Microsoft 365 Security Assessment
Know Exactly Where Your Tenant Stands
A one-off, independent review of your Microsoft 365 security settings. We check how people sign in, how admin accounts are protected, how email and files are shared and whether logging is on, then give you a clear, prioritised list of improvements.
What is Microsoft 365 Security Assessment?
A Microsoft 365 Security Assessment is a structured, one-off review of how your tenant is configured. It answers a simple question: are the security settings that protect your email, files and accounts switched on, and set sensibly for your business?
We review sign-in security, admin accounts, mailboxes, sharing, device settings and audit logging, compare them with good practice and with what your licences include, and give you a prioritised report. You then choose what happens next: fix the issues in-house, pass the report to your current IT provider, or ask us to carry out the remediation as a separate, scoped piece of work.
It differs from our ongoing Microsoft 365 Security service, which configures and maintains the settings month to month. The assessment is a point-in-time check, useful if you manage Microsoft 365 yourselves, use another provider or simply want a second opinion.
Key benefits
- An independent view of your Microsoft 365 security settings
- Findings ranked by risk, so you know what to fix first
- Clarity on which improvements your current licences already support
- Suspicious mailbox and forwarding rules brought to light
- A practical starting point for Cyber Essentials and wider security work
How does it work?
The assessment is a review only: we make no changes to your tenant while it runs. Any fixes are agreed afterwards as a separate piece of work, so you stay in control of what changes and when.
Agree scope and access
We confirm which tenant, domains and areas are in scope, and agree with your administrator how we will access the settings. Access is arranged securely, not through our website forms, and removed when the assessment ends.
Review the tenant
We check sign-in and MFA, Conditional Access, admin roles, mailbox and forwarding rules, external sharing, device settings and audit logging, alongside what your licences include.
Report and walk-through
You receive a prioritised report in plain English, explaining each finding, why it matters and the recommended fix. We walk through it with you and answer questions.
Optional remediation
If you would like us to make the changes, we scope and quote the remediation as a separate project. Some fixes are quick; others, such as enforcing MFA, need planning with your staff.
- Your tenantSign-in, admin, email, sharing, devices and logging
- Settings reviewNo changes made during the assessment
- Prioritised reportFindings ranked by risk, with recommended fixes
- Your decisionFix in-house, with your provider, or scoped remediation
What we review
- Sign-in security: MFA coverage, the methods in use and security defaults
- Conditional Access policies, where Microsoft Entra ID P1 is licensed
- Legacy (basic) authentication, and devices or apps that still rely on it
- Admin accounts: number of Global Administrators, role assignments, separation from everyday accounts and emergency access accounts
- Mailbox rules, automatic forwarding to external addresses and suspicious inbox rules
- Email protection policies, and the SPF, DKIM and DMARC email authentication records for your domains
- External sharing in SharePoint, OneDrive and Teams, including anonymous links and guest access
- Device settings and app protection policies, where device management is in use
- Audit logging status and the sign-in and alert information available
- Microsoft Secure Score recommendations, weighed against how your business works
When an assessment makes sense
You manage Microsoft 365 in-house
A second pair of eyes checks the settings nobody has looked at since the tenant was first set up.
Changing IT provider
Understand what you are handing over, and what needs fixing, before a new provider takes over.
After a security scare
If someone clicked a phishing link or noticed odd emails, a review of mailbox rules, sign-in settings and logging helps close the gaps. A suspected live incident needs incident response first.
Before Cyber Essentials
MFA on cloud services is required, and missing it is an automatic fail. The assessment checks Microsoft 365 against that early.
Problems solved
Nobody is sure how the tenant is set up
Settings built up over years, by different people, are hard to judge. The report sets out the current position in one place.
Hidden forwarding and inbox rules
Rules that quietly forward or hide email are a common sign of compromise. We look for them as part of the review.
Too many administrators
Microsoft recommends fewer than five Global Administrators. We list who has admin rights and whether they need them.
Paying for features that are switched off
We show which security features your licences already include and whether they are being used.
Files shared more widely than intended
We review sharing defaults, anonymous links and guest access, and recommend sensible limits.
What's included
Included as standard
- Agreed scope and secure access arrangements
- Review of tenant security settings, including sign-in, MFA and Conditional Access
- Admin account and role review
- Mailbox, forwarding rule and email protection review
- External sharing, device settings and audit logging review
- Prioritised findings report, with a walk-through of the results
Optional or scoped
Available on request and confirmed in your proposal; not part of the standard service.
- Remediation of findings, scoped and quoted as a separate project
- Ongoing configuration and review through Microsoft 365 Security
- A follow-up review after remediation
- Review of other cloud platforms through a Cloud Security Assessment
What's not included
- Making changes to your tenant during the assessment
- Incident response or forensic investigation of a suspected compromise
- Microsoft 365 licences or licence upgrades
- Review of third-party applications connected to Microsoft 365, unless agreed in the scope
- Penetration testing of Microsoft 365 or other systems
The assessment reflects your settings at the time of review. Settings change as people make changes and Microsoft updates its services, so findings can go out of date.
Some checks depend on your licences and the access granted. Where something cannot be reviewed, the report says so.
Who it's suitable for
- Businesses that manage Microsoft 365 themselves
- Organisations considering a change of IT provider
- Businesses preparing for Cyber Essentials
- Organisations that want an independent second opinion on their tenant
- Businesses on Business Premium unsure whether its security features are in use
Pricing
This service is tailored to your business, so we confirm the price after a short conversation about your requirements. There is no charge for the conversation.
Use the quote builder to add Microsoft 365 Security Assessment to an indicative quote, or book a free security review and we'll recommend what fits.
Price
Price Based on Scope
Price to be confirmed following a review of your requirements.
What affects the price
- Number of users and admin accounts
- Your Microsoft 365 licences
- Number of domains and mailboxes
- Use of SharePoint, Teams and guest access
- Whether device management is in scope
All prices exclude VAT.
Add to Your QuoteFrequently asked questions
Will you change anything in our tenant?
No. The assessment is a review only. If you want us to make the recommended changes, we scope that separately so you can see the work and the cost before anything changes.
What access do you need?
We agree this with your administrator at the start. Access is set up securely for the assessment and removed afterwards. Please don't send passwords or admin details through our website forms or quote builder.
Which Microsoft 365 plans can you assess?
Business Basic, Standard and Premium, Enterprise plans and tenants with a mix of licences. The findings take your licences into account, so we recommend what you can use today and explain where an upgrade would help.
Our current IT provider manages Microsoft 365. Can we still have an assessment?
Yes. An independent review can give you reassurance or highlight gaps, and the report is written so that your provider can act on it.
Is this the same as Microsoft Secure Score?
Secure Score is a useful list of recommendations built into Microsoft 365, and we take it into account. Not every recommendation suits every business, so we review your settings in context and prioritise what matters most for how you work.
Let's Secure Your Business
Find out how Pulsar IT can help protect, manage and improve your IT environment.