Pricing
Mix and match workload assessments. Basic gets you a scored PDF report. Advanced adds an AI-generated executive summary and remediation roadmap, built from tokenised data.
Which assessments fit your licences? (optional)
Pick your main Microsoft 365 plan and any add-ons and each assessment below shows how many of its scored controls can apply to them. It is a guide: skip it and buy exactly as before. The assessment itself reads your real licences.
In the Microsoft 365 admin center > Billing > Licenses > Export. Uploading replaces the picks above.
Your file is read in this browser. Nothing in it is sent to us; only the licence types we recognised are used for the recommendation and, if you buy, saved with your order. Your picks never change what is collected or scored, and the order page tells you if the assessment finds something different.
Entra ID
65 controls
Identity, MFA, Conditional Access, privileged roles and unused or guest administrators, legacy authentication, third-party app consent and a list of unused app permissions, device settings, group expiration, cross-organisation access, and access reviews.
Exchange Online
36 controls
Anti-phishing, anti-spam and anti-malware against Microsoft’s Standard, DKIM, SPF and DMARC, auto-forwarding, enhanced filtering for connectors, sign-in and protocol settings (SMTP AUTH, POP and IMAP, modern authentication, shared mailboxes), user protection (outside-sender tag, MailTips, calendar sharing), quarantine and sending limits, mail flow rules and mailbox auditing.
Microsoft Intune
37 controls
Device compliance policies and their assignment, device compliance and Windows encryption, screen lock and password settings, the Microsoft Defender for Endpoint risk score, app protection and data transfer, enrolment restrictions, Windows Hello for Business, update rings, and Windows Autopilot, each checked separately for Windows, macOS, iOS/iPadOS and Android.
Microsoft Purview
22 controls
Audit logging, sensitivity labels and label policies, DLP, auto-labelling, and retention policies.
SharePoint Online (read-only)
20 controls
External sharing, guest and sign-in settings, sync client restrictions, site creation, and how your Microsoft 365 groups are governed. Read-only: no write-capable permission is requested.
Read-only: no write-capable permission is ever requested. A few SharePoint settings are listed for you to check by hand. An order holds one SharePoint assessment: read-only or full control.
SharePoint Online (full control)
20 controls
The read-only SharePoint assessment plus the settings that only the SharePoint tenant admin object holds, checked automatically instead of by hand: the default sharing link, Anyone link expiry and permission, access from unmanaged devices, guest access expiry and infected file download. It holds one write-capable SharePoint permission for a few minutes.
Holds a write-capable permission. This assessment gives the 365Posture app the SharePoint permission Sites.FullControl.All for a few minutes, removed right after the one read. You confirm it at checkout and again in the setup script. Prefer not to? Choose the read-only SharePoint assessment.
Microsoft Teams
22 controls
External access, guest settings, meeting and app policies, file storage, channel email, shared channels, and security reporting.
Defender for M365
27 controls
Defender for Endpoint coverage and protection settings (EDR block mode, antivirus and its readiness when another antivirus is the main one, network protection, attack surface reduction), exploitable vulnerabilities, Secure Score, alerts and incidents, attack simulation, and Safe Attachments, Safe Documents, Safe Links, anti-phishing, Teams protection and user reported messages.
AI Exposure
12 controls
Third-party AI app exposure and Microsoft 365 Copilot readiness. Shows which AI apps can reach your mail, files, chats and calendars, how users and admins consent to apps, and how ready your tenant is for Copilot.
What it checks and what it does not
- Third-party AI apps (6 controls). Application access to mail, files, chats and calendars. High-risk scopes consented by admins and by users. Meeting note-takers. Unverified publishers. A catch-all for apps we do not recognise.
- Consent and governance (2 controls). Whether users can consent to apps, and whether an admin consent workflow is set up.
- Copilot readiness (4 controls). The tenant sharing level, whether sensitivity labels are published, how Copilot licences are assigned, and Copilot adoption. The last two are for information only and need a Microsoft 365 Copilot licence.
The deeper data-protection settings that Copilot relies on are graded in the Purview assessment (labels, DLP for Copilot, audit, retention) and the SharePoint assessment (sharing, links). If you buy those, you see them there. We do not grade them twice.
Not covered yet: AI agent identities (Entra Agent ID), Power Platform and Copilot Studio agents and connectors, and browser traffic to AI websites (finding shadow AI that way needs Defender for Cloud Apps).
Your selection
Payment is processed securely by Stripe. You will be redirected to complete checkout.