Your data stays in your Microsoft 365 tenant. EndKeep works inside it with access you approve, never copies your data out, and every change we make is recorded in your own audit log. Our team is in Islamabad, Pakistan, and we say so up front, because the controls below are what make that safe.
The promise
| We commit to | What that means in practice |
|---|---|
| Your data stays in your tenant | We change settings, policies and apps inside your Microsoft 365. We do not download, export or keep copies of your email, files or user data. |
| Access you approve | Named admin accounts with MFA, given only the roles a task needs. No shared logins and no standing Global Admin. |
| Everything logged | Every change shows in your own Entra and Microsoft 365 audit logs, under a named account you can see. |
| A sanctioned access path | We reach your tenant through a path you agree to, such as Azure Lighthouse, GDAP or a named guest account, never a hidden tunnel. |
| Honest about location | Our engineers work from Islamabad, Pakistan. Admin sessions can run from a jump host in your own region if you require it. |
| Clean exit | When we stop working together, every account, role and app consent we used is removed the same day, and we confirm it in writing. |
How access works
- You approve the access method and the roles before any work starts. We send the list in writing.
- We sign in with named EndKeep accounts protected by MFA. Higher roles are activated only for the task, through PIM where your licence allows it.
- Changes go through Intune, Entra and the Microsoft 365 admin portals. Scripts run inside your tenant and are shared with you on request.
- Anything that needs your data, such as a mailbox search or a file restore, is done only when you ask, and the result stays in your tenant.
- Your monthly report lists what we changed, so the audit log and the report tell the same story.
What you can check yourself
- Who has access: Entra admin centre, Roles and admins, filtered to the EndKeep accounts.
- What we changed: Microsoft Purview audit log or Entra audit logs, searched by those accounts.
- Where we signed in from: Entra sign in logs show the IP address and country of every session.
- App consents: Entra, Enterprise applications, to confirm nothing was added without your approval.
If any of these ever disagree with our monthly report, tell us and we will explain it within one business day.
Who we are
EndKeep is ENDKEEP (SMC-PRIVATE) LIMITED, registered with the SECP in Pakistan and with the Pakistan Software Export Board. The work is done by Microsoft certified engineers.
[email protected] · +92 311 1222030 · Contact