Standing service security-monthly-sign-in-and-alert-review-for-a-small-team · revised 12 October 2026
Standing service
Get a monthly review of risky sign-ins, new admins and new mail forwards
Each month you get a list of risky sign-ins, new admins, new forwarding rules and unfamiliar locations in your Microsoft 365 or Google tenant, with the log rows and a question for you. Not monitoring.
This starts a conversation by email. Nothing is charged, and nothing is reviewed, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
Sign-in and admin logs are kept but rarely read, so a new forwarding rule or a stranger's login can sit unseen for months. Reading them takes time and a sense of what is normal for your team. This is a monthly review of exported logs, not live monitoring, and it must not be mistaken for a security operations centre.
Who it’s for: Owner or manager of a 10 to 100 person company who wants someone to look at account activity each month and has no security team.
Usually starts when: A mailbox was taken over, a customer or insurer asks how you review account activity, or nobody has looked at the logs since set-up.
The result: Every month you get a report of risky sign-ins, new admin role holders, new mail forwarding rules and unfamiliar locations from your logs. Each finding has the log rows behind it and a question for the owner. The report states the period covered and what could not be checked, and nobody watches between reports.
What stays true, and what we do about it
No response time is promised, and nobody watches between reports. A delivery target for each monthly report is agreed in writing before the service starts.
Runs once a month after the period closes. Not staffed round the clock.
What must remain true
- Each month's report covers every risky sign-in, new admin, new forwarding rule and unfamiliar sign-in location in the logs for the period, or says what was not available
- Every finding links to the log rows it came from
- No finding is dropped: each carries a question for the owner and a status into the next report
What we watch
- The sign-in and audit log exports for the month, which you generate or read through a read-only role
- A list of your staff and their usual countries
- The previous month's report
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A month closes and the log exports for it are available. | We produce the report and send it to the person you named. |
| A forwarding rule to an outside address is new. | We list it first, with the rule text and who created it, and ask the owner whether it is expected. |
| A new admin role holder appears. | We list it with the date and the account that granted it, and ask the owner to confirm. |
| The same unexplained finding appears two months running. | We put it at the top of the report and ask for a decision. |
| The logs show signs of an active compromise. | We say so at the top of the report, advise getting incident response and stop the review; we do not investigate. |
We do on our own
- Read the exports and compare them with your staff list
- Prepare the report and the questions
- Carry open findings to the next report
We ask you first
- A longer log period or wider access
- Any change to what counts as unfamiliar
- Starting any other job
We escalate to you when
- The logs show signs of an active compromise
- The same finding appears two months running
- Logs stop arriving or are kept for fewer than 30 days
How you know it held. Each month you can recompute the counts in the report from the same exports, and the report states how many sign-ins, admin changes and rules were examined.
How we keep it true
This service is never finished. Each period's summary shows whether the thing it watches stayed true, and it continues until you end it.
Get a list of the outside apps connected to your Microsoft 365 or Google account Job Optional
A list of the third-party apps that hold a consent grant in your export, what each can reach, when it was last used and who owns it. Unknown or unusually broad ones are flagged for you to review.
Bought separately
The one-off list of connected apps and their permissions, if you want it as well.
Get your staff phishing reports sorted with a reason and a draft reply for each Job Optional
Forwarded suspicious emails come back classified as phish, spam, genuine or unclear, with the reason and a draft thank-you for the reporter. A person acts on each one; we take no action.
Bought separately
Sorting staff phishing reports is a different job with its own test.
What is included, and what is not
- A monthly report and decision list
- The log rows behind every finding
- A running list of open findings
Included
- One Microsoft 365 or Google Workspace tenant of up to 100 users
- Risky sign-ins, new admin role holders, new forwarding rules to outside addresses and sign-ins from unfamiliar locations, for the month
- Each finding with its log rows, a plain-English note and a question for the owner
- A carried-forward list of open findings, so nothing is lost between months
- Scripts read and count the logs; the language model writes the notes and questions from the evidence
Not included
- Monitoring between reports, 24/7 cover or any guaranteed response time
- Responding to or investigating an incident
- Changing, disabling or deleting anything in your live systems: your own administrator does that
- Reading mailbox or file contents
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
- Stale accounts, missing two-step sign-in and shared mailboxes (see the monthly accounts review)
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
In a test tenant planted with 20 events (risky sign-ins, a new admin, new forwarding rules, unfamiliar locations) by the separate automated reviewer and not shown to the builder, all 20 appear in the report. This is a smoke test on planted cases, not a rate on your real data.
Evidence: The planted list beside the report. A missed planted event fails the test.
Each month every finding links to the log rows it came from, and the counts examined can be recomputed from the same exports.
Evidence: The report and the two exports.
Our access made no change in your tenant: your own audit log shows no write by the read-only role.
Evidence: Your audit log for the month.
Ten display names and rule names in the test logs hide an instruction, and each runs five times. Done when no instruction is followed in any run. This is a baseline on this sample, not a claim of immunity.
Evidence: The planted markers and the output of all 50 runs.
Sign-off. You read each report and tell us whether the questions and the definition of unfamiliar still suit you. A month counts as delivered when you have received the report.
If it fails. If we cannot complete a period because an export is missing or has changed, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- Your tenant keeps sign-in and audit logs for at least 30 days, and you can export them or create a read-only role that you can remove
- A named owner reads the report each month and answers the questions
- Some risk signals need higher licence tiers; we report what the logs contain and say what was not available
We stop and tell you if
- The logs show an active compromise (we tell the owner and advise incident response; we do not investigate)
- Logs are kept for fewer than 30 days and cannot be extended
- You want response times, round-the-clock cover or managed detection
What could go wrong
The service only reads and reports, so there is nothing to undo. Ending it leaves your systems exactly as they are; you keep every report we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A quiet report is read as proof that nothing happened | Each report states the period, the number of events examined and what could not be checked, and says plainly that it is a review, not monitoring. |
| Sign-in data is personal data | The review stays at account level. Mailbox and file contents are out of scope, and display names are treated as data, not instructions. |
| Missing licence tiers hide some risk signals | The report lists which signals were not available in your tenant, so a gap is visible rather than silent. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every finding against its log rows before it is sent. The owner reads each report and decides what each finding means. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
Stays with a person
- The owner decides what every finding means
- Your administrator makes any change
Access we would need
- Read-only role or log exports that you create and can remove
- No admin credentials held between runs
Questions
Is this a security operations centre or managed detection?
No. Nobody watches between reports and there is no response time. It is a monthly review of exported logs, with questions for you.
Will you act on a bad finding?
No. We list it and ask you. Your administrator disables accounts or removes rules.
What if you find a break-in?
We say so at the top of the report and advise getting incident response. We do not investigate or fix it.
Also part of
Send an enquiry
Send us
- Your platform and roughly how many users
- How long your tenant keeps logs today
- Who would read the monthly report. No logins or exports in the first enquiry
Later, once you agree
- A read-only role, such as Reports Reader or Security Reader, that you create and can remove, or log exports you run each month
- A list of staff and the countries they normally sign in from
- A named owner and a second contact
You keep the tenant and every decision. We read exports or a read-only role that you create and can remove, and hold no admin credentials between runs. We never disable an account, delete a rule or change a setting.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-monthly-sign-in-and-alert-review-for-a-small-team” as the subject.