Security assessments
Microsoft 365 Security Assessment
A structured review of identity, access, and security controls across your Microsoft 365 tenant, covering Entra ID, Conditional Access, Microsoft Defender, and related configuration, to identify gaps against recommended security baselines.
Problems this addresses
- Uncertainty about Conditional Access and MFA coverage
- Legacy authentication or weak sign-in policies left enabled
- Overly broad privileged role assignments
- Unclear Secure Score standing and what it actually means operationally
Who this is for: Organizations running Microsoft 365 / Entra ID that want an independent review of tenant security configuration before or after a broader security initiative.
Scope
- Entra ID identity and authentication configuration
- Conditional Access policy review
- Privileged role assignment review
- Microsoft Defender configuration (where licensed)
- Exchange Online security settings
- SharePoint and OneDrive external sharing controls
- Audit logging configuration
- Secure Score review and interpretation
Methodology
- 01Scope and license tier confirmation
- 02Read-only tenant configuration review via delegated admin access
- 03Comparison against Microsoft and CIS Microsoft 365 Foundations Benchmark recommendations
- 04Risk-rated findings with tenant-specific context
- 05Remediation guidance, sequenced by effort and impact
Deliverables
- Executive summary
- Tenant configuration findings register
- Secure Score interpretation
- Prioritized remediation roadmap
- Optional remediation support as a follow-on engagement
Frameworks referenced
- CIS Microsoft 365 Foundations Benchmark
- Microsoft Secure Score
- NIST SP 800-53 (control mapping reference)
What we need from you
- Delegated or time-boxed admin access appropriate to the review (least-privilege, revocable)
- Confirmation of current Microsoft 365 / EMS licensing tier
- A named technical point of contact
Out of scope
- Hands-on remediation (available as a separate engineering engagement)
- Review of custom line-of-business applications integrated with the tenant
- On-premises Active Directory review (covered separately if relevant)
Frequently asked questions
Do you need Global Administrator access?
No. Review access is scoped to least privilege required for the assessment and should be time-boxed and revoked at the end of the engagement.
Will you change any settings during the assessment?
No. This is a read-only assessment. Any changes are proposed as findings and only implemented separately, with your approval, as a security engineering engagement.
Which license tier do I need?
We'll confirm your current tier during scoping. Some recommendations depend on licensing (for example, certain Defender or Entra ID P2 features) and will be flagged as license-dependent rather than assumed.