Microsoft 365 Security Assessment
A detailed review of your Microsoft 365 setup against our Secure Baseline and the Essential Eight, with a clear report and a prioritised plan.
The challenge
You can’t fix what you can’t see
Most Microsoft 365 setups have grown through years of quick fixes, staff changes and default settings. Before changing anything, it helps to know exactly how yours is configured and where the real risks are.
The assessment gives you that picture, in plain English, without changing anything in your environment.
Questions it answers
- Who has admin access, and do they need it?
- Is multi-factor authentication enforced for every account?
- Which devices can reach company data?
- Can email be forwarded outside the business?
- Are files being shared with people outside the business?
- Are you paying for licences nobody uses?
What we review
Every assessment follows the same five areas as our Secure Baseline, plus a licence check.
Identity and access
Multi-factor authentication, Conditional Access, admin roles, guest accounts and sign-in activity.
Devices
Device enrolment, encryption, compliance policies, updates and local admin rights.
Endpoint protection
Microsoft Defender coverage, attack surface reduction rules and alert handling.
Email security
SPF, DKIM and DMARC, anti-phishing settings, mailbox forwarding and suspicious inbox rules.
Data and sharing
External sharing in SharePoint, OneDrive and Teams, and how data is backed up.
Essential Eight and licences
A gap analysis against the Essential Eight, plus a review of the licences you hold and how they’re used.
What you receive
A scored report
Each area is scored and explained in plain English, so you can see where you’re strong and where you’re exposed.
A prioritised plan
A clear list of fixes, starting with the quick wins that reduce the most risk for the least effort.
A walkthrough
We take you through the findings, answer your questions and help you decide what to do next.
How it works
Scope
We confirm your users, devices and goals, and agree the timeframe.
Access
You grant a read-only admin role, so nothing changes during the review.
Review
We check your setup against the baseline and the Essential Eight.
Report
You receive the report, the plan and a walkthrough meeting.
FAQs
Frequently asked questions
Will the assessment change anything in our Microsoft 365?
No. We use a read-only admin role for the review. Nothing is changed unless you ask us to make changes afterwards.
How long does it take?
It depends on the number of users and devices. We’ll confirm the timeframe when we scope the assessment with you.
Do we have to use Zenvia to fix the issues?
No. The report and plan are yours to keep. You can use them with your own IT team or another provider, or ask us to help.
How is this different from your Cybersecurity Assessment?
This assessment focuses on Microsoft 365. Our Cybersecurity Assessment looks more broadly at your whole environment, including networks and other systems.
Related services
You might also need
Secure Baseline
Fix what the assessment finds, then keep it in place every month.
Cybersecurity Assessment
A broader review of security across your whole business environment.
Essential Eight
Understand the Essential Eight and work towards your target maturity level.
Know exactly where you stand
Book a free consultation to scope your Microsoft 365 Security Assessment.