365 Security Assessment finds the M365 gaps your MFA doesn't cover.

Our assessment is read-only by design. We request the minimum Microsoft consent permissions required to read your tenant's security configuration. No settings are changed, no emails are sent, and no files are modified.

Our assessment only collects data. No settings are changed, no emails are sent, and no files are modified. Your data is encrypted at rest with AES-256 and in transit with TLS 1.3.

You'll see initial results within minutes as we prioritize the most critical checks first. The complete scan analyzing all 12,000+ tenant signals typically takes:

• Small organizations (<500 users): 15-30 minutes
• Mid-size (500-5,000 users): 30-60 minutes
• Enterprise (5,000+ users): 1-3 hours

Subsequent scans are much faster since we only track changes from your baseline. Microsoft throttling policies can occasionally extend scan times for very large tenants.

We request the minimum Microsoft consent permissions required to read your tenant's security configuration across Microsoft 365 and Azure. All access is read-only — our audit collects evidence, never changes settings.

• • Read-only access to your identity, device, and security policy configuration
• • Read-only access to your email, SharePoint, and Teams security settings
• • Read-only access to your Azure resource configuration
• • Directory roles required to read security-sensitive properties

During onboarding, we provide a pre-populated Microsoft consent URL with all required permissions for one-click admin approval. Our assessment only collects data — no changes are ever made to your environment.

Your security data is stored in Azure with enterprise-grade protection:

• AES-256 encryption at rest for all data
• TLS 1.3 for all data in transit
• Encryption keys stored in Azure Key Vault, isolated from application data
• Private endpoints—no public internet access to storage

Raw scan data is retained for 30 days in hot storage, then moved to encrypted archive. You can request complete data deletion at any time. We're currently pursuing SOC 2 Type II certification.

We go 120x deeper. Microsoft Secure Score checks approximately 200 recommended settings. We analyze 12,000+ tenant signals across 242 security modules covering:

• Exchange Online (4,030 rules)
• Microsoft 365 identity & collaboration (5,609 rules)
• Azure Resources (4,593 rules)
• Entra ID (2,362 rules)
• SharePoint, Teams, PowerApps, and more

We also pull your Secure Score and Azure Security Score for a unified view—then correlate findings across services to identify attack paths Microsoft doesn't detect.

Yes. The 365 Security Assessment partner program is built for System Integrators, MSPs, and Microsoft-focused service providers.

• Flat 20% referral path on qualifying paid subscription referrals
• Assessment-led prospecting motion for Microsoft 365 clients and prospects
• Co-branded report templates
• Every finding = remediation revenue for your team

Referral eligibility and payout timing are confirmed in the partner agreement before launch.

Contact our partner team to learn more about becoming a 365 Security Assessment channel partner.

Because the product sells itself. MSPs who scan 3+ tenants see exactly what the full platform does — and upgrade when their clients demand more. We're betting on the product, not the pitch.

Most tenants surface their first critical finding within 14 minutes of consent. The full assessment completes in well under an hour for SMB tenants and within a few hours for enterprise tenants with thousands of users — no agent installation, no infrastructure to configure.

Defender XDR is excellent at detection and response — finding threats after they enter. We're a posture audit — finding the configuration gaps that let threats in to begin with. E5 customers consistently fail audits because nobody is checking their tenant configuration against deep security checks and 12 compliance frameworks. We complement Defender, we don't replace it.

Yes. MSPs and multi-entity organizations can run assessments across an unlimited number of tenants on paid plans. The MSP Multi-Tenant dashboard rolls findings up into a single view so you can prioritize remediation work across customers — useful for both internal IT teams managing acquisitions and MSPs serving many clients.

Your assessment data, scanner application registration, and report history are preserved. You can upgrade in-app at any time to resume full access — your historical evidence comes with you. We do not delete anything at trial expiry; the view simply becomes read-only locked until upgrade.

No. Your evidence is yours. We process it solely to generate your assessment reports. We do not sell, share, or use customer evidence for AI training. Aggregate anonymized statistics (e.g., "X% of tenants miss MFA enforcement") may inform our annual industry reports, but never with customer-identifying detail.

Ten frameworks: CIS Microsoft 365 Foundations Benchmark, CMMC 2.0 (Levels 1 and 2), FedRAMP Moderate and High, GDPR, HIPAA Security Rule, HITRUST CSF, ISO 27001/27017/27018, NIST SP 800-53 Rev 5, PCI-DSS v4.0, and SOC 2 Type II Trust Services Criteria. Every finding carries the specific control number from each relevant framework so auditors accept your evidence directly.

Three deliverables: an executive summary dashboard (board-ready), an engineering summary dashboard (remediation-ready), and a compliance evidence pack (auditor-ready). All three are exportable to PDF, viewable in-app for continuous monitoring, and tagged with MITRE ATT&CK technique IDs for the highest-priority findings.