What changed
FACT (per signal 1729 as summarized in the convergence input; no source URL provided): Microsoft is ending its donated Business Premium grant for nonprofits, with the fallback being up to 300 free Business Basic licenses that lack Intune and Defender. INFERENCE: each affected org faces either new per-seat spend or a security/device-management gap at its renewal date.
Why now
The grant change lands on hard renewal dates rolling through 2026, so affected orgs discover the loss on a schedule rather than all at once. The targeting dataset (IRS BMF + bulk DNS MX lookups) can be assembled in days at near-zero cost, and the pain is individually provable: a prospect's own MX record ending in *.mail.protection.outlook.com demonstrates they run M365 before the first email is sent.
Converging signals
Only one underlying signal (1729, nonprofit M365 licensing) plus a reusable pattern (public registry as downloadable buyer list). The signals array supplied to this brief is EMPTY, so convergence here is a single-signal hypothesis with a clever targeting mechanism, not a multi-signal convergence. Scored accordingly.
Customer pain
HYPOTHESIS: nonprofits on the grant must either start paying ~$5.50/user/mo (nonprofit Business Premium pricing) or drop to Business Basic and lose endpoint management (Intune) and threat protection (Defender) — a concrete, explainable security regression for orgs handling donor PII. Pain intensity is unproven: demand_evidence is empty, and no complaint threads or job postings were supplied.
Who pays
Executive director or operations/IT manager at US 501(c)(3)s with roughly 10–300 staff currently on the Business Premium grant; secondarily, small MSPs who would buy the fingerprinted lead list itself.
Solved today
Nonprofit-specialist MSPs (Community IT, Tech Impact, RoundTable and thousands of generalist MSPs) and TechSoup handle licensing questions; Microsoft partners are actively marketing migration guidance on exactly this change. Many orgs will simply accept Business Basic and silently absorb the security gap.
Why current solutions are bad
MSPs sell ongoing managed contracts, not a one-time fixed-price optimization; TechSoup explains options but doesn't remediate; and no incumbent proactively identifies affected orgs that have no MSP relationship — which is exactly the segment the MX-fingerprint list surfaces.
Proposed product
A fixed-price 'M365 Grant Transition Audit' ($500–$1,500): automated tenant scan (Graph API read-only consent) + license right-sizing plan + security-gap remediation checklist, delivered as a report with an optional implementation upsell. The BMF×MX pipeline is the GTM engine, not the product; it can also be packaged as a lead-list/data product for nonprofit MSPs.
MVP version
(1) Download IRS EO BMF; (2) resolve org websites and bulk MX-lookup with dnspython; (3) filter to *.mail.protection.outlook.com; (4) a report generator that turns a read-only Graph API export into a license-savings + security-gap PDF. Steps 1–3 are one afternoon; step 4 is 1–2 weeks AI-assisted.
30-day build
Week 1: build the list and run the stated falsification test — sample 500 BMF orgs with websites, measure MX hit-rate (kill if <10%); cold-email 200 M365-confirmed orgs referencing the grant change. Weeks 2–4: book discovery calls, sell 2–3 paid audits at $500 pilot pricing, build the report generator against the first real tenant.
60-day build
Standardize the audit deliverable, raise price to $1,000–$1,500, add an implementation upsell (Defender/Intune alternative setup or Business Premium ROI justification). Test selling filtered lead lists to 5 nonprofit-focused MSPs as a second revenue line.
90-day revenue plan
HYPOTHESIS: 10–15 audits at ~$1,000 plus 2–3 MSP list subscriptions ≈ $12–20k cumulative. Entirely contingent on the week-1 reply-rate test; if replies are ~0% the idea is falsified cheaply.
Distribution path
Cold email/LinkedIn to a pre-qualified, provably-affected list — demonstrated-value outreach ('your own DNS shows you run M365; here's what the grant change costs you'), which matches the founder's non-relationship sales style. No ad spend, no marketplace.
Pricing hypothesis
$500 pilot → $1,000–$1,500 fixed-price audit; $2–5k implementation upsell; $250–500/mo lead-list feed for MSPs.
Technical difficulty
Low. BMF parsing, bulk DNS, cold-email infra, and a Graph-API report generator are all squarely within the founder's demonstrated skills. Hardest part is deliverability at outreach volume (needs warmed domains, ~$100–300/mo).
Legal / regulatory risk
Low-moderate: CAN-SPAM-compliant B2B cold email is legal; IRS BMF and DNS are public data. Reputational care needed — 'we fingerprinted your infrastructure' can read as creepy if phrased badly.
Platform dependency
Moderate: Microsoft could soften the change, extend deadlines, or offer discounts that shrink the pain; the audit also depends on Graph API read access remaining consentable by tenant admins.
Founder fit
Good but not his best pattern. Public-records mining, automation, and per-transaction pricing fit his strengths; the applicable lesson (gov-portal forced-buyer mandates score 8–9, confidence 0.80) does NOT apply — this is a VENDOR policy change, not a regulation, so there is no forced filing and no portal-submission moat. The delivery motion risks sliding into IT consulting, which he should resist by keeping the audit productized.
Breakout potential
The reusable asset is the 'mandatory registry × DNS/tech fingerprint = provable-pain buyer list' engine — repeatable for other stacks (Google Workspace nonprofit changes, state license rosters × tech fingerprints) and sellable as a data product to agencies/MSPs even if this vertical fizzles.
Final recommendation
TEST, don't build. This is a C+/B- opportunity with an A-grade falsification loop: one afternoon of scripting plus ~$200 of email infrastructure fully tests the thesis in 7 days. The demand_evidence array is empty, so demand is currently pure hypothesis — do not invest beyond the outreach test until ≥5% replies and ≥3 discovery calls materialize. If the test passes, the productized audit is a fast, self-funded $10–20k/quarter line and the registry×fingerprint engine generalizes; if it fails, total loss is under a week.
Next action
Run the stated experiment this week: download the IRS EO BMF, MX-fingerprint 500 sampled orgs (kill if <10% M365 hit-rate), send 200 grant-change-referencing cold emails from a warmed domain, and count replies/calls at day 7 against the ≥5%/≥3-call threshold.