Modern Workplace · Managed Services · for small and mid-sized companies

Microsoft 365 security, governance and AI agents for companies with 50 to 500 people

Fixed packages with a named result, delivered in your tenant, handed over to your IT. Then, if you want, a monthly service that keeps it that way.

Microsoft 365 CopilotCopilot StudioSecurity CopilotMicrosoft DefenderMicrosoft EntraMicrosoft IntuneMicrosoft Purview
See the packagesHow a package runsTalk to us

Not sure which package? A free 30-minute call about your Microsoft 365 licence is enough to start.

Fixed scope, written offer after a 30-minute call.

Start here: six packages, named after your situation

Pick the line that sounds like you. Each package combines a few building blocks from the three areas below and ends with a result your IT can keep.

Topics and tools in this area (click to filter)
Microsoft DefenderMicrosoft EntraMicrosoft IntuneMicrosoft Purview
You have Business Premium

Secure Start

Switch on the Defender Suite and Purview Suite you just added: mail protection, identity rules, device compliance, first labels. One clean baseline instead of ten unused features.

Defender for Office 365 hardeningIdentity HardeningPurview basicsDevice compliance in Intune
Microsoft 365 CopilotSharePointMicrosoft Purview
You bought Copilot

Copilot, safely, in 30 days

Readiness check, oversharing clean-up, rollout with rules. Copilot sees only what it should, and management can sign it off.

Copilot & Agent Readiness PlusOversharing & Data ReadinessCopilot Rollout & Usage Rulesoptional Adoption & Training
Security CopilotMicrosoft DefenderAgent 365
You have E5 or E7

Use the Security Copilot you own

The agents are already in your licence. We switch them on, set the budget and rules, and check the Defender baseline they work on.

Security Copilot StarterDefender XDR baselineAgent Governance
Microsoft PurviewMicrosoft EntraMicrosoft Defender
You fall under NIS2

NIS2 with Microsoft 365

Gap analysis, duty-to-control mapping, identity hardening and the evidence an auditor can read. Built on the tools you already pay for.

NIS2 mapped to Microsoft 365Identity HardeningTenant Governance & Audit
Microsoft DefenderMicrosoft Intune
Old antivirus, old Windows

Endpoint complete

Pilot Defender next to the old product, turn attack surface rules from audit to block, bring devices into Intune and finish Windows 11. Rollout waves follow.

EDR Migration Pilot & PlanASR & Endpoint HardeningIntune & Windows 11
Copilot StudioMicrosoft FoundryAgent 365
You want agents, not experiments

Agent program

Roadmap workshop, two agents built in your tenant, and the governance that keeps every later agent under control.

AI Maturity & Agent Roadmap2× Agent SprintAgent Governance
No package needed

No package in mind yet? Short call, free.

You have Microsoft 365 Business Premium, E3 or E5 and are not sure what you already use? In 30 minutes we look at your licence and your open topics together, and tell you honestly whether and where a package makes sense. No preparation, no commitment.

  • What your licence already includes
  • What hurts first
  • Next step, even if it is without us
Request a call
Free: Copilot & Agent ReadinessOpen source, read-only, runs in your tenant. 41 checks, German report.Go to the free check →

Agents

From the first Copilot rollout to your own agent with an identity, an owner and a log. Every package ends with something your IT can run.

Topics and tools in this area (click to filter)
Microsoft 365 CopilotSmall

Copilot & Agent Readiness Plus

The free check, read out with IT and management, turned into a plan and a licence picture.

Result: Report and action plan you can work through alone.

CopilotSharePoint Advanced ManagementPurviewBusiness Premium
Microsoft 365 CopilotStandard

Copilot Rollout & Usage Rules

Pilot group, labels and DLP for Copilot, usage policy, admin settings, measurement after four weeks.

Result: Copilot live, with auditable rules.

CopilotSensitivity LabelsDLPRestricted Content Discovery
Copilot StudioStandard

Agent Sprint

One use case, one agent in your tenant, with identity, approval path, logging and handover.

Result: Productive agent and operating rule.

Copilot StudioMicrosoft FoundryEntra Agent IDPower Automate
Security CopilotStandard

Security Copilot Starter

Security Copilot is already in E5 and E7. We switch on workspace, budget and roles, enable the Microsoft agents for phishing triage and Conditional Access, and build one small custom agent for your most frequent case.

Result: Agents running, costs and limits known, your team can work with them.

Security CopilotDefender XDRE5E7
More packages (5)
Agent 365Standard

Agent Governance

Inventory of all agents, owner per agent, access rules for agent identities, lifecycle, cost rules.

Result: Agent register, policy, dashboard.

Agent 365Entra Agent IDCopilot StudioPurview DSPM
Microsoft 365 CopilotSmall

AI Maturity & Agent Roadmap

Half-day workshop with management and business units: where agents save time and what it costs.

Result: Five prioritised use cases with effort, licence need and risk.

CopilotCopilot StudioAgent 365
Copilot StudioSmall

Agent Security Review

For agents you or a vendor already built: prompt injection, data access, identity, logging.

Result: Review report with fixes.

Entra Agent IDCopilot StudioPurview DSPMDefender for Cloud Apps
Microsoft TeamsStandard

Copilot Adoption & Training

Key users per department, short online sessions for everyone, usage measured after six weeks.

Result: People use it, measured by department.

CopilotCopilot Control System
Microsoft DefenderStandard

Defender Operations & ISOC Pilot

For E5/E7 with Azure: data sources, three investigation cases, one rehearsed incident, cost baseline.

Result: An operations model and a cost picture.

ISOCDefender XDRSecurity CopilotE5

Security

Bring the Defender, Entra and Intune features you already license into operation. No 24/7 monitoring from us; for that we work with a SOC partner.

Topics and tools in this area (click to filter)
Microsoft DefenderStandard

EDR Migration Pilot & Plan

Defender for Endpoint proven on a pilot group next to your current product, with a rollout plan you can order wave by wave.

Result: Decision-ready pilot and rollout plan.

Defender for EndpointDefender for BusinessIntuneDefender Vulnerability Management
Microsoft EntraStandard

Identity Hardening

Conditional Access, passkeys and admin roles brought to a baseline you can show an auditor.

Result: Identities hardened, exceptions justified, evidence for the audit.

Entra IDConditional AccessPasskeysPIM
Microsoft IntuneStandard

Intune & Windows 11

Intune set-up or clean-up, compliance, Autopilot, Windows 11 in rings, Windows 10 exit per device.

Result: All devices managed, Windows 10 out or with an end date.

IntuneAutopilotWindows 11
More packages (6)
Microsoft DefenderStandard

Defender XDR Workshop & Baseline

Two workshop days plus implementation across Office 365, Endpoint, Identity and Cloud Apps.

Result: One portal, one baseline, a 90-day plan.

Defender XDRDefender for Office 365Defender for EndpointDefender for Identity
OutlookSmall

Defender for Office 365 Hardening

Preset policies, Safe Links and Attachments, impersonation, prompt injection protection, first phishing simulation.

Result: Mail protection documented.

Defender for Office 365Safe LinksPhishing-Simulation
Microsoft DefenderStandard

ASR & Endpoint Hardening

Attack surface rules from audit to block in stages, exclusions justified, baselines, reporting routine.

Result: Block rules active, documented.

ASRDefender for EndpointIntune
Microsoft EntraSmall

Defender for Identity & Hybrid AD

Sensors on domain controllers, configuration review, response actions, Entra Connect secured.

Result: On-prem identity in the same portal.

Defender for IdentityEntra ConnectActive Directory
Microsoft DefenderSmall

Defender for Cloud Apps & Shadow AI

Which SaaS and AI tools staff really use, OAuth apps with wide permissions, allow and block rules.

Result: App inventory and clean-up.

Defender for Cloud AppsShadow AIOAuth
Microsoft IntuneSmall

Reduce Local Admin Rights

Standard users everywhere, approved tasks elevate through Intune Endpoint Privilege Management, with audit trail.

Result: Local admin gone on the pilot cohort.

Endpoint Privilege ManagementIntuneEntra ID

Governance

Classify data, stop leaks, deliver evidence. This is where NIS2 and Copilot meet, and where most companies have the least in-house knowledge.

Topics and tools in this area (click to filter)
Microsoft PurviewStandard

Purview Enablement: Labels & DLP

Label model, pilot in IT and one business unit, DLP first simulated then enforced, runbook. Your admins configure along.

Result: Labels in use, DLP with evidence, runbook.

PurviewSensitivity LabelsDLP
SharePointStandard

Oversharing & Data Readiness for Copilot

Permissions, “Everyone” shares, sites without owners, restricted discovery, clean-up plan with owners.

Result: Copilot sees only what it should, proven with before and after numbers.

SharePoint Advanced ManagementRestricted Content DiscoveryPurviewCopilot
Microsoft PurviewStandard

NIS2 mapped to Microsoft 365

Scope, gap per duty area, duty to control to evidence, measure catalogue, 24/72-hour reporting process.

Result: Gap report and mapping matrix.

NIS2AuditDefender XDREntra ID
More packages (6)
Microsoft PurviewStandard

Insider Risk & Purview DSPM

Leaver and exfiltration policies, works council friendly, visibility of Copilot and third-party AI usage.

Result: Data movement visible, alert process.

Insider Risk ManagementPurview DSPMCopilot
Microsoft EntraSmall

Tenant Governance & Audit

Audit retention, admin roles, guests, lifecycle, sharing settings, Message Center process.

Result: A tenant handbook an auditor can read.

AuditEntra IDMessage CenterData Lifecycle Management
Microsoft PurviewStandard

Business Premium Suites Activation

Defender Suite and Purview Suite set up in short form, so the add-on does not stay unused.

Result: Both suites configured and explained.

Business PremiumDefender for BusinessPurview
Microsoft PurviewSmall

Retention & eDiscovery Basics

Retention matched to German duties, litigation hold, a tested search process for lawyer or auditor.

Result: Retention map and search process.

Data Lifecycle ManagementeDiscoveryAudit
Microsoft PurviewStandard

Purview Coaching: your admins configure

Two workshops, label and DLP decisions, configuration review, test plan. Your team does the clicks, we show once and review.

Result: A team that can run Purview.

PurviewSensitivity LabelsDLP
SharePointSmall

Secure External Collaboration

One partner, one data set: guest settings, cross-tenant access, labels that survive sharing, links with expiry.

Result: A tested way to work with one partner.

Entra External IDSensitivity LabelsSharePoint Advanced Management

Quick wins

Small, fixed jobs that fit next to a bigger package or stand alone. Each one has a clear end.

Security

MDE migration, small fleet

Up to ~150 Intune-managed devices: pilot, rollout, old agent out.

Agents

Simple agent

One Copilot Studio agent on one SharePoint library, with owner and log.

Agents

Agent Security Review

Prompt injection, data access, identity, logging. Report with fixes.

Security

Mail protection check

Defender for Office 365 presets, simulation campaign, report.

Security

Conditional Access review

All policies read, gaps and conflicts listed, report-only fixes proposed.

Security

Secure Score sprint

Two weeks on the top recommendations, with before/after score.

Governance

Retention basics

Retention map and a tested eDiscovery search.

Governance

Copilot check, read out

The free report explained in 90 minutes, with your next three steps.

Managed Service

Every package ends with the offer to keep it that way. A monthly service from someone who knows your tenant, not a ticket queue.

Topics and tools in this area (click to filter)
Basic

Security & Governance

Secure ScoreDefender XDRPurviewMessage Center
  • Secure Score and open recommendations
  • Policy drift check
  • Alerts of the last 30 days, reviewed together
  • Oversharing, DLP hits, guests and roles
  • Microsoft change radar
  • One agreed tuning change per month
  • Quarterly report for management

For 50–150 users. Business hours, no incident response.

Ask about Basic
Plus

Security, Governance & Agents

Agent 365CopilotCopilot StudioSecurity Copilot
  • Everything in Basic
  • Agent register and approvals
  • Credits and compute budget watched
  • Copilot rules kept current
  • Test-set reruns after model or tool changes
  • New Microsoft agents assessed before they appear

For 150–500 users, or anyone running agents. Up to ten registered agents; new agents are a sprint.

Ask about Plus
With SOC partner

24/7 detection and response

Defender XDRISOCSentinel
  • Everything in Plus
  • A partner SOC watches and responds around the clock
  • govnex keeps tenant, policies and governance
  • One contact for both

For companies that need round-the-clock coverage.

Ask about SOC

How a package runs

The same five steps for every package, so you know what to expect before the first call.

  1. 1

    30-minute call

    What you have, what hurts, which package fits. Free.

  2. 2

    Fixed offer

    Scope, result, prerequisites, exclusions and price in writing within three working days.

  3. 3

    Delivery in your tenant

    Read-only first, changes only after your approval, your admins configure along.

  4. 4

    Handover

    Runbook, evidence and a session with your IT. Nothing depends on us staying.

  5. 5

    Optional: keep it that way

    Move into the monthly service, or come back for the next package.

How we work: first check what your tenant shows, then build, then keep it running.

Talk to us

Tell us which package or situation, and we come back within one working day.

Rather talk right away? Book a 15-minute call

No newsletter, no sharing.

Ask about this packageHow a package runs

Fixed scope and a written offer after a 30-minute call. Delivered in your tenant, read-only first.