Microsoft 365 Security Assessment and Tenant Hardening

Find the gaps an attacker would use, before they do.

I review how people sign in to your Microsoft 365 tenant, who has admin rights, which apps can read your mail, and how email is protected. You get a ranked list of risks in plain language, and I make the agreed changes with you, so the tenant is harder to break into and easier to investigate if something does go wrong.

Ask about a security review See what you receive

Microsoft Certified: Cybersecurity Architect Expert Microsoft 365 Administrator Expert 16+ years with SharePoint and Microsoft 365 Remote, from Vancouver, BC

When a security review makes sense

MFA is turned on, but nobody has checked what still gets around it.
You run Microsoft 365 without an in-house security person, or your tenant was set up years ago and left alone.
You have had a phishing scare, a suspicious sign-in alert, or a request to change payment details that did not feel right.
Your cyber insurance renewal asks about MFA, admin accounts, and email security, and you are not sure of the answers.
People have left, but their accounts, devices, or app access may still be there.
You recovered from a compromised account and want to be sure the same attack cannot work again.

Dealing with a compromised account right now? Go to Microsoft 365 account compromise help instead.

What I review

Sign-in and MFA: Who is covered by MFA and with which methods, legacy authentication, and whether Security Defaults or Conditional Access protects the tenant.
Conditional Access and devices: Policies, gaps and exclusions, who can register or join devices, and whether sign-ins from unmanaged devices or unexpected locations are controlled.
Admin accounts: Global admins and other privileged roles, dormant or shared admin accounts, separate admin accounts for daily work, and emergency access accounts.
App access: Enterprise apps and the permissions users or admins have consented to, apps that can read or send mail for everyone, and who is allowed to grant consent.
Email protection: Anti-phishing and impersonation settings, automatic forwarding to outside addresses, mail flow rules that skip filtering, quarantine release, and SPF, DKIM and DMARC for your domains.
Key mailboxes: Inbox rules, forwarding and delegated access on the mailboxes that matter most, especially the people who approve payments.
Audit readiness: Whether auditing is on and how long sign-in and audit records are kept, so an investigation would have evidence to work with.
Sharing and data exposure: External sharing, guests, and Anyone links in SharePoint and OneDrive, using the same approach as my permissions assessment.

What you receive

A plain-language summary for the owner or leadership
A ranked list of risks, with the evidence behind each one
Recommended settings, with what each change means for staff day to day
Licensing notes: what your current plan already includes, and what needs Microsoft Entra ID P1 or Microsoft 365 Business Premium
The agreed changes made with you, with a before-and-after record of each setting
A short checklist to repeat the most important checks yourself

Gaps I often find

MFA required for some people but not everyone
An old global admin account with no MFA and a password nobody has changed in years
Anyone able to register or join a device to the tenant without extra checks
A third-party app allowed to read and send mail as every user
Automatic forwarding to outside addresses still allowed
Mail flow rules that let whole groups of email skip spam filtering
No DMARC record for the company's own domain
Audit records that would expire before anyone looked at them

Why MFA alone is not the finish line

A small business I helped had MFA turned on and still lost control of a mailbox. The attacker replayed a session that had already passed MFA, registered devices to keep coming back, and read email for weeks before trying a payment fraud. Several gaps on the list above made that easier. Read how I traced the attack and locked down the tenant.

How the review works

1

Agree the scope

A short call about your tenant, your licences, and who needs to be involved.
2

Read-only review

I review settings and logs with a read-only role such as Global Reader wherever possible. Nothing changes without your agreement.
3

Findings

The ranked risks and recommendations, written for both IT and the owner.
4

Hardening

We agree which changes to make. I make them with you and record each one, so a change can be rolled back if it affects something the business relies on.
5

Handover

A walkthrough of what changed, the repeatable checklist, and what to keep an eye on.

Frequently asked questions

What does a Microsoft 365 security assessment include?

A review of how people sign in (MFA, Security Defaults or Conditional Access, legacy authentication), admin accounts, device registration, app permissions, email protection and forwarding, key mailboxes, audit settings, and external sharing. You get a ranked list of risks with the evidence behind each, recommended changes, and help making them.

Is MFA enough to protect Microsoft 365?

MFA is essential, but it protects the moment of sign-in. Attacks that steal a session that already passed MFA, register a device to keep coming back, or trick someone into approving an app can work around it. The assessment checks the controls behind MFA: device and location rules, admin accounts, app consent, and mail settings.

Are Security Defaults enough for a small business?

Security Defaults are a good free baseline. They require everyone to register for MFA, require MFA for admins, and block legacy authentication. They cannot be tuned, and they do not control which devices or locations can sign in. With Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium, Conditional Access gives you that control.

Do we need Microsoft 365 Business Premium?

Not for everything. Many important fixes work on any plan: removing old admin accounts, blocking outside forwarding, restricting app consent, and publishing DMARC. Conditional Access and Microsoft Defender for Office 365 Plan 1 are included in Business Premium. The assessment shows which of your gaps need it, so you can decide. I do not sell licences.

Will the review disrupt our staff?

The review itself is read-only. Changes are agreed with you first, and each recommendation says what it changes for staff, such as an extra sign-in prompt on a new device.

Can you help if we have already been hacked?

Yes. If an account is compromised now, start with containment and investigation rather than an assessment. The account compromise help page explains what to do right away and how I can help.

How is the assessment delivered?

Remotely. I am based in Vancouver, BC, and work with small and mid-sized organizations across British Columbia and elsewhere in Canada.

Want to know how exposed your tenant is?

Send a short note about your Microsoft 365 plan, roughly how many people use it, and what prompted the question. Please do not include passwords or other sign-in details.

Send a note