Everything an MSP needs to run Stella.

Run your first baseline

1. Sign up at the trial tier. stella-ai.ai/signup?plan=trial. 14 days, one tenant, no card. Use whichever client tenant has the easiest M365 admin access.
2. Connect Microsoft 365. On the Tenants page click Connect new tenant. Stella opens the Microsoft device-code flow — sign in as a Global Admin (or Privileged Role Admin) of the target tenant. The connect step takes about 60 seconds; consent is granted to a documented scope list (see below).
3. Wait for the first scan. As soon as the tenant connects, Stella runs a full baseline against 1,800+ M365 settings, all 17 CMMC L2 domains, and the active framework set. Typical wall-clock: 20–35 minutes. You don't have to stay on the page; Stella emails the on-call address when the scan finishes.
4. Open the gap report. The report lands at /audit-report with per-domain coverage, prioritised remediation queue, and an exportable PDF for the client. This is the document you quote against.

Microsoft 365 permissions Stella requests

Stella requests Microsoft Graph delegated permissions, scoped to read posture and to apply specific remediations the MSP approves. Tokens are encrypted at rest with a per-key identifier; refresh tokens are rotated on each use. Reading the actual scope list before consent is a normal MSP audit step — here's what to expect:

Read-write scopes are only exercised when the MSP explicitly approves a fix from the remediation queue. No scope is invoked on auto-discovery; nothing changes on a tenant without a logged operator decision. Every applied change goes into the append-only audit log mapped to the relevant control.

Control coverage by domain (the honest version)

Microsoft 365 governs more of CMMC L2 than most MSPs realise. The remaining domains are policy or human-process — Stella evidences them but doesn't auto-fix them. A truthful split:

~110 controls auto-remediated via Microsoft Graph, Exchange Online PowerShell, and Intune. The rest are evidenced (configs, screenshots, timestamps captured automatically) but require your team to ratify policy or perform on-site work.

For the full economics + 90-day deployment plan, see the CMMC L2 service-line blueprint.

Assessor-defensible evidence: what gets captured automatically

The reason most MSPs walk away from CMMC L2 work isn't the controls — it's the evidence pipeline. Per control, an assessor wants to see configuration that proves it, on a date that proves it. Stella captures all of this in the background:

• Configuration snapshots
  Per scan, every M365 setting Stella reads is hashed and snapshotted to an append-only store. The snapshot ID is referenced from the report.
• Screenshot evidence
  For settings that an assessor traditionally wants to 'see', Stella renders a deterministic screenshot of the M365 admin view at scan time.
• Timestamps + actor
  Every applied change is logged with the M365 token used, the operator who approved it, and the resulting object diff.
• Per-control mapping
  Each evidence record carries the CMMC L2 control IDs it satisfies (and any inherited NIST 800-171 control). Assessors can filter the store by control.
• Append-only storage
  Once written, evidence records are immutable. Edits or revocations create a new record; the original stays for audit.

When the C3PAO walks in, your client doesn't dig through admin centers — your MSP hands over a single PDF that links every claim to the underlying evidence record by ID.