For an audit or insurance questionnaire you have to answer, or a tenant that grew without a security baseline.
We assess your Microsoft 365 tenant and, if you need it, your on-premises infrastructure. We score it against Microsoft’s recommended settings and the rules you answer to, and hand you a roadmap in priority order.
Four assessments, each ending in a roadmap in priority order. The Microsoft 365 Security Assessment covers the tenant, and the other three go deeper on infrastructure, CIS Controls, or compliance.
Microsoft 365 Security Assessment
Typically 2–3 weeks
Your tenant’s security reviewed against Microsoft’s recommended settings: identity, Conditional Access and MFA, admin roles, sharing and guest access, email and cloud app protection, and Secure Score.
What you get
Business and technical security requirements, including guest access
Licensing, authentication, admin roles, and tenant settings reviewed
A Secure Score baseline to measure progress against
Findings ranked by risk and effort
A roadmap in priority order
Best for
A Microsoft 365 tenant whose sign-in, admin role, and email settings were never checked against a baseline.
Core infrastructure review
Typically 3–4 weeks
Active Directory, Group Policy, DNS and DHCP, SQL, network links, directory sync, patching, and lifecycle reviewed for security and resilience, ranked by business priority.
What you get
Findings from hands-on review, site visits, and user interviews
Assessment document: current state, requirements, risks
Recommendations per service and a deployment roadmap
Roadmap presented to leadership on site
Best for
On-premises infrastructure that nobody has reviewed as a whole in years.
What does the Microsoft 365 Security Assessment produce?
Findings across your Microsoft 365 tenant, a Secure Score baseline, and a roadmap ordered by risk and effort. The roadmap is presented to your leadership at the end.
Do you do the fixes too?
Yes, as separate projects: identity and access, Defender and Sentinel, Purview, and hardening. For vulnerabilities, the CIS Controls gap assessment produces the plan, Threat Protection does the one-time remediation, and Managed Security works the ongoing backlog. The roadmap is written so that your own team or another provider could carry it out as well.
We map findings to the framework you answer to, such as NIST SP 800-53, PCI DSS, or GLBA, or to the CIS Critical Security Controls. Microsoft’s recommended settings are the baseline for the tenant review. If you need CMMC or FedRAMP, tell us up front so we can be clear about fit.
How long does an assessment take?
It depends on which assessment, and on how many sites, systems, and standards are in scope. Typical lengths are listed with the assessments above.
What changes the size of an assessment?
Mostly how many users, devices, and workloads are in scope, and whether on-premises infrastructure is included. The number of standards you answer to counts too, as does whether we also do the fixes.
Can you secure the tenant before we turn on Copilot?
Yes. Start with the Copilot Readiness Assessment, which checks what Copilot can see. This assessment covers broader tenant security, and labels across the organization are Data Security and Compliance.
It starts with a 60-minute call. If we need more to scope it, a short questionnaire follows. Then a written proposal and statement of work. Once you approve, we begin with the Assess phase.
