UPnGO Risk Assessment logoUPnGO RA
Back to home

Service Management Reference

Operational commitments for the UPnGO Risk Assessment platform. Aligned with Microsoft Commercial Marketplace SaaS requirements.

1. Service overview

UPnGO Risk Assessment ("the Service") is a multi-tenant SaaS application hosted on Microsoft Azure that assesses, remediates and monitors Microsoft 365 tenants for security posture, compliance and Copilot readiness. It is delivered to MSPs, Microsoft partners and enterprise IT teams.

2. Onboarding

  1. Customer subscribes via the Azure Marketplace, a Cloud Solution Provider agreement or a direct order form.
  2. An administrator signs in with a work account and completes the MSP workspace setup.
  3. Each Microsoft 365 tenant is connected by granting the UPnGO application least- privilege Microsoft Graph permissions.
  4. The initial assessment completes within 24 hours; onboarding assistance is available on request.

3. Support

  • Channels: in-console chat, email info@upngo.co.uk, and the status page.
  • Hours: 08:00–18:00 UK time, Monday to Friday, excluding UK public holidays. 24×7 for Sev-1 incidents.
  • Response targets: Sev-1 within 1 hour, Sev-2 within 4 business hours, Sev-3 within 1 business day, Sev-4 within 3 business days.

4. Service availability

UPnGO targets 99.9% monthly availability for the console and API surface, measured excluding scheduled maintenance and factors outside our reasonable control. Service credits are available under the SLA appendix on request.

5. Maintenance

Standard maintenance windows are Sundays 22:00–02:00 UK time. Customers are notified at least 72 hours in advance for changes that may cause downtime. Emergency maintenance may be performed with shorter notice to protect the security of the Service.

6. Change management

Releases follow a continuous-delivery model with automated testing, staged rollout and feature flags. Breaking API changes are versioned and announced at least 30 days ahead of enforcement.

7. Incident management

  • Incidents are triaged against the severity matrix above.
  • Status updates for Sev-1/Sev-2 incidents are posted at least every 60 minutes.
  • A root-cause analysis is published for Sev-1 incidents within 10 business days of resolution.
  • Security incidents that affect Customer Data are notified without undue delay and in any event within 72 hours of confirmation.

8. Security

  • Hosted on Microsoft Azure; data at rest and in transit encrypted with industry-standard algorithms.
  • Microsoft Entra ID single sign-on and multi-factor authentication for all console users.
  • Least-privilege Microsoft Graph permissions, scoped per connected tenant.
  • Continuous vulnerability scanning, dependency monitoring and periodic penetration testing.
  • Row-level security and tenant isolation enforced in the data layer.

9. Backups and business continuity

Application databases are backed up with point-in-time restore covering the last 30 days. Backups are geo-redundant within the UK/EU. Recovery objectives are RPO ≤ 1 hour and RTO ≤ 4 hours for the primary region.

10. Data location and residency

The default hosting region is UK South, with EU West available on request. Customer metadata never leaves the selected region except for aggregated telemetry required to operate the Service.

11. Offboarding and data deletion

On termination or cancellation, the Customer can export their tenant assessments in JSON and PDF formats for up to 30 days. After that period, tenant data is deleted from production systems and purged from backups within a further 60 days.

12. Roles and responsibilities

  • UPnGO: platform availability, security of the multi-tenant infrastructure, product roadmap, incident response.
  • Customer / MSP: authorising Graph permissions, managing console users, reviewing findings and executing remediation approvals.
  • Microsoft: availability of Azure and Microsoft 365 platform services consumed by UPnGO.

13. Microsoft Online Service interfaces used

UPnGO Risk Assessment integrates with Microsoft 365 exclusively through Microsoft Entra ID (OAuth 2.0 v2.0 authorization-code flow, multi-tenant) and read-only Microsoft Graph REST API v1.0 endpoints. No writes, no application-only permissions, and no webhooks or change-notification subscriptions are used.

Identity — Microsoft Entra ID (v2.0)

  • Authorization endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
  • Token endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token
  • Redirect URI: https://upngora.upngoapp.com/api/auth/microsoft/callback
  • Protocol: OAuth 2.0 Authorization Code Grant with refresh tokens (offline_access).

Delegated permissions requested: openid, profile,email, offline_access, User.Read.All,Group.Read.All, Directory.Read.All, Organization.Read.All.

Microsoft Graph REST API v1.0 (read-only)

Base URL: https://graph.microsoft.com/v1.0

  • GET /organization — tenant name, ID, verified domains.
  • GET /users (with $select, $top) — user inventory, licence and Copilot readiness.
  • GET /groups/$count (header ConsistencyLevel: eventual) — group count.
  • GET /subscribedSkus — purchased and assigned licence SKUs.

Microsoft services explicitly not used

Microsoft Graph beta, Teams APIs, Exchange Online / EWS / Outlook REST, SharePoint Online and OneDrive, Intune, Defender, Purview, Security Graph, Power Platform / Dataverse, Graph change-notification subscriptions and webhooks, Graph Data Connect, Azure Resource Manager against customer subscriptions, and any application-only (daemon) access.

14. Contact

Service management enquiries: info@upngo.co.uk. Security disclosures: info@upngo.co.uk.