Microsoft 365 Security Posture Assessment

65 security controls

Identity, MFA, Conditional Access, privileged roles and unused or guest administrators, legacy authentication, third-party app consent and a list of unused app permissions, device settings, group expiration, cross-organisation access, and access reviews.

36 security controls

Anti-phishing, anti-spam and anti-malware against Microsoft’s Standard, DKIM, SPF and DMARC, auto-forwarding, enhanced filtering for connectors, sign-in and protocol settings (SMTP AUTH, POP and IMAP, modern authentication, shared mailboxes), user protection (outside-sender tag, MailTips, calendar sharing), quarantine and sending limits, mail flow rules and mailbox auditing.

37 security controls

Device compliance policies and their assignment, device compliance and Windows encryption, screen lock and password settings, the Microsoft Defender for Endpoint risk score, app protection and data transfer, enrolment restrictions, Windows Hello for Business, update rings, and Windows Autopilot, each checked separately for Windows, macOS, iOS/iPadOS and Android.

22 security controls

Audit logging, sensitivity labels and label policies, DLP, auto-labelling, and retention policies.

20 security controls

External sharing, guest and sign-in settings, sync client restrictions, site creation, and how your Microsoft 365 groups are governed. Read-only: no write-capable permission is requested.

20 security controls

The read-only SharePoint assessment plus the settings that only the SharePoint tenant admin object holds, checked automatically instead of by hand: the default sharing link, Anyone link expiry and permission, access from unmanaged devices, guest access expiry and infected file download. It holds one write-capable SharePoint permission for a few minutes.

22 security controls

External access, guest settings, meeting and app policies, file storage, channel email, shared channels, and security reporting.

27 security controls

Defender for Endpoint coverage and protection settings (EDR block mode, antivirus and its readiness when another antivirus is the main one, network protection, attack surface reduction), exploitable vulnerabilities, Secure Score, alerts and incidents, attack simulation, and Safe Attachments, Safe Documents, Safe Links, anti-phishing, Teams protection and user reported messages.

12 security controls

Third-party AI app exposure and Microsoft 365 Copilot readiness. Shows which AI apps can reach your mail, files, chats and calendars, how users and admins consent to apps, and how ready your tenant is for Copilot.