Microsoft 365 security assessment.

When this assessment helps

A growing Microsoft 365 environment can accumulate stale accounts, broad application permissions and inconsistent device policies. IT leaders need to know which of those conditions are present, what evidence supports them and which changes deserve attention first.

This assessment supports organisations reviewing their tenant, preparing a security improvement programme or bringing a newly connected environment into regular reporting. Start with the business services and user groups that matter to you, then agree which parts of the tenant will be assessed.

What can be included

The supported Microsoft connection can collect directory and group information, administrative role assignments, application consent and credential-expiry context, Conditional Access policies, MFA registration, and available sign-in and audit activity. These sources help explain access exposure beyond a single headline score.

Depending on the agreed permissions and licensing, the scope can also include Intune device inventory and compliance, Defender alerts and incidents, Microsoft Secure Score, SharePoint sharing context and selected mailbox evidence. Specific Exchange and Purview checks require separate access arrangements. We establish that coverage before relying on a finding.

What the assessment gives you

ThreatShield brings collected evidence into assessment reporting, technical findings and leadership priorities. The useful output is a reviewable account of the conditions observed, the systems or identities affected, and the work needed to investigate or improve them.

For example, an MFA registration gap is a reason to review the affected accounts and access policies. Registration alone does not establish that MFA is enforced at every sign-in. Keeping those distinctions visible helps the team choose an appropriate action and define the evidence needed to confirm it.

Permissions, coverage and next steps

Begin with the assessment questions, confirm the authorised tenant and review the requested access. Read-only Microsoft collection is available for assessment; it is distinct from permission to administer accounts, policies or devices. Some deeper checks require additional permissions or separately authorised administrative access.

Licensing, consent, retention and collection health affect what can be assessed. An unavailable feed is a coverage gap. After reviewing the results, agree owners and priorities, authorise any change through the appropriate process, and collect fresh evidence for the next review.

How it works, step by step

1. Scope and authorise. Agree the authorised tenant, the questions that matter to your team and the read-only Microsoft consent needed to collect evidence.
2. Collect read-only evidence. Gather identity, access, policy, device and available activity signals without changing anything in the tenant.
3. Analyse against references. Review the observed conditions against CIS-aligned and NIST CSF references, and record where a feed is unavailable as a coverage gap.
4. Prioritise with owners. Turn findings into leadership priorities and technical actions, naming the affected identities, policies or devices for each one.
5. Confirm and re-collect. Authorise any change through your own process, then collect fresh evidence at the next review to check the outcome.

Conditions a Microsoft 365 assessment can surface

Coverage depends on your licensing, consent and collection health. Where the evidence is available, a Microsoft 365 security assessment can highlight conditions such as:

• Stale or unused accounts, and privileged accounts that no longer need their level of access.
• MFA registration gaps across users and administrators — registration is not the same as MFA being enforced at every sign-in.
• Broad or unreviewed application (OAuth) consent grants and long-lived client secrets.
• Conditional Access coverage gaps for administrators, legacy authentication or risky sign-ins.
• Device-compliance and Intune posture inconsistencies measured against your own policy.
• External SharePoint or file-sharing exposure that has not been reviewed.
• Microsoft Secure Score movement read alongside the underlying identity, policy and device evidence.

Each item is a reason to review the affected accounts, policies or devices — not a proof of compromise. What is included depends on the agreed scope and the feeds your tenant makes available.

Framework alignment

The assessment organises Microsoft 365 findings against widely used references so a technical team and its leadership can discuss the same baseline. It draws on CIS-aligned control references and NIST Cyber Security Framework perspectives, and the results can inform a UK Cyber Essentials review of user access, multi-factor authentication and device controls.

A framework label organises the discussion; it is not a certification or an assurance that a control is effective. Formal certification requires the applicable scope, evidence and an independent assessment. ThreatShield keeps the evidence behind each mapped observation so that distinction stays clear.

Questions about Microsoft 365 security assessment

Can we start with a read-only assessment?
Yes. ThreatShield supports a read-only Microsoft collection tier. The proposed scope should identify checks that need additional permissions or separate administrative access before consent is requested.

Does Microsoft Secure Score cover the whole assessment?
Secure Score is one source of context. The assessment can also use identity, policy, device and activity evidence, with coverage limited to the sources available in your tenant.

Will the assessment automatically change our tenant?
Read-only assessment access does not authorise changes. Remediation requires the relevant permissions and the applicable approval and action policies.

Is a read-only Microsoft 365 security assessment available in the UK?
Yes. ThreatShield is part of ITS Consulting, which operates in the United Kingdom and the United States. A read-only Microsoft 365 assessment can be scoped for UK organisations and for MSP partners delivering it to their own clients.

What does a Microsoft 365 security assessment involve, and what does it cost?
Scope, timeline and cost depend on the size of the tenant, the feeds connected and whether you need a one-off review or ongoing reporting. We agree the scope from your assessment questions and the authorised tenant before any commitment, so there are no surprise charges.