Productized Security Assessment$500 Pilot / SAR 1,875 FlatMada, Apple Pay & Wire Ready
Microsoft 365 & Entra ID Hardening Review
A read-only security baseline audit of your M365 tenant: identity hygiene, admin plane, legacy authentication exposure, high-risk OAuth grants, external forwarding, and unified audit logging — mapped deterministically to CIS M365 v3.0 and NCA ECC controls. Delivered within 48 hours with an executive report, remediation punch-list, and complimentary delta verification.
Identity & Admin Plane
- ✦Global Administrator count & hygiene
- ✦Security defaults / Conditional Access baseline
Authentication
- ✦Legacy authentication exposure
- ✦MFA coverage signals
Apps & Data
- ✦High-risk OAuth consent grants
- ✦External mailbox forwarding rules
- ✦External sharing posture
Management & Audit
- ✦Intune enrollment & compliance
- ✦Unified audit log status
- ✦Microsoft Secure Score trend
🔒 Strictly Read-Only Guarantee: We evaluate strictly via view-only Microsoft Graph API scopes. Governed by formal bilateral Rules of Engagement (RoE) & Mutual NDA. Zero writes, zero agent installation, zero credential retention.
📋 Service Scope & Technical Boundaries Matrix
| Dimension | Specification & Client Safeguards |
|---|---|
| Supported Products | Microsoft Entra ID (Azure AD), Exchange Online, SharePoint/OneDrive, Intune |
| Required Tenant Licenses | Microsoft 365 Business Premium, E3, E5, or standalone Entra ID P1/P2 |
| Access Method & Scopes | Temporary client-owned App Registration restricted to read-only scopes: Policy.Read.All, Directory.Read.All, Reports.Read.All, AuditLog.Read.All |
| Collected Data | Tenant configuration metadata, security policies, and administrative role assignments only |
| Strictly Excluded Data | Mailbox body/attachment content, OneDrive/SharePoint files, and Teams chat messages are 100% excluded and uncollected |
| Service Boundaries | Point-in-time configuration baseline assessment. Not an intrusive penetration test; not an ongoing 24/7 managed SOC |
| Retention & Offboarding | Technical evidence purged 30 days post-delivery. Client receives step-by-step runbook to delete the temporary App Registration immediately after extraction |
| Complimentary Retest | One free delta re-test within 30 days to verify that remediated controls have successfully transitioned to PASS |