Why Admin Companion?
Answering the question properly means walking Entra ID, Defender, Purview, Intune, Exchange Online, SharePoint Online, Teams, Power Platform and Fabric by hand — then writing down what you saw. Then doing it all again next quarter.
The honest version
A manual audit is a snapshot of one afternoon. By the time it's typed up, someone has changed a Conditional Access policy and nobody's review says so.
Findings get fixed by one admin clicking through a portal. There's no preview, no second pair of eyes, and no durable record of who changed what.
The process that just about works once collapses when it has to happen every quarter. The spreadsheet becomes the system of record, and the spreadsheet is wrong.
What's different here
Admin Companion doesn't invent its own scoring. It runs two independent, versioned industry security baselines — 283 automated controls between them — and every control keeps its published identifier. A finding is something your auditor can look up at the source, not a rule number only we can explain.
227 controls carry a built-in remediation that writes the correct setting back to Entra ID, Exchange Online, Teams, SharePoint Online, Power Platform or Fabric. Afterwards, re-check that one control on its own — verifying a fix takes seconds, and the history records it was a targeted re-check.
Anything disruptive pauses on a preview of exactly what it will touch and requires a configurable quorum of admin approvals before it runs. A single rejection vetoes it outright, approvers can exclude individual rows while approving the rest, and an undecided run expires instead of firing late.
Every change is recorded automatically: who made it, what changed, when, and the before-and-after. History can't be rewritten afterwards — it stays exactly as it happened, for as long as your retention policy keeps it.
Being straight with you
Not everything can be machine-checked, and pretending otherwise is how compliance tooling loses people's trust. Admin Companion draws the line explicitly.
Checks that can gather evidence but can't reach a verdict resolve to a manual outcome rather than a false failure. You record a dated attestation with a written rationale and an optional expiry; the control then reads as satisfied in your secure score, and a reminder chases you before the attestation lapses.
Gaps you're accepting on purpose get an accepted-risk acknowledgment — again with a rationale and an optional expiry. Those rows stay visible and marked rather than disappearing, and the acknowledgment itself is audited. A risk you decided to carry should still be a risk you can see.
Details that don't make the headline
Your tenant's data is kept strictly separate from every other customer's. The isolation is structural — not a setting someone could switch off.
Emailed reports reach people with no account through links that expire on both a time window and a download count — they can't circulate forever.
Every PDF and CSV that leaves Admin Companion is safe to open and safe to share — no surprises when a file lands in someone's spreadsheet.
A connection probe records which permissions were actually granted and which license features exist, then offers only the checks that can really run.
Connection certificates are generated and rotated for you, and warned on well before they expire.
Six categories — approvals, outcomes, assessment completion, control changes, credential expiry, general expiry — each opt-in, immediate or digested.
The fastest way to judge this is to point it at something real and read the findings yourself.