Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A full security review of your Microsoft 365 tenant, top to bottom.
A Microsoft 365 assessment is a configuration review of your tenant, Entra ID, Exchange Online, backups, and licensing, against Microsoft's own security baselines, since most M365 tenants are configured for convenience during onboarding and never revisited.
Most Microsoft 365 tenants are configured for convenience during onboarding and never revisited. We review the tenant the way an attacker or auditor would, identity, email, data protection, and licensing, and tell you exactly what's misconfigured and why it matters.
This covers the full Microsoft 365 product surface: Entra ID (Azure AD), Exchange Online, SharePoint/OneDrive, Teams, and the backup and retention posture sitting behind them.
We work across the whole Microsoft ecosystem, not just email: Entra ID for identity, Exchange Online for mail flow, Microsoft Defender for threat protection, SharePoint and OneDrive for file storage, Microsoft Teams for collaboration, and Microsoft Purview for compliance and data governance. Each ships with real security controls that are either off by default or set to whatever was fastest during onboarding, closing that gap without breaking how your team actually works is the whole engagement.
Licensing is part of the review too. Business Basic, Business Standard, Business Premium, and the E1/E3/E5 enterprise tiers don't just differ on price, they gate which security features (Conditional Access, Microsoft Defender for Office 365, Entra ID P1/P2, Purview DLP) are even available to turn on. We'll tell you if you're paying for security capability you're not using, or missing capability you're already licensed for.
Microsoft 365 misconfiguration is one of the most common initial-access vectors in real incidents, and one of the cheapest to fix, since the controls already exist in your existing licensing and are often just not turned on.
A licensing review frequently pays for the assessment on its own, by identifying unused or misassigned licenses alongside the security findings.
Your tenant's default settings are not your security policy.
of cloud breaches trace back to misconfiguration or identity issues
How we manage and secure each product
Conditional Access policies, MFA enforcement, and privileged role review, identity is where most real-world M365 breaches actually start.
Anti-phishing and anti-spoofing controls, SPF/DKIM/DMARC enforcement, and mail flow rules that catch what default filtering misses.
Safe Links, Safe Attachments, and Secure Score tuned to your actual risk, not left on the report-only defaults most tenants ship with.
External sharing defaults, sensitivity labels, and access reviews so file sharing doesn't become the biggest data-leak vector.
External and guest access policies locked down, plus a review of Teams' own sprawling, often-unaudited permission model.
DLP policies, retention labels, and audit logging configured so you can actually answer "who accessed what" when it matters.
6
areas covered
Live from our own KEV archive
Not all of this is Microsoft 365 itself, some is the broader Microsoft stack a hybrid-identity tenant touches, but it's the real, current exploitation count across that ecosystem, not a hypothetical.
Microsoft ecosystem tracker
LiveMicrosoft-tagged CVEs
0
Windows-tagged CVEs
0
Exchange-tagged CVEs
0
Microsoft ecosystem breakdown
Licensing
Compare the tiers that matter, toggle any of them on or off. Security-relevant features (Conditional Access, Defender, Entra ID tier, Purview DLP) are gated by license, so the right tier is as much a security decision as a budget one.
| Feature | Business Basic Up to 300 users, web-only apps | Business Standard Up to 300 users, desktop apps | Business Premium Up to 300 users, needs real security | E1 Large orgs, web-only apps | E3 Large orgs, full productivity + baseline security | E5 Large orgs, maximum built-in security |
|---|---|---|---|---|---|---|
| Desktop Office apps | ||||||
| Microsoft Teams | ||||||
| Cloud storage (OneDrive) | 1 TB | 1 TB | 1 TB | 1 TB | 1–5 TB | 1–5 TB |
| Exchange mailbox | 50 GB | 50 GB | 50 GB | 50 GB + 50 GB archive | 100 GB + 1.5 TB archive | 100 GB + 1.5 TB archive |
| Advanced threat protection (Defender) | Defender for Business | Defender for O365 P1 | Defender for O365 P2 | |||
| Entra ID tier | Free | Free | P1 | Free | P1 | P2 |
| Conditional Access | ||||||
| Endpoint management (Intune) | ||||||
| Purview DLP (emails & files) | ||||||
| eDiscovery & audit | Standard | Premium |
Feature inclusion shown is Microsoft's published tier breakdown at time of writing and can change, confirm current business plans or enterprise plans directly with Microsoft, including current pricing. We help you pick the right tier for what you actually need, not the most expensive one.
Beyond the license tier
The license comparison above tells you what's available. This is what we actually check once you have it, starting with the legacy-auth gap that quietly bypasses MFA in almost every tenant.
PS> Connect-MgGraph -Scopes "Policy.Read.All"
Welcome to Microsoft Graph!
Tenant: demo-corp.onmicrosoft.com
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Process
Confirm tenant scope, licensing tier, and access needed for review.
Review configuration across identity, email, storage, and backups.
Assess findings against Microsoft security baselines and real-world risk.
Deliver a prioritized report mapped to business impact.
Support your team implementing fixes directly in the tenant.
Verify configuration changes actually close the gaps found.
We typically request a read-only Global Reader or scoped custom role, enough to review configuration without needing standing admin access to your tenant.
Both, we can assess your current configuration, and separately support implementing and managing the fixes across any Microsoft 365 product.
Yes, for organizations operating under UK NCSC guidance or EU NIS2's risk-management measures, we assess your tenant configuration against those baselines alongside Microsoft's own security recommendations.
Yes, hybrid identity (on-prem AD/LDAP federation into Entra ID) is explicitly part of what we assess, since misconfiguration in the sync layer is a common way an on-prem compromise becomes a cloud compromise.
Tell us your specific tenant environment during scoping, the core assessment methodology applies, though sovereign/government cloud environments sometimes have additional configuration surfaces worth confirming fit for before starting.
Our methodology for microsoft 365 is grounded in established, publicly available frameworks, not a proprietary checklist.
Share a few details about your environment and we'll help you scope the right engagement.