Skip to content

Microsoft Cloud Security Assessment

Know where your Microsoft environment stands before an auditor asks.

You get a written answer, at a fixed price, to how secure your tenant is and what to fix first. We review Microsoft 365, Entra ID, Intune and Azure against the Microsoft Security Baselines, the CIS Benchmarks and NIS2.

Book an introductory call How it works

Example of a findings report, collected read-only: MFA for all accounts is partially met, emergency accounts are in place, time-limited admin roles and an enforced DMARC policy are open. First comes: limit MFA exclusions to emergency accounts. Each finding names its location, priority and effort.

For
Companies with 50 or more employees on Microsoft 365
Scope
Microsoft 365, Entra ID, Intune, Azure on request
Access
Read-only, removed afterwards
Result
Finding per control, roadmap, workshop with management and IT
Price
€3,500 to €5,000 excl. VAT, fixed price by environment size

Sound familiar?

Who is the gap assessment for?

How secure are we really?

Nobody can prove that MFA covers everyone or who holds admin rights.

"All green", but no evidence

You want a second opinion before an audit or renewal.

Phishing despite Microsoft 365

Often caused by default settings and a DMARC policy, the rule for forged sender addresses, that enforces nothing.

From tenant to finding

How does your tenant become a finding per control?

We read the configuration without changing anything and compare it with baselines. Every finding names where it sits. Switch the view to see the order in which to act.

Choose a view
Your tenant Microsoft 365, Entra ID, Intune, Azure
read-only
Compared with baselines Microsoft Security Baselines, CIS Benchmarks
  1. 1 MFA for all accounts Location: Entra ID › Conditional Access › Exclusions Limit exclusions to emergency accounts MFA for all accounts Partial Priority high Effort low
  2. Emergency accounts in place Location: Entra ID › Roles › Global Administrator Emergency accounts in place No action needed Met Met
  3. 2 Time-limited admin roles Location: Entra ID › Privileged Identity Management Activate admin roles via PIM only when needed Time-limited admin roles Open Priority high Effort medium
  4. 3 DMARC enforced Location: DNS › DMARC record › p=none Enforce DMARC step by step DMARC enforced Open Priority medium Effort low
  5. 4 Guest accounts reviewed Location: Entra ID › External Identities Remove inactive guests, schedule reviews Guest accounts reviewed Partial Priority medium Effort low
  6. Compliant devices only Location: Intune › Compliance policies Compliant devices only No action needed Met Met

Every finding is mapped to NIS2, ISO/IEC 27001 and BSI IT-Grundschutz. A senior architect puts deliberate exceptions in context. Ordered by risk and effort, agreed with management and IT in the workshop.

Example: your tenant with Microsoft 365, Entra ID, Intune and Azure is collected read-only and compared with the Microsoft Security Baselines and CIS Benchmarks. Finding per control with location: MFA for all accounts partial, emergency accounts met, time-limited admin roles open, DMARC enforced open, guest accounts reviewed partial, compliant devices only met. Actions by priority: 1 limit exclusions to emergency accounts, 2 activate admin roles via PIM only when needed, 3 enforce DMARC step by step, 4 remove inactive guests.

What does the assessment check?

Identities and MFA

Conditional Access, exclusions, emergency accounts and legacy sign-in methods.

Privileged roles

Permanent admin rights, missing PIM, exposed Azure resources.

Mail protection

Protection policies plus SPF, DKIM and DMARC for your domains.

Sharing and guests

External sharing, anonymous links and forgotten guest accounts.

Device compliance

Intune enforcement, access only for compliant devices.

Logging and backup

Unified audit log, retention and tested recovery.

How does the gap assessment work?

  1. Together

    Kick-off

    Agree scope, frameworks and contacts.

  2. Read-only

    Collection

    Via an app registration, removed afterwards.

  3. Senior architect

    Assessment

    Deliberate exceptions are put in context.

  4. In writing

    Report

    Priority and effort per finding, control mapping, roadmap.

  5. Together

    Workshop

    Management and IT, your provider is welcome.

What scope does your assessment need?

In 30 minutes we clarify scope, then you receive a fixed-price proposal.

Book an introductory call

What changes after the assessment?

Today

  • "All green" without evidence
  • No overview of exceptions
  • No answers to auditor questions
  • No order for measures

Afterwards

  • Finding per control with location
  • Prioritised roadmap with effort
  • Management summary for the board
  • Evidence snapshot at the review date

Further reading: Security assessmentsActive Directory assessmentManaged SecurityMicrosoft 365 hardeningNIS2 with Microsoft 365Blog: Checking your IT providerBlog: SPF, DKIM and DMARC

Frequently asked questions

What is a Microsoft 365 security assessment and what does it check?

A structured review of the security settings in your tenant, from identities to backup. Yardsticks are the Microsoft Security Baselines and CIS Benchmarks, mapped to NIS2, ISO/IEC 27001 and BSI IT-Grundschutz.

How much does a Microsoft 365 security assessment cost?

A fixed price that depends on size and scope and is agreed before we start. After the introductory call you receive a proposal with price, duration and deliverables.

Do we need a penetration test or an assessment?

The assessment shows whether your settings match the target state, the pentest whether weaknesses can be exploited. If you do not know where your tenant stands, start with the assessment.

Can the assessment replace our IT provider?

No. It is an independent second opinion; your provider can implement the measures directly.

Where does your tenant stand today?

Evidence for auditors and insurers; your data stays with you.

Book an introductory call