Free Microsoft 365 Security ReviewFind out what your Microsoft 365 security is actually doing. Free, in writing.
Most businesses pay for Microsoft 365 security they have never switched on. Our free review reads your tenant's configuration, not a questionnaire, and gives you a written list: what is protecting you, what is off, and the order to fix it in. No obligation, no sales deck, and you keep the report whether or not you ever speak to us again.
Who this is for
Businesses of 10 to 250 people on Microsoft 365 Business Standard, Business Premium or Enterprise plans, who have an IT provider or an in-house person and want an independent view, or who have just been asked a security question by an insurer, a customer or a Cyber Essentials assessor and are not sure of the answer.
What we check
Identity: whether multi-factor authentication is enforced for every user and every admin or merely available, whether legacy authentication is blocked, how many Global Administrators there are and whether they have separate everyday accounts, and whether Conditional Access policies exist and what they actually require.
Devices: how many devices are enrolled in Intune against how many people you have, whether they are encrypted and compliant, and whether company data can be opened on a device you do not manage.
Email: whether Defender for Office 365 Safe Links, Safe Attachments and anti-phishing impersonation protection are configured for your domain, whether SPF, DKIM and DMARC are set up so your own domain cannot be spoofed, and whether mailbox forwarding rules are monitored.
Data: whether sensitivity labels and retention policies exist, whether sharing links default to anyone, and whether there is a backup of Microsoft 365 outside Microsoft and when it was last restored from.
Score: your Microsoft Secure Score, what it is being held down by, and which of those items are quick to fix.
Source: Microsoft Secure Score (Microsoft Learn), Security benefits of Business Premium (Microsoft Learn)
What you get
A written report, usually four to six pages, in plain English. Each finding says what we checked, what we found, why it matters to a business your size and what it would take to fix, ordered by risk. The first page is a summary a managing director can read in five minutes. The report is yours to keep, and to hand to your current IT provider if you want them to act on it.
If you would like us to do the fixes, we quote that separately as a fixed project. Most businesses find that the majority of findings are configuration changes inside the licence they already pay for, rather than new products.
How it works
You book a twenty-minute call. On it we explain what read-only access we need, which is a time-limited reader role on your tenant that cannot change anything, and you grant it yourself. We review the tenant within five working days, send the report, and go through it with you on a second short call if you want one. Then we remove our access, and that is the end of it unless you ask for more.
We do not ask for passwords, we do not install anything, and we do not run the review on a tenant whose owner has not personally authorised it.
Source: Small Business Guide (NCSC)
What is included
Identity review
MFA enforcement, legacy authentication, admin accounts and Conditional Access, read from the tenant.
Device review
Intune enrolment, encryption and compliance against your headcount.
Email review
Defender for Office 365 policies, SPF, DKIM and DMARC, forwarding rules.
Data review
Sensitivity labels, retention, sharing defaults and backup.
Secure Score
Your score, what holds it down and the quick wins.
Written report
Findings in priority order, in plain English, yours to keep.
Walkthrough call
Optional, twenty minutes, to go through the findings and answer questions.
What is not included, and why
- The fixes. We quote those as a fixed project if you want us to do them; you can equally hand the report to your existing provider.
- A penetration test or vulnerability scan of your network. This is a configuration review of Microsoft 365, not an attack simulation.
- Cyber Essentials certification. The review tells you how far off you are; certification is a separate fixed-price service.
What it costs
The review is free. There is no fee, no obligation and no automatic follow-up. If you ask us to carry out the fixes, we quote a fixed price for the project first, and ongoing management is included in managed IT support or Microsoft 365 management from £35 per user per month.
How it starts
- 1Free IT Health CheckA short online check that benchmarks your security and business risk and tells you where you stand.
- 2Discovery callAn engineer, not a salesperson. What you have, what is broken, what it would cost to fix, in writing.
- 3OnboardingEverything moves across on a plan, with no gap in cover and nothing lost.
Questions people ask before signing
Why is it free?
Because it is the most useful first conversation we can have, and because the findings sell themselves or they do not. Some businesses take the report to their existing provider and we never hear from them again. That is fine.
What access do you need?
A time-limited, read-only role on your Microsoft 365 tenant, which you grant yourself and which cannot change anything. We tell you exactly which role on the first call and we remove it when the review is done.
Will it upset our current IT provider?
A good one will be pleased to have a written list to work through, and most of the findings are in their gift to fix. If a provider objects to an independent read-only review of your own tenant, that tells you something.
How long does it take?
Twenty minutes on the first call, nothing from you while we review, and the report within five working days. The optional walkthrough is another twenty minutes.
Is this the same as the free IT Health Check?
No. The IT Health Check is a short online questionnaire that benchmarks your overall IT and business risk in a few minutes. This review reads your actual Microsoft 365 configuration and is specific to it. Many businesses do the Health Check first and book this second.
Do you review Google Workspace?
Not as part of this. The review is specific to Microsoft 365. For Google Workspace businesses we look at identity, device and backup questions on a discovery call instead.