications and a recognised, certified Microsoft security expert. The full profile and projects are on the personal website.
Half an hour is enough to know whether this makes sense
The intro call covers which licences you have bought and how large the environment is. The scope and an indicative date follow from the answers.
Or go straight ahead and pick a slot in the calendar, or write to info@bearclave.cz.
Supplier identification
Přímětice, 669 04 Znojmo, Czech Republic