What an Adeo engagement is built to surface.
Three composites — a Quick-Scan, a Baseline Audit, and a single month on a Technology Advisory Retainer — written to show how each engagement runs and what it puts in front of leadership. The firms are invented; the method and the cadence are as the engagement is designed to run, and the deliverables are the ones it produces. The figures are real third-party unit costs, published list prices and benchmarks, applied to the invented case; Adeo’s own fees are set out on the Services page.
A fast read on MSP value and performance.
Picture a suburban law firm, fifty-odd staff, a few offices, content enough with the day-to-day service of its MSP, but wanting to see in writing what the spend is returning before the annual review. The managing partner wants a plain second opinion, and does not want to start a fight to get it.
What this engagement examines
Microsoft 365 licence assignment, reconciled seat by seat against what is being paid for. Ninety days of ticket data from the MSP’s own service desk. Twelve months of invoices, cross-walked against the master services agreement line by line. And the monthly service review written into clause 7 of the MSA — held, or let slide. Every finding is reviewed and signed off by a principal before the read leaves the building.
What a scan of this kind is built to surface
- Paid-but-unassigned Microsoft 365 seats — licence spend leaving the firm every month with nothing sitting against it.
- The distance between the resolution time the contract promises and the resolution time the service-desk data actually shows — and whether the credit the SLA owes was ever applied.
- Whether the monthly service review the MSA mandates is being held, or has lapsed without anyone noticing.
- Standing charges such as an “extended monitoring” line, billed month after month with no signed change order behind them.
- Renewal indexation applied above CPI, and whether the notice the contract requires was ever given.
What the firm receives
A four-page executive brief, with a one-page MSP accountability section written to be forwarded to the account manager without an edit. It makes the relationship measurable: a scorecard the firm can put on the table, and a clear basis for the questions worth asking at the annual review.
A Quick-Scan gives the MSP relationship a written scorecard, forwardable and defensible, run again only at the client’s request.
- Seven paid-but-unassigned licences. Business Premium seats at ~A$32.90 per user each month — about A$2,760 a year of spend carrying nothing in return.
- An unsigned monitoring line. A standing “extended monitoring” charge at ~A$180 a month (about A$2,160 a year), billed for twelve months with no change order behind it.
- A renewal escalator left unread. CPI-plus-three on the managed fee, where the contract’s own cap would have held it lower, compounding each year it goes unchallenged.
List prices: Microsoft AU partner pricing, June 2026; escalator against the ABS Monthly CPI Indicator (+4.2% to April 2026). The first two lines alone recur at roughly A$4,900 a year.
A cyber-insurance renewal, defended on evidence.
An accounting practice of eighty-eight staff across two offices, regulated under APES 110, is a few weeks out from its cyber-insurance renewal. The carrier’s control questionnaire has gone from nine items last year to forty-seven this year. The managing partner wants the renewal answered on evidence, and answered before the broker gets anywhere near a price.
What this engagement examines
All five domains of a Baseline Audit: service delivery; commercial discipline; roadmap and governance; security and compliance — under which sit identity and access, endpoint posture, Microsoft 365 security configuration, backup and recovery readiness, network exposure, data-sharing and third-party access, incident-response readiness, and the controls the carrier requires at renewal; and AI adoption and posture. Evidence comes from authenticated API reads against the practice’s own tenants, plus document review across three years of invoices and ticket exports. A principal reviews and stands behind every finding before it is written down.
What an audit of this kind is built to surface
- Essential Eight mitigations, control by control — whether a shared break-glass admin account is actually being rotated, for instance, even where MFA on privileged accounts is enforced.
- Whether backup restore testing is run at the cadence the insurer’s own policy wording requires, or has lapsed below it.
- A Microsoft price step-up such as a re-tiered Business Premium uplift, applied at auto-renewal with no re-negotiation conversation on file.
- Whether a documented incident-response plan, a tabletop exercise, and a Notifiable Data Breach escalation path exist in fact, or only in the answer that gets written on the questionnaire.
- Third-party integrations holding tenant-wide access — including any still granted to a vendor the practice stopped using and never revoked.
- A supplier contract such as an ISP agreement, auto-renewing at above-CPI indexation, with the notice arriving too late for accounts payable to act on it.
- AI showing up outside any decision the partners made — Microsoft 365 Copilot switched on in partner mailboxes and used on client correspondence, with no supervision SOP and no APES-aligned data-handling guidance behind it.
What the practice receives
A full Baseline Audit report, a one-page executive scorecard, a stand-alone MSP accountability matrix, a 12-month remediation roadmap with named owners and dates, a cyber-insurance control crosswalk, and an executive readout prepared for the board. The roadmap is sequenced so that every item closing before the renewal date maps to a specific control on the carrier’s questionnaire — structured evidence for the broker to work from, and a defined programme of instructed work for the MSP. One set of documents, written so the board, the insurer, and the MSP can each act on their part of it without a translator in between.
- The renewal, defended. Partial MFA coverage and an unevidenced restore test are the gaps most likely to draw a loading or a declined renewal; Adeo supplies the evidence the carrier prices on, so the questionnaire is answered from the lower band.
- Licence spend put back on the table. An auto-renewal step-up across eighty-eight seats works out to roughly A$10,560 a year — renegotiated before it sets next year’s base.
- Forgotten vendor access shut off. A third-party integration still holding tenant-wide access for a vendor the practice no longer uses: a breach route removed at no cost.
Re-tier reads ~A$10 per user each month across 88 seats; Microsoft 365 Business Premium AU partner list ~A$32.90 per user each month, ex GST, June 2026.
A Baseline Audit is one document a board, an insurer, and an MSP can each act on.
What the fourth month of a retainer actually looks like.
An allied-health practice group: forty-six staff, several clinics across metropolitan Adelaide, Primary Health Network funding, active NDIS-provider status. Its long-serving IT consultant retired earlier in the year, and the board is left with no independent view of what IT costs or what it risks. Adeo is engaged on the Standard tier of a Technology Advisory Retainer. The composite below is the fourth month of the first twelve — the point where the cadence has settled and the artefacts arrive on schedule.
What a month on retainer holds
- The month’s advisory hours — a set envelope on this tier — booked by the CEO and the operations manager and drawn on as the month requires.
- One Adeo Pulse performance scorecard, issued on the first business day.
- The monthly MSP accountability call, minuted, with actions carried onto the roadmap.
- A seat at the MSP’s quarterly business review, attending as observer.
- The 12-month remediation roadmap kept current: the month’s closures marked off, the month’s new items added.
- Written advice on whatever commercial or technical decision the client raises that month.
- A quarterly board appendix built up month by month, so the quarterly pack is never written the night before.
What this composite month held
- The Pulse scorecard came in at 78 / 100, green, up two on month three, with two amber flags: backups (a restore-test gap) and commercial (a Microsoft price step-up detected with no re-negotiation on file).
- A short written review of a helpdesk-services RFP the operations manager had been sent by a rival MSP: scope adequate, pricing fair, but the governance and reporting clauses thin — with the points worth negotiating set out.
- A disaster-recovery tabletop run with the senior leadership team: two hours, one scenario (ransomware on the finance platform), six decisions to make, three gaps found and added to the roadmap.
- A phishing-simulation programme scoped for the MSP to run from month six — vendor-neutral, with the results read independently in Pulse.
- A three-page draft board appendix covering IT risk posture, roadmap status, and a single line on commercial drift.
- Cover protected ahead of renewal. The rival MSP’s helpdesk proposal was read down to its governance and reporting clauses, and a vendor-neutral phishing programme was scoped for the MSP to run. Partial or untested controls are a common reason insurers load cover at renewal, so both tighten the firm’s position before the carrier prices it.
- The price step-up, named before it compounded. A re-tier slipping in at auto-renewal across forty-six seats runs roughly A$1,500–1,800 a year, recurring — caught on the Pulse scorecard before it set next year’s base.
- Three disaster-recovery gaps now have owners. Surfaced in the two-hour ransomware tabletop and put onto the roadmap before they were ever tested for real.
List rate ~A$32.90 per user each month (annual commitment, ex GST), June 2026; threat-cost context: ASD Annual Cyber Threat Report 2024–25, ~A$80,850 average self-reported cost per report. The range assumes a re-tier of roughly A$2.70–3.30 per user each month across the forty-six seats; step-ups vary with the tiers involved, which is why it sits below the A$10 re-tier in Composite II.
Where Adeo fits
The MSP keeps running the environment day to day; Adeo is the independent layer on top, measuring whether the MSP is earning its fee, and the adviser leadership calls before a procurement decision, a renewal conversation, or a board question. The value is in the continuity: a standing, independent read the board can rely on between audits.
A Technology Advisory Retainer is an adviser on call, measured every month, with a scorecard the board never has to chase.
If one of these sounds like your situation, the next step is a conversation.
Thirty minutes at no fee: a plain read on whether Adeo can help, and a straight answer if it can’t. What an engagement is worth depends on what it surfaces in your own environment, weighed against the cost of the work. We’ll work out the question you’re actually trying to settle, and tell you whether a Quick-Scan, a Baseline Audit, or a retainer is the right shape for it.
Email contact@adeo.au with two or three artefacts to make the first reply useful — your last MSP invoice, your Microsoft 365 licence count, and, if it’s in front of you, your current cyber-insurance renewal questionnaire. You’ll have a reply within one business day.
Start a Conversation →See all engagements at /services.