MSPs scale clients. We scale audits to match.
Multi-tenant audit, white-label PDFs, Kaseya-aligned. Free 14-day trial.
Why This Matters for MSPs & MSSPs
M365 security assessments have moved from a nice-to-have to a cornerstone MSP offering — driven by insurance, compliance, and client demand.
Assessments Are a Proven Revenue Stream
Security assessments consistently command $1,500–$5,000 per engagement for SMB clients, and substantially more for mid-market. The margin is exceptional when the assessment takes 10 minutes to run and the report is auto-generated. Top-performing MSPs run quarterly assessments as a recurring line item — not a one-time project. Every finding becomes a remediation service opportunity, and every compliance gap becomes a managed security service upsell.
Cyber Insurance Is Forcing the Conversation
Cyber insurers now ask detailed questions about M365 configuration at renewal. Clients without MFA enforcement, without conditional access policies, or with legacy authentication still active are facing coverage denials or premium spikes of 60-200%. MSPs that proactively identify and close these gaps before renewal — and can document the remediation — become indispensable trusted advisors. Assessments give you the evidence base to have that conversation before the insurer does.
Clients in Regulated Verticals Need This Now
Healthcare clients need HIPAA evidence. Financial services clients need SOC 2 or NY DFS documentation. Legal clients need to demonstrate "reasonable efforts" to their enterprise clients. Government contractors need CMMC audit prep. If you serve any of these verticals — and most MSPs serve all of them — you need an assessment platform that can generate compliance-mapped findings, not just a generic security scorecard.
Built for Multi-Tenant Scale
One platform. Every client. Complete isolation between tenants. Customer-ready reports delivered automatically.
Client Portfolio Dashboard
See security posture scores, critical finding counts, and compliance status across every client tenant in a single view. Sort by risk score, filter by vertical, and identify which clients need immediate attention — without logging in to each tenant individually.
- Aggregated risk scoring across all client tenants
- Critical findings prioritized for immediate action
- Trend tracking across quarterly reassessments
Co-Branded Customer Reports
Every assessment generates a professional PDF report with your firm's branding — logo, colors, and contact information. Reports are formatted for two audiences: an executive summary your client's leadership can read in five minutes, and a technical findings section your team can use to prioritize remediation work.
- Your logo and branding on every client report
- Executive summary + technical findings in one document
- Compliance framework mapping included per finding
Complete Tenant Isolation
Client data is isolated at the database level using row-level security — no data from one client tenant can be accessed from another. Each assessment runs read-only against the client's Microsoft environment with no persistent agent installation, no changes to the tenant, and no data stored beyond what is needed for the assessment report.
- Database-level isolation per client tenant
- Read-only Microsoft delegated access — no persistent agent
- Client data never crosses tenant boundaries
Kaseya Partner Alignment
Built for the MSP channel and aligned to the Kaseya partner ecosystem. Run 365 Security Assessment alongside your existing Kaseya stack to add M365-specific depth that general RMM and security tools do not provide. Assessments drop directly into your existing client reporting workflow with no additional tooling or agents required.
- Complements Kaseya RMM and security tooling
- M365-native depth not available in general-purpose tools
- No agent installation — browser-based assessment initiation
What We Audit Per Client
24,000+ expert-curated rules across every M365 service and Azure resource — run against each client tenant in under 10 minutes.
Exchange Online & Email Security
Thousands of rules covering anti-phishing, anti-spoofing, DMARC, external forwarding, transport rules, mailbox audit, and Defender for Office 365 configuration — the area where most SMB client breaches originate.
Entra ID & Conditional Access
MFA enforcement across all users, conditional access policy gaps, legacy authentication exposure, privileged role governance, and guest account risk — the identity controls cyber insurers ask about at renewal.
SharePoint & OneDrive
Anonymous sharing links, external access policies, sensitivity label coverage, and overshared document libraries — the most common data exposure vector in SMB M365 tenants and a consistent finding across MSP client portfolios.
Teams & Collaboration
External guest access, Teams app governance, recording and retention policies, and channel data exposure — an area where SMB clients are frequently overexposed and MSPs can add immediate, demonstrable value.
Intune & Device Compliance
Device compliance policy coverage, MDM enrollment rates, conditional access integration with Intune, and mobile application management policies — essential for clients where BYOD access to M365 data is the norm.
Azure Infrastructure
For clients with Azure workloads — storage account exposure, Key Vault access policies, Azure Defender coverage gaps, network security group rules, and resource encryption posture across the Azure subscription.
10 Frameworks. One Assessment.
Every assessment covers all 10 compliance frameworks automatically — so you can serve clients in any regulated vertical without running separate tools.
What MSPs Find Across Client Portfolios
These are the findings that appear in the majority of SMB M365 tenants — and each one is a documented remediation and upsell opportunity for your practice.
Users Without MFA
Present in the majority of SMB tenants. Each unlicensed or exempted user is a potential account takeover and an immediate cyber insurance issue. Remediation is billable — monitoring is recurring revenue.
External Email Forwarding Rules
Forwarding rules routing email to personal accounts — often set up by an employee years ago and forgotten. Discovery triggers immediate client concern and same-day remediation work that demonstrates your team's value clearly.
Anonymous SharePoint Links
Anonymous "anyone with a link" sharing enabled — meaning sensitive client or business documents are accessible to anyone who receives the URL. Almost universally present in SMB tenants that have not had a proactive security review.
Legacy Authentication Still Active
Legacy auth protocols that cannot enforce MFA — still active on a significant portion of SMB tenants. Blocking legacy auth is a 30-minute remediation that dramatically reduces phishing and credential-stuffing risk, and it is a documented cyber insurance control requirement.
Audit Logs Disabled or Too Short
Unified Audit Log not enabled or set to the default 90-day retention — leaving clients unable to investigate incidents or meet compliance retention requirements. A direct Managed SIEM or log management upsell conversation starter.
Stale Admin Accounts
Former employee or former MSP accounts with Global Administrator or privileged role assignments still active — a significant risk and an immediate action item. Discovery of a former IT provider's admin account is a powerful demonstration of assessment value.
"We assessed our first 12 clients in the same afternoon. The reports were professional enough to hand directly to client leadership — which immediately opened conversations about remediation projects we had never been able to get budget for before. The assessment paid for itself six times over in the first month."
Turn M365 security into a recurring revenue line.
Assess your first client tenant free. See the report quality, the finding depth, and the compliance coverage — then decide if it belongs in your service catalog.
Read-only access — per-tenant data isolation — co-branded reports included.