Free · Self-serve · Read-only · No call required
Review your Microsoft 365 security with read-only access. Available evidence and licences determine which controls can be assessed.
You need a Microsoft 365 Global Administrator to approve the read-only consent. You can revoke it yourself at any time.
The assessment catalogue
Identity, email, Teams, sharing, Defender, devices and more. The free assessment reads your tenant with read-only consent. Every result includes its evidence and confidence.
Measured coverage depends on your licences and the evidence available. Unavailable or uncertain controls are distinguished from confirmed failures.
101 controls · 11 domains
Point at a cell, or tab in and use the arrow keys, to read the control it checks.
After the assessment
Your first successful live Microsoft 365 assessment starts a 15-day dashboard trial. Exploring sample data first does not use up that live trial. No card is required and there is no automatic paid conversion.
If you do not continue
Your stored score, grade, headline counts and reading date remain visible. Existing ticket history stays available.
New scans, detailed findings and evidence, remediation guidance, drift and new dashboard tickets pause when the trial expires. Your Microsoft services keep running; trial expiry does not change their settings.
Access and data when you leaveFor your own IT team
US$99 / tenant / month
Continue using detailed evidence, remediation guidance, repeat assessments, drift and assessment-related tickets. The same read-only assessment access applies.
Request activation from Your pack in the dashboard. Your request is saved with a reference and progress history in Service requests. We arrange an invoice and confirm activation. General IT helpdesk and changes performed for you are separate managed services.
View dashboard pricingFor ongoing engineering support
Agree an engineer-led service for your Microsoft cloud, users and devices. We scope the support, changes and automation you want before requesting management access.
Published managed plans start at US$89 per user/month, with a 10-user minimum. Microsoft licences and onboarding are separate. A dashboard subscription does not automatically start this service.
See the managed onboarding stepsNeed help choosing after your trial expires? You can still request pack activation or contact us directly.
Why this one is different
Review the evidence, costs and access boundaries before deciding what to do.
Failing controls are ranked by severity, with the evidence behind each verdict. Controls that need a licence you do not have are listed separately as not assessed, and never counted as passing or failing.
If we cannot measure a control in your tenant, it is reported as not assessed. It is never quietly counted as a pass, and never inflated into a failure to make the report look busy.
The assessment app reads settings and security signals. It does not write to your tenant. Your Global Administrator grants the consent, and can remove it from the Azure portal at any time without contacting us.
The product
Screenshots and a recorded walkthrough using an illustrative sample tenant. Your dashboard shows the evidence available for your tenant; features and layout can differ from this recording.
How it works
From the moment you click start to the moment you are looking at findings.
Tell us who you are, then use your work account. No new password and no software to install.
Microsoft shows the exact read-only permissions on its own consent screen. Nothing runs until an admin approves it there.
We read available configuration through Microsoft Graph and evaluate a catalogue of 101 controls. Coverage depends on your licences, permissions and available evidence; unsupported checks are marked not assessed.
Findings, evidence and priorities in the browser, ready to work through or hand to whoever owns the tenant.
Scope
Worth reading before you take this to whoever owns your tenant. It is the question they will ask.
What you get
No slide deck, no maturity score with nothing behind it.
Live findings reference the configuration and evidence we can retrieve. Unavailable or unverified checks are disclosed as not assessed, so the catalogue is not a promise of 101 measured results.
You can see how sure we are of each result and what evidence it came from, so you know which items to act on and which to check first.
Findings are mapped to CIS, CISA ScubaGear and NIST CSF, which makes the report usable in an audit conversation or an insurance questionnaire.
Ordered by risk, with the changes that cost nothing on your current licences at the top.
Becoming a client
Start a managed onboarding request in the dashboard. Your engineer records the scope, terms, access review, pilot and handover evidence so you can follow progress. Completing the assessment, paying for the Basic pack or recording a milestone does not automatically grant management permissions.
Review the findings together. Agree which users, tenants, subscriptions and devices are in scope, what is excluded, and the service and licence costs.
Name your technical and billing contacts and who may approve changes. Confirm support hours, response targets, escalation, cancellation and data-handling terms in your service order.
Your administrator reviews each application, delegated role or device tool, its purpose, scope and revocation method. Assessment consent does not cover these additional permissions.
Check the connections, ticket route, notifications and agreed procedures with a pilot. Record the baseline, change windows and rollback approach before management starts.
Track requests and findings, review changes and their verification, and revisit service coverage with your engineer. The service order sets the reporting cadence and review schedule.
Permissions & automation
There is no single “autonomous MSP” permission. Read-only assessment consent, paid service activation and permission to make a change are separate decisions. The exact management request depends on your chosen workloads and tasks.
The paid dashboard uses the same assessment app; it does not request write access simply because you pay. The catalogue below matches the platform onboarding list. Review Microsoft's actual consent screen before accepting.
Directory objects, memberships, privileged roles, registered authentication methods, app grants and licences. Authentication method records can include registered phone numbers.
Policy and sharing settings, sign-in/audit records, usage reports and Microsoft security signals. Logs and reports can identify individual accounts.
Mailbox configuration can include the text of automatic out-of-office replies, working hours and language. This is broader than a simple configuration flag; it does not grant Mail.Read or Mail.Send.
Risk detections, Intune device/configuration records and Defender hunting data where the tenant's licences and access support them. Unavailable coverage is disclosed in the results.
Read-only access can still return personal information in logs, directory records and mailbox settings. We do not request permissions to read email messages, documents or chats. Microsoft Graph permission definitions explain the scope of each grant.
Human administrators may use a customer-approved delegated relationship such as GDAP where the partner relationship supports it, or separately agreed tenant roles. GDAP is granular and time-bound; it does not automatically authorize a separate unattended application.
An unattended application needs its own explicitly consented API permissions. For example, changing Conditional Access can require Policy.ReadWrite.ConditionalAccess; updating Intune configuration can require DeviceManagementConfiguration.ReadWrite.All. Those permissions can affect access or many devices. They are examples to review for a selected task, not a bundle requested by this assessment.
Before agreeing a management grant, review the named app or role, who will use it, affected resources, permitted actions, expiry/review date and how to remove it. Do not send us an administrator password through an enquiry form.
Microsoft's GDAP overview · Application permission reference
Azure uses a separate read-only snapshot for each connected subscription. An authorized customer administrator starts collection in the dashboard. The results show the resource, security and cost evidence Azure actually returns, with source times and any missing permissions or coverage. Opening a page or saving connection details does not start collection.
Microsoft 365 consent does not cover Azure resources. Azure needs separately reviewed access at the agreed scope; cost and security APIs may require additional permissions or product availability. A visible subscription does not prove a particular role or complete assessment coverage. Read-only collection does not change resources.
Managed Azure work needs separately reviewed Azure RBAC roles at the agreed subscription or resource-group scope. Some management roles also expose data or keys, so “resource management” should not be read as a promise of no data access. We must review the actual roles for your service.
The browser assessment installs no endpoint agent. Device management may require Intune enrolment, and remote support or backup services may require a separately approved tool, app or agent. The onboarding scope should name the devices, data accessible, remote-session controls, retention and removal procedure before deployment.
The platform supports Microsoft 365 read-only assessments and scheduled rescans for eligible, connected tenants. Azure snapshots are collected separately when an authorized administrator requests them; they are not continuous monitoring or a comprehensive control assessment. Support requests are recorded for review and do not guarantee an automated response.
Unattended tenant remediation is not enabled through this trial or the Basic pack. Managed changes require an agreed procedure and the necessary access and approval. Buying a plan, granting read access or pressing Request help is not approval to alter a policy, disable a user or wipe a device.
Agree named approvers, any narrowly defined pre-approved procedures, maintenance windows and escalation contacts in your service scope. Authorized customer approvers can review a specific proposal in the dashboard and record approval or denial. Review its target, expected impact, verification and rollback plan before deciding.
Execution is separate and currently paused. Recording approval does not mean a change has run. A request, an approved proposal and a verified completed change are different states; ask for completion evidence before treating a recommendation as implemented.
Basic pack tickets cover assessment findings and posture. General user support, continuous monitoring, out-of-hours response and incident containment depend on the managed service you agree. Confirm coverage hours, response targets, contact channels, reporting cadence and the route for urgent incidents before go-live. A response target is not a guarantee of resolution time.
Trial expiry does not automatically revoke an existing Microsoft grant or delete stored results. To withdraw assessment access, your administrator can remove the assessment enterprise application in Microsoft Entra. Separately review any Azure delegation, GDAP relationship, management app or device tool added for a managed service.
Billing cancellation, access revocation and data deletion are separate steps. Agree notice periods, handover, export and retention/deletion terms in the service order. Submit a data export or deletion request in the dashboard’s Service requests area, which remains available after trial expiry. An authorized administrator can prepare a short-lived, signed-in download of the supported portal records for their export request. Its manifest identifies what is included and what still needs separate collection from providers, files or backups; a portal download does not complete a whole-service export.
You receive a request reference and can follow up there. For enquiry records or help signing in, contact us directly. Our team verifies authority, holds, provider results and the agreed policy before recording wider fulfilment. Submitting a request does not itself delete data, revoke access or cancel billing.
Never include passwords, tokens or private keys in the public form.
Review our trust and service boundaries, privacy policy and terms, or ask for a service-scope review.
The assessment uses read-only Microsoft Graph permissions and does not change tenant settings or install device software. Your administrator should still review the consent and data scope before connecting production: directory records, logs and mailbox settings can contain personal information. Coverage and scan time depend on the tenant and available APIs.
The permission catalogue on this page lists the read-only application permissions used by platform onboarding, including directory, policy, logs, mailbox settings and licensed security/device services. Review the exact grants on Microsoft's consent screen. Buying a plan does not grant write access; managed operations require separate agreement and access.
Your administrator can remove the assessment enterprise application in Microsoft Entra. Trial expiry alone does not revoke it. Any separate Azure delegation, managed-service app or GDAP relationship must be reviewed separately. Contact contact@mscloudsupport.net to arrange stored-data export or deletion; revoking access and deleting our stored results are separate steps.
Checks that need unavailable licences or evidence are marked not assessed rather than counted as passes or failures. Available improvements and their licence requirements appear in the findings. A framework mapping helps organise the review; it is not a compliance certification.
A Microsoft 365 Global Administrator reviews and approves the read-only application consent. They do not need to stay signed in for background assessments. Managed onboarding also needs a technical owner, billing contact and named change approvers.
No. Your first successful live assessment starts a 15-day trial with no card and no automatic charge. After expiry, score summaries and existing ticket history remain available, while detailed findings, repeat scans and new dashboard tickets pause. You can request paid activation or discuss a separate managed service when ready.
We store assessment results and evidence to provide the dashboard and history. These can include personal information from directory records, sign-in logs, authentication methods and mailbox settings, including automatic-reply text. Review the permission catalogue and privacy policy, and discuss any residency or retention requirements before connecting.
Something not covered here? Ask us before you connect anything.
Read-only, revocable, and free. If you would rather have a person walk your tenant with you first, book a 30-minute call with the engineer instead and we will do it together.
