Fix this week
Gaps attackers actively exploit: accounts without MFA, legacy authentication left open, standing Global Admin access, risky users nobody has reviewed.
For in-house IT teams
A second opinion on your Microsoft 365 tenant, whenever you want one
You run a busy environment with a small team. M365Assessments gives you an objective review of identity, devices and licensing in minutes, plus a prioritized list of what to fix first.
Assess your own tenant
Set up in the time it takes to get a coffee
No agents, no scripts, no service accounts. If you're a Global Administrator, you can connect your tenant yourself.
Sign in with Microsoft
Use your work account. Your first sign-in creates your workspace.
Add your tenant and run the onboarding wizard
Enter your domain, pick the modules, and approve each one's permissions on Microsoft's consent screen; the wizard then assigns the view-only Global Reader role for you. If you're not a Global Admin, send the link to someone who is.
Run and read
Start the assessment. Small tenants finish in minutes; you'll get a report ranked by severity.
Simplified illustration. Microsoft shows the full list of read-only permissions when you consent.
Prioritized fixes
Know what to fix first, and why it matters
A flat list of 200 recommendations isn't a plan. Findings are ranked by severity and explained in plain English, so you can spend your limited time where it counts.
Plan this quarter
Hardening that closes real risk but needs a change window: device compliance, app protection, guest access settings, update rings.
Tidy up
Hygiene and cost: stale app registrations, unassigned licenses, unused subscriptions and configuration drift.
Track improvement
Show progress, not just effort
Every assessment is saved to your run history. Re-run after a remediation sprint or each quarter, and put the reports side by side.
- A dated record of your tenant's configuration over time
- Two assessments a month on the IT Admin plan: one to find, one to confirm the fix
- Evidence for leadership, auditors and cyber insurance renewals
Run history
High + medium findings per assessment
Done
Sep 12 · Assessment #4Completed in 6 min · 2 high/medium findings
ReportDone
Jun 09 · Assessment #3Completed in 6 min · 4 high/medium findings
ReportIllustrative example.
When IT teams run it
Useful whenever someone asks, "How secure are we, really?"
Cyber insurance & audits
Answer MFA, admin access and device management questions with current evidence instead of guesses.
Budget conversations
Turn "we need more security tooling" into a ranked list of specific gaps leadership can approve.
Before a Copilot rollout
Check licensing, usage and identity hygiene before you put AI in front of your data.
New in the role
Inherited a tenant? Get a baseline on day one so you know what you're working with.
Safe to run in production
Read-only, revocable, and specific about what it reads
Your security team will ask. Here are the answers.
Security & permissions detailsNothing gets changed
The standard modules request only read permissions and the view-only Global Reader role, so the assessment can't modify policies, users, devices or data. Two opt-in modules that Microsoft only offers with broader access are clearly marked and off by default.
Your content stays private
We don't request access to mailbox contents, files, chats or documents. We read configuration.
You stay in control
Delete the M365 Assessment enterprise apps in Microsoft Entra whenever you want, and access ends immediately.
Find out where your tenant stands today
The IT Admin plan covers one tenant with two assessments a month. Sign in with your work account to get started.