Free Microsoft 365 security assessment
Most Microsoft 365 breaches start with a setting nobody changed: MFA that isn't enforced everywhere, an admin account without strong sign-in, or mail quietly forwarding outside the company. We check your tenant's configuration against recognised security baselines and tell you what to fix first.
What we check
Every check looks at how things are configured, never at your data. Here's what each area covers.
Standards
Results also help answer the Microsoft 365 questions on cyber insurance applications and SOC 2 or ISO 27001 readiness reviews.
Read-only
You stay in control of access the whole time, and you can remove it whenever you like.
We email your administrator a short access pack with step-by-step instructions.
They run one script on a Windows PC. It creates a temporary read-only app in your tenant, using the Global Reader role. No password is shared: it signs in with a certificate that's unique to your assessment.
Access expires automatically after 30 days. Your administrator can remove it sooner with one command, and we ask them to once the report is delivered.
Prefer not to run anything? Your administrator can sign in live on a 30-minute screen share instead, and nothing is left behind.
What you receive
An A to F grade for each area, written for the person who signs the cheques, with the technical detail attached for whoever runs IT.
The ten findings that matter most, each explained in plain language: what it is, why it matters, and how to fix it.
How your settings line up against each framework we check, so you know where you stand before an audit or insurance renewal.
We go through the report with you on a call and answer questions. Any fixes are quoted at a fixed price, only if you want them.
Questions
Yes. The access we ask for can only read settings. It can't change anything, and it's limited to configuration, not your data. The section above lists exactly what we can and can't see.
No. We read configuration through Microsoft's standard administration interfaces. Nothing is installed on your devices, and users won't notice anything.
A Global Administrator, on any Windows PC. It takes about five minutes.
No. Some checks only apply if you have features like Conditional Access or Defender for Office 365; where you don't, the report tells you what those features would add.
Yes. It's an independent check of the settings, and the report is something your provider can work from.
The assessment is free. If you'd like help fixing what we find, each fix is quoted at a fixed price before any work starts, and you're never obliged to go ahead.
Within two business days of your administrator finishing setup. We then book a 30-minute call to walk you through it.
Tell us a little about your setup and we'll send everything your administrator needs.
