What Is the IT Audit Process That This Automation Was Built to Replace?
Innovative Automations has been in the managed service provider and technology consulting space for over 25 years. A core part of how they differentiate their service is a proprietary auditing and alignment process developed over roughly 15 years. The goal is to compare every technology component in a client environment against industry best practices, the firm's own best practices, and each client's specific standards, then surface anything that is out of alignment.
A common example is Microsoft 365 multi-factor authentication. Every organization should have MFA enabled for every user, but many push back with exceptions and special use cases. The audit process exists to show clients exactly what that risk looks like and quantify it. Historically, that meant a proactive service engineer (also called a Technology Alignment Manager) had to manually log in to the Microsoft tenant, scroll through every user, identify anyone without MFA enabled, and then write a report explaining the risk. The same manual approach applied to wireless networking, PCI compliance, backups, cybersecurity, and more.
How Does the New Automation Reduce the Manual Work in an Audit?
The first piece of the solution is a dashboard that ties directly into existing tools. When a proactive service engineer opens an assessment, the relevant data is already there, removing the need to manually log in and review lists before generating a report.
Because some tools could not integrate directly into that dashboard, a separate automation was also built. When the engineer kicks off an assessment, this automation pulls in the following data and attaches it to the ticket as individual CSV files, all triggered by a single button click:
Tickets, projects, and quotes from the past 60 days. Failed or problematic backups. High, medium, and low priority alerts from the antivirus platform. Alerts from the SOC and SIEM platforms. Data from Office 365 and additional connected tools.
As long as a platform supports cloud API access, it can be added to the automation. The set of connected sources can grow over time without rebuilding the core process.
What Does Getting All Audit Data in One View Actually Change?
Previously, a full audit could take hours or even days of manual collection work. With the dashboard and automation in place, the same results are available at a glance. That shift changes where skilled engineers spend their time. Instead of collecting data, they can focus on what to do with items that are out of alignment, which is where the real impact lies.
The firm had staff whose entire day was dedicated solely to the audit collection phase, followed by separate ticket creation, and then a review process to present the findings. Consolidating those steps into a single unified view adds significant hours back to the team each week, though putting a precise number on the efficiency gain has proven difficult.
Who Will Eventually Have Access to This Data?
The long-term goal is not limited to internal operations. The same information should be queryable and viewable by clients as well, giving them direct visibility into their own alignment status.
What Does Automated Remediation Look Like as a Next Step?
Once out-of-alignment items are identified in the dashboard, the next phase is acting on them automatically. Using the MFA example again: if a user is flagged as not having multi-factor authentication enabled, the Technology Alignment Manager would click a remediate button and the automation would go out and turn MFA on directly, without any additional manual steps.
This is practical because the automation is already authenticated to the tenant and already has the necessary permissions to read user data. Reading and writing through the same API endpoint are almost always both supported, so enabling changes is a natural extension of the existing data pull. The only meaningful limitation is an endpoint that does not support API access at all, which covers a small minority of cases.
The broader principle is to use automations to collect the data you need, and then build additional automations to act on it. Finding the data and displaying it is the foundation. Executing on it is the goal.