Microsoft 365 Security Assessment

A Microsoft 365 security assessment is a specialist manual review of your M365 tenant conducted by CREST-accredited consultants. Unlike Microsoft Secure Score, which provides an automated compliance score, a manual assessment identifies exploitable misconfigurations that automated tools cannot detect, such as Conditional Access bypass paths via legacy authentication protocols, overpermissive OAuth application consent grants, and mail forwarding rules silently exfiltrating email to external addresses. Our testers assess every layer of your M365 environment: Entra ID Conditional Access policies, Exchange Online mail flow and delegation settings, SharePoint and OneDrive sharing configurations, Teams external access controls, Intune device compliance policies, and Microsoft Purview information protection settings. The output is a prioritised findings report mapped to industry standard security benchmarks, with a board-ready executive summary and a technical remediation guide.

Our M365 security assessment covers the full suite of Microsoft 365 services: Entra ID (Conditional Access, PIM, B2B/B2C trust, risky sign-in policies), Exchange Online (mail flow rules, delegated access, OAuth app consent, auto-forwarding, EOP and Defender for Office 365 configuration), SharePoint Online and OneDrive (sharing policies, external access, anonymous links, site-level permissions, sensitivity labels), Microsoft Teams (guest access, external federation, app permissions, meeting policies, compliance recording), Intune and Microsoft Endpoint Manager (device compliance policies, enrollment restrictions, app protection policies, conditional launch controls), Microsoft Purview (DLP policies, sensitivity labels, insider risk policies, eDiscovery access controls), and Azure Information Protection (classification rules, label inheritance, encryption configuration, rights management). The specific workloads assessed are agreed during scoping and depend on which M365 services your organisation has licensed and deployed.

Our testers require read-only administrative access to your M365 tenant. The minimum roles required are Global Reader and Security Reader, which provide read access to all configuration settings without granting any write or administrative capability. We do not require Global Administrator access. For Intune assessments, the Intune Service Administrator (read-only) role may be added. All access is provisioned before the engagement, documented in a signed Scope of Work, and the accounts are disabled or removed at the end of the engagement. No changes are made to your tenant configuration during the assessment. We operate in a purely read-only posture unless you specifically request that we attempt active exploitation under controlled conditions (available as an optional add-on to the standard review).

A Microsoft 365 security assessment starts from £3,750 for a single tenant with up to 500 users, covering the core workloads: Entra ID, Exchange Online, SharePoint, OneDrive, and Teams. Larger tenants with 500 to 2,000 users and additional workloads such as Intune and Microsoft Purview typically cost between £6,250 and £10,000. Multi-tenant environments or engagements requiring active exploitation testing are quoted separately after scoping. All engagements are fixed-price: the quote you receive after a free scoping call is the amount you pay, with no day-rate overruns. A retest of remediated findings is included in all engagements.

Microsoft Secure Score is a dashboard metric that tracks your organisation's adherence to Microsoft's recommended configuration settings. It identifies low-hanging configuration weaknesses and provides actionable recommendations, but it has significant limitations as a security assurance tool. Secure Score cannot detect exploitable attack chains, such as a Conditional Access policy that appears correctly configured but has a legacy authentication exclusion that bypasses MFA for a subset of high-privilege accounts. It cannot identify overpermissive OAuth application consent grants that give third-party apps full mailbox and OneDrive access. It cannot assess whether mail forwarding rules are silently exfiltrating email to external addresses. And it cannot evaluate the business risk of a SharePoint sharing policy that exposes sensitive files to anonymous links with no expiry. A manual assessment by CREST-accredited testers identifies these exploitable chains and provides a prioritised remediation roadmap that Secure Score alone cannot produce.