SOC operations 24/7Under active attack? Call the incident hotline +1 833 403 5875
Partner loginContact sales
  1. Home
  2. Assessments & Advisory
  3. Microsoft security assessment
Assessments & Advisory

Microsoft gives you the controls,
configuring them is on you.

We examine every control in your Microsoft tenant, identity, devices, cloud, Defender, monitoring, compliance and collaboration, map each one to recognised standards and tell you exactly what to change.

Scope a tenant assessment →
2 weeksFor one tenant
QuarterlyRe-baseline against drift
7 areasIdentity to collaboration
RemoteRead-only access, no site visit
What it is

Shared responsibility means the gaps are yours.

Microsoft 365 is where your email, files, chat and identity live, which makes it the first place an attacker goes. Business email compromise, consent phishing, OAuth abuse and token replay all start in the tenant. A default tenant favours ease of use: conditional access, phishing-resistant MFA, sharing limits, mail flow protection and audit logging all have to be switched on and tuned by someone.

A Microsoft security assessment examines every one of those controls, maps it to recognised standards such as the CIS Microsoft 365 Benchmark, and ranks the gaps by what an attacker would use first. One tenant takes two weeks. Because Microsoft ships new features and settings drift, we re-baseline quarterly so the picture stays current.

What you get
  • A control-by-control review of your tenant across seven areas, each mapped to recognised standards
  • A ranked list of gaps, with the exact setting to change and the business impact of changing it
  • Conditional access, MFA and privileged access recommendations designed for how your people actually work
  • A Defender configuration review covering Office 365, Endpoint, Identity and Cloud Apps
  • An executive summary and a technical remediation plan for your administrators
  • A quarterly re-baseline that shows what changed and what drifted
How it works

Four steps, access to re-baseline.

Connect, read-only

You grant read-only access to the tenant. Nothing is changed without your approval.

Examine every control

Identity, device management, cloud, Defender, monitoring, compliance and collaboration settings are reviewed and mapped to standards.

Rank and brief

Gaps are ranked by attacker value and business impact, then walked through with your team and leadership.

Re-baseline quarterly

We re-run the review each quarter to catch drift, new features and new attack techniques.

What we examine

Seven areas, every control.

Entra ID

Identity

Conditional access, phishing-resistant MFA, privileged identity management, legacy authentication, guest access and risk policies.

Intune

Device management

Compliance policies, enrolment, app protection and the conditions that tie device health to access.

Azure

Cloud

Subscription and role configuration, exposed resources and the identities that can reach them.

XDR

Defender

Defender for Office 365, Endpoint, Identity and Cloud Apps: coverage, policies, alert tuning and automated response.

Logging

Monitoring

Unified audit log, mailbox auditing, sign-in logs and whether anyone is watching them.

Purview

Compliance

Sensitivity labels, retention, data loss prevention and eDiscovery readiness.

Exchange, Teams, SharePoint

Collaboration

SPF, DKIM and DMARC, anti-phishing and impersonation protection, mail flow rules, external sharing and third-party app consent.

Ideal for

Who it is for

Any organization that says "we're all-in on Microsoft". If your email, identity and files live in Microsoft 365, this is the assessment that tells you whether the platform you depend on is configured to protect you.

Related services · what comes next
Questions

What buyers ask.

Microsoft handles our security.

Microsoft provides the controls and secures the platform. Configuring the controls in your tenant is your responsibility under the shared responsibility model, and that is where the gaps are.

We already check our Secure Score.

Secure Score is a useful starting point, but it counts settings rather than weighing them. We rank gaps by what an attacker would use against your tenant and how your people actually work.

Do you need admin access?

No. The review runs on read-only access, and nothing in your tenant changes unless you choose to make the change.

Why re-baseline every quarter?

Microsoft ships new features and defaults constantly, and administrators change settings to solve today's problem. A quarterly re-baseline catches drift before an attacker does.

Find out what your tenant is really allowing.

Put an engineer on a call to scope a Microsoft security assessment for your tenant. No charge, no commitment.

Scope a tenant assessment →All services