Organisation
Evaluate the experience for your own Microsoft environment before connecting it.
- Review connection requirements
- Explore workflows with representative data
- Move to live protection when approved
Self-guided sandbox or guided walkthrough
Create a secure workspace, enter a sandbox with representative data, and examine how UnifiedONE handles signals, readiness and governed response. Connect Microsoft only when you decide to move into a live environment.
The sandbox uses representative data. Live actions require a connected tenant, eligible controls, permissions and licensing.

Automated onboarding
The product keeps evaluation and activation distinct, so your team can understand the operating model before granting access to a production tenant.
Create your account, configure two-factor authentication and retain recovery codes.
Choose an organisation or provider workspace, then enter the sandbox without connecting Microsoft.
Inspect representative signals, the global threat map, readiness questions and response paths.
Sign in with Microsoft Entra ID and move eligible protections into a live environment.
Two operating models
Evaluate the experience for your own Microsoft environment before connecting it.
Create a provider workspace first, then add customer tenants through an approval-led flow.
Controlled activation
Connecting a tenant does not turn every possible action on. Available responses still depend on your selected policy, Microsoft permissions, licensing and the controls supported in that environment.
Only controls supported by the connected environment should be offered.
Permission, licensing and control availability determine where an action can run.
Choose an observation, manual approval or governed automated posture where available.
Guided walkthrough
Tell us how your organisation or provider team works. We will focus the walkthrough on the relevant workspace, tenant connection and response model.