What is Operational Infrastructure for Microsoft 365? The Missing Category

The problem this category solves

Any Microsoft 365 tenant with Business Premium or E3 licensing already has Defender, Conditional Access, Purview, Intune, and the full set of native connectors. The technical capability is there. What is missing — and what any LFPDPPP, CNBV, or ISO 27001 auditor will notice within five minutes — is the consistent operation of those capabilities.

Consistent operation means four things that no native Microsoft 365 component delivers complete:

1. Stable configuration over time. The policies an MSP applied in March are not the same ones in force in September. Configuration drift is the rule, not the exception.

2. Change detection and prioritised findings. Microsoft Secure Score gives you a number. It does not tell you which of 200+ controls broke this week, or how serious it is for your vertical.

3. Remediation with evidence. Closing a finding requires executing a change, and the auditor will want to see _who, when, with what authorisation_. The email with a screenshot does not survive serious scrutiny.

4. Mappings to local regulation. Microsoft Compliance Manager ships templates, but the work of mapping Microsoft 365 control X to LFPDPPP Article 18 — for your industry, your size, your customer contract — falls on someone.

The layer that covers all four is operational infrastructure.

Definition: what is "operational infrastructure for Microsoft 365"

An operational infrastructure satisfies, at minimum, the following four criteria:

1. Continuous detection with an auditable rule library

Not a quarterly scan. A rule library (in simiriki: 201 rules in `lib/deepScan.ts`, run against Microsoft Graph and Azure Resource Manager) that runs continuously and whose source code is public and verifiable. Each finding has a stable ID, an assigned severity, and an explicit mapping to compliance categories (CIS Microsoft 365 Benchmark, NIST CSF v2.0, LFPDPPP Art. 18).

If the rule library is not public, it is not infrastructure — it is a black box.

2. Remediation with human approval and evidence

Detecting a misconfiguration without a clear path to remediation is debt. Operational infrastructure delivers, for each finding, an executable playbook: what change will be made, what privilege level it requires, what impact it has if something breaks. Approval is explicit and human. Evidence is persisted with timestamp, actor, and delta.

A CNBV auditor does not accept "the finding was closed" without the capture of who approved, when it was executed, and what was documented.

3. Stable operational metrics, not cosmetic scores

Microsoft Secure Score is useful but noisy: it changes with every Microsoft announcement of new controls, and it compares against global benchmarks that are not yours. Operational infrastructure publishes its own metrics — at simiriki we call them sIPO (simiriki Infrastructure Posture Observable) and sIRR (simiriki Infrastructure Risk Ratio) — that remain stable over time and allow intra-organisation comparison month over month.

Without stable metrics there is no board reporting, and without board reporting there is no recurring budget.

4. Public source traceability

Every quantitative claim the infrastructure makes to the customer must trace to an identified source. simiriki publishes the graph at `/sources`, including current legislation and publications from IBM, Microsoft, CISA, NIST, INEGI, SAT, and CNBV. A claim without a source must not be presented as proven fact.

Three things operational infrastructure is NOT

It is not a managed service billed by the hour

An MSP that manually configures Microsoft 365 for 30 customers sells hours and ships a PDF. The infrastructure is the software that operates Microsoft 365 — code the customer can inspect, metrics the customer can measure, evidence the customer can hand to an auditor without asking the consultant for permission.

It is not a one-shot consultative audit

A 60-hour security audit delivered as PDF is an instant. Infrastructure is a continuous system: the posture on day 90 is the consequence of the operation of the previous 89 days, not of a single-day scan.

It is not just a SOAR, nor just a SIEM

Microsoft Sentinel and Defender XDR are formidable technical components. They cover detection and response to active threats. Operational infrastructure hardens and governs them: it reinforces Sentinel configuration and playbooks, aligns the analytic rules, and connects the logs to the audit journal with the chain of evidence the regulator requires —under contractual scope in Enterprise, not as a managed SIEM/SOAR by default. Sentinel is the tool; infrastructure is what decides when to activate it, how to maintain it, and how to demonstrate it.

Why the Mexican context makes this category necessary

Three regulations make it non-optional for a Mexican mid-market company:

LFPDPPP Art. 18 (Chamber of Deputies)

Obligates the data controller to establish and maintain security measures — administrative, technical, and physical. The key terms are "establish" and _maintain_. Establishing is a project; maintaining is an operation. Operational infrastructure is the literal implementation of the verb "maintain" in the article.

CNBV Circular Única de Bancos

For financial institutions, it requires a signed Security Master Plan, formal CISO designation, and periodic privilege review — all with evidence. Maintaining that evidence month over month is not a consultant's job; it is infrastructure work.

SAT — CFDI 4.0 and Carta Porte

For any company that issues CFDI, the operation of Microsoft 365 includes the CFDI ↔ ERP ↔ email flow. Each flow is fiscal evidence, and each is subject to identity and data security controls. Operational infrastructure closes the loop between security cumplimiento and tax cumplimiento.

How to evaluate a vendor

Four questions any vendor that calls itself "operational infrastructure" must answer with public evidence:

1. Is your rule library and its framework mapping published? If the answer is "under NDA", it is not infrastructure.

2. Is your platform security audit published? simiriki publishes the twelve audited vectors at `/security-posture`.

3. Is your citation graph published? Ours is at `/sources`.

4. Is your pricing published? Without published flat pricing, what you are selling is consulting, not infrastructure.

For a factual comparison of simiriki vs Augmentt vs CoreView vs Microsoft Defender against these four axes, see `/comparison`.

Next step

If you want to see what your Microsoft 365 posture looks like against a public rule library (201 rules: 155 via Microsoft Graph + 46 via Azure Resource Manager), with no credit card or installation, the free scan evaluates the 155 Microsoft Graph rules. The preview typically appears in minutes. The complete report is delivered on a best-effort basis, with a non-guaranteed estimated target of up to 1 hour. The 46 Azure Resource Manager controls require separate admin consent and Reader access.

Scan your Microsoft 365 + Azure free →

---

Sources cited in this article:

• IBM Security · Cost of a Data Breach Report 2024
• Microsoft Digital Defense Report — identity as primary vector, MFA effectiveness
• NIST Cybersecurity Framework v2.0 — Identify / Protect / Detect / Respond / Recover taxonomy
• LFPDPPP Art. 18 (Chamber of Deputies) — security measures
• CNBV Circular Única de Bancos — Chapter IX, outsourcing and CISO designation
• SAT — CFDI 4.0 and Complemento Carta Porte
• CISA Cross-Sector Cybersecurity Performance Goals
• ISO/IEC 27001:2022

Full source index: simiriki.com/sources