Frequently asked questions

Straight answers about safety, data handling, licensing, and support.

How long can I run an assessment I have bought, and how long are the results kept?: An assessment you have bought can be run for 12 months from purchase. Assessment results are deleted 12 months after the assessment. Your order record (product, date and amount) stays in your account as a billing record.
How long do you keep my records?: Billing records are kept for 7 years. Assessment results are deleted 12 months after the assessment. Support assistant messages, Report Advisor usage records (not the text), email delivery records (including bounces and complaints), and sign-in, security and account activity records are kept for 12 months. Support requests are deleted 180 days after they are closed, or after 12 months without activity. Application logs used to run the service are kept for 30 days. See the Privacy page for the full list.
Can I see which assessments fit my licences before I buy?: Yes, and it is optional. On the pricing page pick your main Microsoft 365 plan and any add-ons, and each assessment shows how many of its scored controls can apply to them, with a Recommended or Not recommended for your licences note. You can also upload the licence export CSV from the Microsoft 365 admin center (Billing > Licenses > Export): the file is read in your browser and nothing in it is sent to us, only the licence types we recognise are used. It is a guide only: you can still buy anything, and the assessment always reads your real licences. Only the names of the licences you pick are saved with your order (never counts or tenant data), and they never change what is collected or scored. If you picked a licence the assessment did not detect, the order page says so and tells you how to re-run with your licence export.
Are there bundles, and how are they refunded?: Yes. Threat protection (Exchange Online and Defender for Microsoft 365), Collaboration (SharePoint read-only and Teams) and AI readiness (AI Exposure and Purview) are sold as bundles, and the Full suite covers all eight assessments (SharePoint read-only). Bundles and the suite have fixed prices, shown on the Pricing page next to what the same assessments cost one by one. A bundle has one tier (Basic or Advanced) for everything in it, and each assessment in it is delivered as its own report. A bundle never includes SharePoint full control. A bundle or the full suite is refunded as a whole, never one assessment at a time.
What is 365Posture?: A Microsoft 365 security posture assessment service. You purchase an assessment for one or more workloads (Entra ID, Exchange Online, Intune, Purview, SharePoint, Teams, Defender for M365, or AI Exposure), run a PowerShell collector script inside your own tenant, and receive a scored PDF report with findings and remediation guidance.
Is it safe to run against our production tenant?: By default the collector asks only for read-only Microsoft Graph API permissions. You approve that permission list on Microsoft’s own Entra admin consent screen before anything runs, and you can review the full list in advance on our Permissions page. The one exception is the separate SharePoint (full control) assessment, which you choose at checkout: see the next answer.
What is the SharePoint (full control) assessment, and why does it need a write-capable permission?: Microsoft lets an app read a few SharePoint settings (the default sharing link, how long Anyone links last and what they allow, access from unmanaged devices, how guest access expires, whether an infected file can be downloaded) only with a write-capable permission, Sites.FullControl.All. The SharePoint (full control) assessment reads them automatically. To do that, the setup script gives the 365Posture app that one permission for a few minutes, just before the one read, and removes it right after; the script then checks that it is gone and tells you, with the exact steps, if it is not. That permission can change every SharePoint site in your tenant; 365Posture only reads with it. Access tokens issued in that short time stay valid until they expire, about 60 to 90 minutes, and exist only on your computer. Microsoft shows no consent screen for it, so you confirm it at checkout and again when the setup script asks. The read-only SharePoint assessment never needs it: it lists those settings for you to check by hand instead. An order holds one SharePoint assessment, read-only or full control.
What does the AI Exposure assessment cover?: Third-party AI app exposure and Microsoft 365 Copilot readiness, in 12 controls. Six look at third-party AI apps: application access to mail, files, chats and calendars, high-risk scopes consented by admins and by users, meeting note-takers, unverified publishers, and a catch-all for apps we do not recognise. Two look at consent and governance: user consent and the admin consent workflow. Four look at Copilot readiness: the tenant sharing level, whether sensitivity labels are published, how Copilot licences are assigned, and Copilot adoption. The last two are for information only and need a Microsoft 365 Copilot licence. The deeper data-protection settings that Copilot relies on are graded in the Purview assessment (labels, DLP for Copilot, audit, retention) and the SharePoint assessment (sharing, links), so you see them there and they are not graded twice. Not covered yet: AI agent identities (Entra Agent ID), Power Platform and Copilot Studio agents and connectors, and browser traffic to AI websites (finding shadow AI that way needs Defender for Cloud Apps).
What data actually leaves our tenant?: Only tokenised, encrypted data. Before anything is written for upload, the collector replaces sensitive values — user names, admin emails, tenant domain and ID, policy and group names, device and domain controller names — with structured tokens (like user1@domain.com or device1) on your own machine. The mapping between tokens and real values is saved locally only and is never uploaded. See the Security page for the full token schema.
Does 365Posture ever see our real tenant data?: No. 365Posture servers only ever process tokenised, anonymised data. The encrypted artifact you upload is deleted immediately after scoring. On the Advanced tier, the AI model that writes your executive summary also receives tokenised data only.
What licenses do we need?: Requirements vary by workload — for example, some Entra ID controls require Entra ID P2, and Intune/Purview controls depend on your existing M365 licensing. The collector detects your licenses automatically and each report clearly flags any control that could not be evaluated due to a missing license.
A report shows a control as unlicensed, but we do have that license. How do we fix it?: License detection is automatic, but if a control is flagged as unlicensed when it should not be, you can correct it and re-run: in the Microsoft 365 admin center go to Billing → Licenses → Export to CSV. Then sign in to your buyer portal, open the order and choose “Re-run with updated licenses”. A re-run replaces your assessment bundle, so download the fresh bundle from the order page, put the CSV into that new bundle folder and run it. (An older bundle stops with a message telling you to download the fresh one.) Your earlier report stays under Your orders (open that run and choose View details); your Pass / Fail marks are cleared. Re-runs are available for 14 days after your first report, up to 3 per order, and not after 12 months from purchase.
What do we need installed to run the collector?: PowerShell 7 (pwsh). The setup script installs any required PowerShell modules automatically. You run one command; it handles app registration, admin consent, data collection, tokenisation, and upload.
How long does it take?: The collector run itself typically takes a few minutes per workload. Your scored report is ready in your account within minutes of the tokenised artifact being uploaded and scored — we’ll email you when it’s ready with a link to your order page (downloads are in your account; we never email download links).
What’s the difference between Basic and Advanced?: Basic includes a scored PDF report with remediation guidance. Advanced adds an AI-generated executive summary and remediation roadmap, built entirely from your tokenised results.
Who can I contact for support, billing, or report issues?: One address for everything: support@365posture.net. Pick a category (billing, technical, report, account, or other) when you message us — from the Contact page, the assistant on your account page, or the Support page in your account — and we route it from there.

Still have a question?