Help
Credits and extras
Credits at a glance
| What uses credits | Extras a person asks for and confirms: optional documents and checks, such as a proposal document (3 credits a lead) or a bulk prospect scan (1 credit for each 10 domains). The cost is on the button, and nothing is used until you confirm. |
|---|---|
| What never does | Everything else: assessments, findings, scores, Cyber Essentials readiness and insurance answers, every report and evidence pack, changes and automation, rollback, everyday admin, the views extras build on (such as connected apps and licence renewals), alerts, support, the client portal, every table’s export and the as-built handover document, the free lead health check, integrations and the API and every schedule and background job. Nothing that runs on a schedule or by automation uses credits, and nothing renews by itself. The full list is below. |
| How many you get | Monitor: 10 a month, plus 2 for each tenant after the first. Automate: 25, plus 4. A trial: 10, once. They refresh on the first of each month (UTC) and do not carry over. More, in pounds: 100 for £15, 500 for £60, or 2,000 for £200, each lasting 12 months, or 100 more each month for £10. |
Where to find them
Extras is in the menu, above Settings. Each extra has a card: what you get, an example of when to use it, what it reads, what is already included, and its cost. Everyone in the workspace can see the credits on the Credits tab: how many you have, why, and what used them. Anyone who can use them sees them in the top bar too. Wherever an extra helps with what you are looking at, such as a client’s licences, a link opens its card.
Before anything is used
Every extra shows its cost on its button, such as “Make it · 3 credits”. You confirm once, seeing how many credits you have now and how many you will have after. Nothing is used until you do. If something will limit the result, such as a tenant that hides names in Microsoft’s usage reports, the page says so first.
Free remakes
Need to change something? For extras priced by a client, lead, person or domain, make the same one again within 24 hours of the one you paid for, free, twice. Only the latest is kept, so a remake replaces the one before.
If something goes wrong
If an extra cannot be made, its credits are given back and we tell you, except credits from a pack whose payment was refunded. If we make it again for you, there is no charge.
When credits run low
Owners and Admins get one email a month when most of the month’s credits are used. With none left, extras that use credits wait for the first of the month or for more credits. Free extras and everything else carry on.
Buying more
An Owner buys packs in Extras › Credits, in one step. Credits each month are added on Plan and billing; they arrive with each payment and last until the next one. Credits that end soonest are used first. Anyone else can ask the Owner in one click.
Who can do what
Everyone can see the credits. Consultants and above make most extras, and download what was made for the clients they see. Anything about a named person, such as a person activity timeline, needs a Technician, and the workspace archive an Admin. Any member can download the as-built document. An Owner can limit credits to Admins and Owners.
Your data, free
Every table exports free, one at a time, on every plan. The workspace archive bundles them all into one download for 10 credits, and is free while your workspace is read-only.
Welcome and recommendation credits
New workspaces get 100 welcome credits with their first plan payment. A workspace that signs up from a customer’s link gets a 30-day trial instead of 14 once its owner confirms their email address, for up to 10 workspaces a year from one link. When it has paid for two months and assessed a tenant, both workspaces get 300, as long as the recommending workspace is still on a paid plan. Credits like these last 12 months, like a pack.
What never uses credits
- Assessments: every assessment, scheduled or started by a person, fix checks, reading again, and a lead’s assessments.
- Findings: every finding, fix guide, score and its trend, framework, Cyber Essentials and insurance answers, and the risk register.
- Reports: every report the report builder makes, by a person, an API key, Power Automate or a schedule, a lead’s report, the portfolio report, and their emails and share links.
- Changes and automation: dry runs, approvals, every change, automatic fixes, automation policies in every mode, containment, fleet fixes and runbooks.
- Rollback: rollback, restores and backups.
- Everyday admin: new starters, leavers, password and MFA resets, groups, mailboxes, guests, licences and devices.
- Views beside the extras: connected apps, licence renewals, licence costs and savings, mailbox sizes and baselines.
- Alerts: security, drift and account takeover alerts by any channel, the incident runbook, the incident timeline and notifications.
- Support: support and its replies.
- The client portal: the portal, client replies, access reviews and quotes.
- Exports: every table’s export, every report’s download and share link, and the as-built handover document.
- The lead health check: the free lead health check and its emailed result.
- Integrations and the API: PSA tickets, webhooks, SIEM, documentation sync, the API and Power Automate.
- Background work: every schedule and background job, the hourly credits job included.
Every extra and its cost
Win and keep clients
- Proposal document: 3 credits a lead. A Word document in your brand to win a lead: your covering letter, what their full check found, a priced quote and a plan for what to fix first. Reads: The lead’s latest full check and your quote rates in ConfigCheckup. Nothing new is read from Microsoft. Included already: Emailing the lead their full report, and quotes, in Leads and savings.
- Bulk prospect scan: 1 credit for each 10 domains. Paste up to 200 domains. Each gets the free lead health check’s public check, and you get one sheet, ranked with the weakest email security first. Reads: Public DNS, Microsoft’s public sign-in pages and each domain’s published MTA-STS policy, as the free lead health check reads them. Nobody is emailed and no lead is made. Included already: The lead health check, one domain at a time, on your free check page.
- As-built handover document: Free. A Word document of a client’s set-up, in your brand: score, open critical and high findings, Conditional Access, partner access, licences, devices and domains. Reads: The client’s latest assessment in ConfigCheckup. Nothing new is read from Microsoft. Also free: Documentation sync pushes the same as-built page to IT Glue or Hudu every day.
Prove and audit
- Sealed auditor bundle: 5 credits a client and framework. One dated zip of a client’s evidence for one framework: the evidence pack as a PDF, every file attached to it, the change log, and a SHA-256 fingerprint of every file. Reads: The evidence and its attached files in ConfigCheckup. Nothing new is read from Microsoft. Included already: The live evidence pack and its share link for the auditor, on each client’s Evidence page.
- Customer security questionnaire answers: 2 credits a questionnaire. Common supplier-security questions answered from the client’s real settings, with how we know and the standard each relates to, as Excel and Word. Reads: The client’s latest assessment and the answers you have recorded. Questionnaires you have been sent are not read. Included already: Cyber insurance answers and Cyber Essentials readiness, with their evidence.
- Like-for-like history: 10 credits a client. A client’s last 12 months, each kept week checked again with today’s checks, beside the score it had then, as a chart and a table. Reads: The assessments kept in full in ConfigCheckup. Nothing new is read from Microsoft. Included already: The score and its trend as recorded, on each client’s Overview; and any report, which scores its own assessment with today’s checks.
- Workspace archive: 10 credits. Every client’s records in one download, as spreadsheets: findings, assessments, changes, alerts, accepted risks, access reviews, quotes, reports, Cyber Essentials readiness, leads, the team and the audit log. Reads: Your workspace’s records in ConfigCheckup. Nothing new is read from Microsoft. Included already: Every table exports free on its own, as CSV or Excel.
Plan and budget
- Licence what-if: 3 credits a scenario. Move people between plans, such as E3 to Business Premium, or add Copilot, and see the cost at your prices and the features gained or lost, as a document for the client. Reads: Licences and people already read, and your licence prices. Included already: Licence savings, and each client’s licences at your prices.
- Licence cost by department: 2 credits a run. Licence costs split by department, cost centre, division, company or office, at your licence prices, as Excel and a one-page summary. Reads: People’s departments, cost centres and offices and their licences, read now, and your licence prices. Included already: Licence costs and savings at your prices, on each client’s Licences page.
- Renewal calendar and budget forecast: 2 credits a client. The next 12 months of each Microsoft subscription: renewal dates, seats, seats used and cost at your prices, month by month, with seats to cut before each renews, as Excel, a one-page budget and a calendar file. Reads: The tenant’s Microsoft subscriptions, read now, your licence prices, and Partner Center’s terms where it is connected. Included already: Renewals in the next 90 days, with seats to reclaim, on each client’s Licences page and in its export.
- Tenant comparison workbook: 3 credits a comparison. Two to 20 clients side by side, setting by setting, as a spreadsheet. Reads: The latest assessment of each client you choose. Nothing new is read from Microsoft. Included already: Each client against your standard settings, on Baselines.
- Teams and SharePoint tidy-up plan: 3 credits a client. Teams and sites unused for 90 days or more, groups and teams with no owner or with many guests, OneDrives of people who left, and storage that could be freed, in a plan. Reads: Teams and SharePoint usage reports, and groups with their owners and guests. Guests are counted for groups and teams only. If the tenant hides names in usage reports, sites show as codes, and you are told before anything is used. Included already: Each client’s groups and owners, and guests who have not signed in.
- Passwordless rollout planner: 3 credits a client. Who is ready for passkeys or Windows Hello for Business, and who needs a device or sign-in method first, in waves. A plan only: it changes nothing. Reads: Microsoft’s sign-in methods registration report, which needs Microsoft Entra ID P1 or P2, and devices, as the latest assessment read them. Included already: Who has no two-step sign-in, on each client’s People page.
- Mailbox storage forecast: 2 credits a client. Mailboxes that will fill up in the next 3 to 6 months at the rate they grew between assessments, and which to archive. Reads: Mailbox sizes from this client’s assessments, and today’s. A forecast needs two readings at least 30 days apart; a mailbox with fewer shows how full it is. If names are hidden in usage reports, you are told before anything is used. Included already: Each mailbox’s size and how full it is, on each client’s Mailboxes page.
- Migration sizing pack: 5 credits a client. Mailbox, OneDrive, SharePoint and Teams sizes and counts, people, groups, licences, domains and devices, and a checklist. Reads: Usage reports (up to two days old), and the people, licences, groups and devices the latest assessment read. If the tenant hides names in usage reports, they show as codes, and you are told before anything is used. It moves nothing. Included already: Each client’s licences, mailboxes, groups and devices, each with its export.
Investigate
- Connected apps review: 3 credits a client. A dated review of every connected app: its permissions, who consented to it, whether its publisher is verified, its last use, a suggested decision for each, and a column for yours, as Excel and Word. Reads: Enterprise apps, their permissions and consents, and sign-in activity. Which admin consented to an app comes from directory records, which Microsoft keeps for 30 days with Microsoft Entra ID P1 or P2 and 7 days without. Included already: Each app’s risk, permissions and last use, on each client’s Connected apps page.
- Conditional Access what-if checker: 1 credit a check. Describe a sign-in: a person, an app, a device platform and a place. See which Conditional Access policies would apply and what each would ask for, which would not, and which Microsoft could not evaluate. Reads: Microsoft’s own What If evaluation of the client’s Conditional Access policies as they are now. It changes nothing. Included already: Why a recent sign-in was blocked, on each person’s Recent sign-ins; and every policy and its settings, on each client’s Conditional Access page.
Email security
- Domain exposure sweep: 5 credits a domain. Every name under one of a client’s domains that has had a public certificate, checked for mail security, for certificates ending, and for records left pointing at cloud names that no longer exist. Reads: Public certificate logs and public DNS only. It finds only names that have had a public certificate. Included already: The email security checks for each of a client’s domains, in every assessment.
Each link opens the extra in the console, after you sign in.
Where next
Trying it out?
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.
Already set up? Sign in