Your Microsoft security score says you’re fine. We check whether that’s true.

You should — it’s free and it’s useful. But it grades what you’ve configured, not what’s enforced. It will credit you for multi-factor authentication your staff have registered even when no policy actually requires it, which is the most common serious problem we find. It also has no check at all for mailbox rules forwarding your mail outside the company, app passwords that never expire, or outside apps holding admin rights — three of the things most likely to hurt you. And it hands you an unordered to-do list; some of its own recommendations conflict with each other, and on a smaller license, doing one of them in the wrong order can lock you out of your own tenant.

For the assessment, you approve a read-only application. It is incapable of changing anything in your tenant, and no software is installed anywhere.

If you later hire us to fix things, that’s a second, separate application with write access. You approve it in writing, for a defined window of work. When the work is finished, that access deletes itself — we don’t rely on you remembering to revoke it. You can confirm it’s gone yourself in your Microsoft admin center under Enterprise Applications, and we’ll show you exactly where to look.

No. Nothing is installed, no passwords change, and nobody is locked out or prompted for anything. The assessment reads configuration only. Most clients run it during a normal business day and their team never knows it happened.

This isn’t a referendum on your IT provider — they were handed the same misleading score you were, and most of what we find was never on their to-do list because Microsoft never flagged it. Think of it the way you’d think about your accountant and your auditor: different jobs, and the second one is more useful precisely because it’s independent. We’re happy to deliver findings directly to your IT provider so they can do the fixing.

We tell you plainly, rank it by what it would actually cost you, and give you a safe order to fix it. The report is yours either way. You can hand it to your own IT people, work through it yourself, or hire us — and there’s no pressure toward the last one. If we find evidence of an active compromise, we’ll tell you immediately rather than waiting for the report.

Partly, and we’re specific about which part. We can evidence the identity controls carriers ask about — multi-factor enforcement, admin account separation, legacy sign-in, external forwarding, who holds privileged access — with a dated third-party report rather than a checkbox. We cannot answer questions about your backups, endpoint protection, network, staff training, or incident response plan, because those aren’t in Microsoft 365. We’ll hand you a worksheet for those instead of guessing, because a wrong “yes” on an application is a denied claim two years later.