Microsoft 365 Security Assessment & Hardening
Turn the Microsoft 365 you already pay for into a properly secured tenant: MFA everywhere, Conditional Access, Defender, backups checked, Secure Score up.
Most businesses run Microsoft 365 with the defaults. That means shared admin accounts, MFA that is 'on' but not enforced, no Conditional Access, mailbox rules nobody audits and a Secure Score in the 30s. We harden the tenant to a documented baseline in days, not months — using licences you already own wherever possible.
What the assessment and hardening covers
- Identity: phishing-resistant MFA for admins, MFA enforced for everyone, legacy authentication blocked, break-glass accounts, admin roles cleaned up
- Conditional Access: a small, tested policy set (device compliance, location, risk, session controls) instead of Security Defaults
- Email: Defender for Office 365 anti-phishing, Safe Links and Safe Attachments, SPF/DKIM/DMARC set correctly, forwarding rules blocked
- Devices: compliance policies, disk encryption, Defender for Business onboarding and alerting
- Data: sharing settings, guest access, sensitivity labels where they add value, backup verified
- Evidence pack mapped to Cyber Essentials / Cyber Essentials Plus, ISO 27001 Annex A or your insurer's questionnaire
How it runs
- Day 1: read-only assessment of the tenant with a scored report and a prioritised fix list
- Days 2–5: changes applied in a safe order with a rollback path, users warned before anything they will notice
- Handover: what changed and why, a one-page 'how to stay secure' guide, and optional monthly check-ins
Typical outcomes
- Secure Score from ~35% to 75%+ in the first week
- MFA on every account, Conditional Access replacing Security Defaults
- Cyber Essentials self-assessment passed first time
Frequently asked
We only have Business Basic / Standard licences. Is that enough?
Mostly yes. MFA, Conditional Access basics, anti-phishing and secure sharing are all available on Business Premium, and a good deal of it on Standard with Entra ID P1. We tell you the one or two upgrades that genuinely matter rather than selling you E5.
Will our staff notice?
They will be asked to register MFA if they have not, and occasionally to sign in again. We schedule changes, send the comms for you and stay on call the morning after.
Do you work with our IT support company?
Often. We do the security design and hardening; your MSP keeps doing the day-to-day. Everything is documented so they can support it.
Not sure where your business stands?
Book a free 30-minute call. We will tell you the three things we would fix first — no report to buy, no hard sell.