Security hardening / United Kingdom
Microsoft 365 security assessment
Understand the configuration and exposure of your Microsoft 365 environment, then prioritise changes around the identities, information and services that matter.
Last reviewed . Fees in pounds sterling plus VAT.
Know what is exposed. Know what to change first.
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Tenant services, licences and identity complexity
- Depth of evidence review and reporting
- Whether separately approved remediation and retesting are included
The requirement in context
Your cloud provider and your tenant are different responsibilities.
NCSC’s cloud security principles help assess a cloud provider. NCSC separately highlights the need to consider secure configuration. Our scoping approach distinguishes provider evidence from the identity, sharing and administration choices within your tenant.
Primary references
NCSC: cloud security principlesInside the work
A finding needs a dependency and a safe next step.
Fictional assessment record. Actual recommendations depend on the tenant, licences, business need and approved access.
| Area | Evidence to review | Decision before remediation |
|---|---|---|
| Privileged identities | Role assignments and agreed authentication configuration. | Confirm emergency access, licensing, pilot users and rollback. |
| Authorised sending services, domain authentication and mailbox configuration. | Check legitimate delivery paths before tightening policy. | |
| Collaboration | Guest access, sharing settings and selected information locations. | Agree the business need, owner and affected users. |
| Monitoring | Available logs, alert ownership and investigation process. | Check retention, licensing and who will respond. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Understand the configuration and exposure of your Microsoft 365 environment, then prioritise changes around the identities, information and services that matter.
- Agreed tenant scope and secure read-access arrangements
- Identity, privileged access and authentication review
- Email and collaboration configuration assessment
- Data sharing and protection observations
- Prioritised findings, dependencies and an agreed remediation plan
How the work moves forward
Assess first. Change with control.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Agree safe access
Confirm tenant, services, licences, evidence permissions and exclusions.
Assess and prioritise
Document observed settings, risk, dependencies and practical recommendations.
Authorise changes
Agree remediation separately, with testing, rollback and a record of what changed.
A practical starting point
Will you change our tenant during the assessment?
Not without agreement. The assessment and remediation are separate decisions. Findings should explain their evidence, likely impact and dependencies so your team can choose and authorise the next steps.
A fictional review finds a privileged account without the agreed authentication controls. The recommendation records the observed configuration, licensing dependencies and a test-and-rollback approach before any change is made.
Before you commission the work
Your questions.
Clear answers.
Is this a Microsoft 365 audit or a security assessment?
The terminology varies. Our proposal defines the tenant configuration review, evidence and deliverables. It is not a financial audit, penetration test or guarantee that the environment is secure.
Does a high security score prove we are secure?
No single score demonstrates the suitability of every control. We interpret configuration findings in context, including business needs, scope, licences, dependencies and operating responsibilities.
Are Microsoft licences included?
Not automatically. Feature availability and licence requirements must be checked for the tenant before a recommendation or change is agreed. Do not buy licences solely on the basis of a generic checklist.
Do you implement hardening after the assessment?
It can be separately scoped and authorised. The assessment report should help you prioritise work; it is not blanket permission for us to change production settings.
Will this achieve Cyber Essentials or ISO 27001?
An assessment can inform wider security work, but does not itself award either certificate. Establish the required scheme and scope separately.
What should a Microsoft 365 security assessment cover?
Agree the tenant, users, workloads and business risks first. Relevant areas may include Entra identity, privileged access, authentication, Exchange, Teams, SharePoint, OneDrive, external sharing and logging. Confirm which areas are actually included; a Secure Score snapshot is not a complete assessment.
Will you change settings during the assessment?
Assessment and remediation are separate unless explicitly combined. Agree least-privilege access, evidence handling and exclusions. Any change needs approval, licensing checks, impact assessment and a recovery plan. The report should connect findings to evidence, priority, ownership and verification.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Resources for this decision.
NIST CSF 2.0 for UK teams: from outcomes to decisionsLet’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project