Configuration and inventory. Never your mail, files or logs.
The assessment is a dedicated Microsoft application holding read permissions only, authenticating with a certificate rather than a secret. It is its own app, separate from anything that connects a tenant for monitoring, and it cannot act on the tenant.
Sign-in and multi-factor
Whether multi-factor authentication is required and for whom, legacy authentication, security defaults, the password and session policies, and how privileged accounts are protected.
Who holds the keys
Global administrators and the other privileged roles, how many there are, whether they are permanent or just-in-time, and whether break-glass accounts exist and are excluded correctly.
The policies, as written
What the policies require, who they cover, what they exclude, and the gaps between them: an unprotected legacy protocol, a location that bypasses multi-factor, a report-only policy nobody enabled.
Consents and secrets
Which applications users and administrators have granted access to, with what permissions; application credentials and how they expire; whether users may consent on their own.
With one optional role
Mail flow and anti-phishing settings, external sharing, guest access and Teams policies. These need one optional role assignment; without it the checks say not assessed, with the reason, rather than guess.
What the world sees
The published SPF, DKIM and DMARC records, the certificate and headers on the web hosts you name, and dangling records that point at hosts you no longer run. Passive checks only: a lookup, a handshake, a single request, never a port scan.
Three steps. Minutes, not a project.
- sign up
Create your organisation, pick your region
Sign up with an email address, Microsoft or Google, and choose where your data lives. Today the region we serve is the European Union (Ireland). Nothing to install, no credit check.
no agent · no card · free - consent
One administrator, one click
A Global Administrator consents once to the dedicated read-only app. We confirm the tenant is yours before anything is read. To include Exchange and Teams, assign the one optional role the page describes; everything else needs nothing more.
read-only · certificate, not a secret - read and fix
The score, the goals, the proof
The dashboard fills in as each part is read, identity first. Work the goals in the order that moves the score most for the least effort, then scan again to prove the fix landed. Print it, send it to Word, or take the CSV.
typically minutes · re-scan on demand
A number you can move, with the evidence behind it.
A score out of 100, in four bands
Exposed, basic, maintained, hardened, with a score per area beside the total. A check that could not run, because a licence is absent or a permission was not given, is shown with the reason and left out of the score. A silent gap never reads as a pass.
One goal per failed check
How many points it returns, whether it is a half-hour fix, a half-day job or a project, the numbered steps, a link to the right blade in the Microsoft admin centres, and the accounts or applications it concerns.
Nine framework views
NIST 800-53, ISO 27001, SOC 2, NIST CSF 2.0, Cyber Essentials, Essential Eight, NIS2, CISA SCuBA and MITRE ATT&CK, each showing met, gap and not assessed, each exportable. The views end with the controls a configuration scan cannot speak to.
Decided by rules, not by a model
Every check is a fixed rule over what was read. The same configuration gives the same answer every time, so a changed number always means a changed configuration.
Microsoft Secure Score
Secure Score is Microsoft's own measure of a tenant against Microsoft's recommendations, and the scan reads it. The scan adds what Secure Score does not: the same checks mapped to nine external frameworks, the email domain and the web hosts, an AWS account in the same report, the coverage stated beside the score, and a history of every re-scan. It does not replace Microsoft's tooling, and it is evidence, never a certificate.
What it cannot see
Policy, training, physical controls and anything outside the tenant's configuration. The framework views say so where it applies. A configuration scan shows how the doors are set; whether someone has already walked through them is the compromise assessment's question.
Yours to take back
Delete the enterprise application in your tenant and access ends at once. Tell us to forget the scan and the targets and results are deleted straight away. Otherwise results live in your isolated tenancy and are deleted thirty days after your last scan unless you continue.