Services

Identity services scoped around the decision in front of you.

CogniAccess provides architecture, implementation, governance, and compliance support across the Microsoft and Okta identity stack — with the documentation and evidence needed to operate the result.

Discuss a scope FISMA Audit & Controls

IAM Advisory & Strategy

Set the identity direction before more applications, policies, and exceptions are added to an already complicated environment.

The situationIdentity choices have accumulated across cloud migrations, audits, mergers, and urgent projects. Leadership needs a target state and a defensible order of work.

What CogniAccess does

CogniAccess assesses identity platforms, authentication paths, privileged access, application integration patterns, and control gaps. CogniAccess then defines the target architecture and sequence: which platform owns which function, which applications move first, what policies apply, and which risks should be corrected before expansion.

Zero Trust planning is treated as an operating model, not a product label. Identity decisions are connected to device trust, least-privilege access, session controls, monitoring, and ownership.

Typical deliverables

Identity current-state assessment
Target architecture and decision record
Zero Trust identity roadmap
Platform and migration recommendations
Risk-ranked remediation sequence
Executive and technical briefing material

Microsoft Entra ID & Conditional Access

Design an Entra ID tenant and policy system that administrators can explain, test, change, and support.

The situationPolicies overlap, exclusions are unclear, break-glass access is uncertain, or enforcement is delayed because nobody wants to cause a broad sign-in outage.

What CogniAccess does

CogniAccess reviews tenant configuration, authentication methods, administrative roles, application assignments, named locations, device signals, and sign-in behavior. Conditional Access is organized into named policy sets with a clear purpose, population, control, exception path, and owner.

Work includes Entra Connect and hybrid identity support, application SSO, tenant hardening, report-only testing, pilot groups, staged enforcement, and monitoring during each wave. Emergency access accounts are designed, protected, tested, and documented rather than treated as an afterthought.

Typical deliverables

Entra ID configuration review
Conditional Access policy set
Exception and break-glass procedure
Application SSO configuration plan
Hybrid identity recommendations
Rollout, monitoring, and rollback plan

Okta & SSO / Federation

Bring applications, users, groups, and authentication policy into a consistent Okta operating pattern.

The situationApplications use different sign-in methods, provisioning is manual, or a migration between Okta and Entra ID needs careful dependency planning.

What CogniAccess does

CogniAccess supports Okta SSO and MFA configuration, SAML 2.0, OpenID Connect, and OAuth 2.0 integrations, federation between identity providers, group and attribute rules, lifecycle provisioning, and application onboarding standards.

For platform migrations, CogniAccess maps application dependencies, authentication behavior, provisioning flows, and user impact before cutover. The plan identifies pilot applications, parallel-run needs, rollback points, and support ownership.

Typical deliverables

Application federation inventory
SAML / OIDC integration patterns
Okta policy and group design
Lifecycle provisioning design
Migration wave and cutover plan
Administrator operating notes

MFA Modernization

Replace weak, inconsistent, or exception-heavy authentication with methods matched to user risk and work patterns.

The situationSMS or voice remains in use, privileged users need stronger proof, help desk resets are frequent, or a mandate requires phishing-resistant authentication.

What CogniAccess does

CogniAccess inventories current authentication methods by population, identifies legacy authentication and exception paths, and designs the target mix: passkeys, FIDO2 security keys, Windows Hello for Business, Microsoft Authenticator protections, certificate-based authentication, and tightly controlled alternatives where a business process requires them.

Enrollment is planned with communications, support scripts, pilot feedback, temporary access procedures, and measurable checkpoints. The goal is stronger authentication that users can complete without creating a parallel support problem.

Typical deliverables

Authentication method inventory
Phishing-resistant MFA target design
Legacy authentication closure plan
Enrollment and support plan
Pilot results and issue log
Policy enforcement schedule

Identity Governance & Privileged Access

Make access ownership visible, approvals meaningful, and privileged elevation temporary by design.

The situationAccess accumulates as people change roles. Reviews become a signature exercise, administrator rights remain standing, and audit evidence is difficult to assemble.

What CogniAccess does

CogniAccess designs joiner–mover–leaver processes, access review campaigns, application ownership, approval paths, and remediation for stale or excessive access. Privileged Identity Management patterns are applied to eligible roles, activation approvals, time-bound assignments, alerts, and review of permanent role holders.

Governance work also covers service accounts, emergency access, federation trust, and the evidence trail: who requested access, who approved it, when it was reviewed, and when it was removed.

Typical deliverables

Access-review campaign design
Joiner–mover–leaver process map
Privileged role and PIM configuration plan
Stale access remediation list
Approval and ownership matrix
Audit evidence package

Endpoint Identity & Intune

Use the device as a reliable part of the access decision, not as a separate management silo.

The situationConditional Access depends on device compliance, but enrollment, configuration, certificates, and exception handling are inconsistent.

What CogniAccess does

CogniAccess designs Microsoft Intune compliance and configuration policies, enrollment patterns, application and certificate profiles, update expectations, and the signals passed into Conditional Access. Work includes baseline design, pilot validation, exception handling, and operating documentation.

Where an environment also uses Jamf Pro and Apple Business Manager, CogniAccess aligns Mac identity, device compliance, application access, and certificate delivery with the same access standards.

Typical deliverables

Intune compliance policy design
Configuration baseline
Certificate and network profile plan
Enrollment and exception workflow
Device signal validation
Endpoint operating runbook

FISMA Audit & Controls

A named service for programs that must show not only that controls exist, but how each control is implemented, evidenced, and corrected when it falls short.

The situationAn assessment is approaching, inherited findings need order, control evidence is scattered, or authorization work is competing with daily operations.

What CogniAccess provides

CogniAccess provides control gap assessments against FISMA requirements and the selected NIST SP 800-53 baseline. The work identifies the control owner, implementation state, evidence source, weakness, risk, and practical remediation order.

CogniAccess supports NIST SP 800-53 control implementation and hardening by translating control intent into identity, endpoint, cloud, and operating settings. DISA Security Technical Implementation Guides and CIS Benchmarks are used where applicable to create baselines that can be checked and maintained.

For audit readiness, CogniAccess organizes assessor evidence, implementation statements, screenshots and configuration exports where appropriate, meeting support, and response tracking. For the Authorization to Operate package, CogniAccess supports control narratives, evidence mapping, risk documentation, and package updates. CogniAccess also creates and maintains Plan of Action and Milestones items, tracks milestones and dependencies, supports remediation, and prepares material for continuous monitoring reviews.

Typical deliverables

Control evidence pack
Gap findings with remediation order
POA&M tracker
Hardening baselines
Audit-response support
ATO package material and updates
Continuous monitoring evidence schedule
Control implementation statements

Authorization & Risk Support

Connect identity and platform changes to the Risk Management Framework, system boundaries, interconnections, and ongoing risk decisions.

The situationA system change affects authorization assumptions, a new connection needs security terms, or risk findings need a clear path into program decisions.

What CogniAccess does

CogniAccess supports Risk Management Framework activities around categorization inputs, control implementation, assessment readiness, authorization package maintenance, and continuous monitoring. Security risk assessments examine identity paths, privileged access, third-party connections, data flows, compensating controls, and residual risk.

Interconnection Security Agreement support includes connection inventories, shared responsibility mapping, data-flow descriptions, security requirements, points of contact, renewal triggers, and evidence needed before a connection is approved or changed.

Typical deliverables

Security risk assessment
RMF activity and evidence checklist
Interconnection inventory
ISA responsibility and control matrix
Data-flow and boundary notes
Risk decision support material

Certificates & authentication

PKI & AD Certificate Services

Certificate problems often appear as unexplained sign-in, Wi-Fi, device, or application failures. CogniAccess supports the operating discipline behind them.

AD Certificate Services operational support and template review
Certificate lifecycle, renewal monitoring, and ownership records
Certificate-based authentication and smart card support
Device, user, Wi-Fi, VPN, and application certificate use cases
PowerShell automation for repeatable checks and reporting

Platform & technology depth

Capability across the systems identity touches

The matrix below shows how CogniAccess organizes platform work. It is a capability map, not a promise that every product belongs in every engagement.

Identity & access

Platforms: Microsoft Entra ID, Active Directory, Okta, Entra Connect, Entra Privileged Identity Management.

Work: SAML 2.0, OpenID Connect, OAuth 2.0, Conditional Access, MFA, federation, provisioning, hybrid identity, access reviews, and privileged role operations.

Microsoft cloud & workplace

Platforms: Microsoft Azure, Microsoft 365, Exchange Online, SharePoint, Teams, Azure Virtual Desktop where identity and access are relevant.

Work: Azure identity design, tenant administration patterns, application access, collaboration platform access controls, and PowerShell automation.

Data protection & governance

Platform: Microsoft Purview.

Work: Purview administration and implementation, data loss prevention policies, sensitivity labels, retention controls, audit, and eDiscovery support connected to access and information governance.

Endpoint & security operations

Platforms: Microsoft Intune, Jamf Pro, Apple Business Manager, Microsoft Defender, CrowdStrike Falcon, Splunk, and Qualys.

Work: endpoint compliance, EDR deployment and operations support, alert review, containment and remediation coordination, vulnerability context, and evidence for security reporting.

Engagement models

Choose the structure that fits the work

Rates are established for each engagement after scope, period, and delivery responsibilities are clear. CogniAccess does not publish a generic rate card.

Time & materials

Program augmentation

Defined identity or compliance capacity under a federal prime or within an internal program, billed against an agreed structure with a ceiling and period of performance.

Fixed scope

Project delivery

A written statement of work for a defined result — such as an MFA rollout, Conditional Access build, federation program, or control remediation package — with milestone acceptance.

Retainer

Advisory support

A defined block of recurring advisory time for architecture decisions, audit readiness, control review, roadmap planning, and program support.

Not sure which service fits?

Describe the platform, deadline, and problem. CogniAccess will identify the smallest responsible scope and the work that should not be bundled into it.

info@cogniaccess.com Start with the checklist