Deploy it
Run Security Assessment Advisor hosted by Mojo Up, in your own Azure tenancy, on an assessor's laptop, or air-gapped in a container, and license it.
The Advisor runs in four shapes. All four serve the same tools.
| Shape | What it is | Sign-in | Exports |
|---|---|---|---|
| Hosted by Mojo Up | The service at saamcp.mojoup.com.au. Nothing to install. | Microsoft Entra ID, your work account | Download links |
| Your own Azure tenancy | The same container, deployed from the deployment kit into Azure Container Apps in your subscription, signed in with your own Entra tenant. | Your Entra ID | Download links from your storage account |
| Your own Docker host | The container on a server you run, with or without Entra. | Your Entra ID, or none on a private network | Download links, or files |
| On the assessor's laptop | The servers run on your machine and talk to your client directly. Nothing leaves the device except the one-off download of each standard's release. | None | Files on disk |
An air-gapped deployment is the Docker shape with the catalogues baked into the image: the container answers with no network at all, and takes a newer release when you bring one in.
The deployment kit
The deployment guide and the kit are on the Mojo Up customer portal under Security Assessment Advisor. The kit holds the Bicep for Azure Container Apps, the Docker Compose files, the Microsoft 365 Copilot agent package, and an example GitHub Actions workflow that fails a build when a change in the repository regresses the recorded assessment. The guide covers each shape step by step, who may call the server, the admin console, and every container setting.
The admin console
A deployed container has an admin console at /admin/. It shows which release of each standard the container is answering from, when it loaded it and when it last checked for a newer one; lets you search and download recent logs; and holds a few runtime switches. Where there is an Entra tenant the console is guarded by an app role; where there is not, by a password generated at first start.
The classification marking stamped on generated documents is set once, by whoever deploys the container, and cannot be changed from the console on a hosted deployment.
Licensing
A new installation runs a thirty-day trial with no key. Lookups, search, the walk-through and the gap analysis are complete on a trial; exports stop at twenty itemised rows, with a row saying what was withheld. A licence key from the customer portal, pasted into the console or mounted into the container, removes the cap. Licences are either a subscription, renewed on its own while billing continues, or perpetual on the version you bought, with a maintenance window for upgrades.
A licensed installation never stops working over a licensing question. If the portal cannot be reached, the installation carries on; if a licence is withdrawn, the installation returns to trial terms and says why.
Keeping the standard current
The container checks the publishers for a newer release on a schedule and loads it when one appears. The ISM comes from the Australian Signals Directorate's OSCAL releases, the Essentials from cyber.gov.au, and ASVS from OWASP. The admin console shows the three dates that matter: when the release was published, when the container loaded it, and when it last checked.