Assessment · Microsoft 365 security
Find out how exposed your Microsoft 365 tenant really is
A fixed-scope, read-only review of the controls attackers test first: sign-in protection, administrator accounts, email authentication, external sharing and alerting. You receive a severity-rated findings report, a remediation roadmap and a readout meeting.
Proposed price
$499.00one-time fee
- SKU
- PC-ASSESS-M365-001
- Billing
- one-time fee
Proposed pricing pending approval. Your final price is confirmed in a written quotation.
At a glance
- Product ID / SKU
- m365-security-assessment / PC-ASSESS-M365-001
- Pricing basis
- Proposed fixed fee of CAD 499 per tenant, before tax; confirmed in a written quotation and pending business approval
- Billing frequency
- One-time
- Delivery method
- Remote, using read-only Global Reader and Security Reader roles; typically one to two weeks from access to readout
- Purchase mode
- Checkout now once price and terms are approved; until then, request it from the store and we confirm by written quotation
- Eligibility
- One Microsoft 365 tenant with up to about 200 licensed users on Business or Enterprise plans
- Not included
- Remediation, penetration testing, on-premises Active Directory and third-party applications
What this assessment examines
Most Microsoft 365 compromises at small and mid-sized businesses begin with a stolen password, a forgotten administrator account or a forwarding rule nobody noticed. This assessment looks specifically at the security controls in your tenant that decide whether those events become an incident: how users sign in, who holds administrative rights, how email is authenticated and filtered, how files are shared outside the organization, and whether anyone would be alerted.
The work is read-only. We do not change settings during the assessment, so there is no risk of locking users out or disrupting mail flow. Instead, every finding is recorded with the evidence we saw, why it matters to a business of your size, and the change we recommend. Microsoft Secure Score is used as one input, but the report explains which recommendations are worth acting on for your licences and which you can safely defer.
What you receive
Findings report
A written report covering each control area, with every finding rated Critical, High, Medium or Low based on likelihood of exploitation and business impact.
Remediation roadmap
Findings grouped into a 30, 60 and 90-day plan, with the licence each fix requires and whether your team or a provider would typically perform it.
Administrator and sign-in summary
A list of privileged accounts, accounts without multifactor authentication, legacy authentication usage and sign-in policies currently in force.
Readout meeting
A 45 to 60-minute video call to walk through the critical and high findings and answer questions from owners or managers.
Assessment scope
Reviewed
- Multifactor authentication registration and enforcement, security defaults and Conditional Access policies
- Administrator role assignments, break-glass accounts and use of privileged roles for daily work
- Legacy authentication and risky sign-in configuration
- SPF, DKIM and DMARC records for your sending domains
- Anti-phishing, anti-malware and Safe Links or Safe Attachments policies where licensed
- External sharing settings for SharePoint, OneDrive and Teams, including guest access
- Mailbox auditing, unified audit log status and automatic external forwarding
- Secure Score recommendations, interpreted for your licence level
Not part of this assessment
- Making configuration changes or remediating findings
- Penetration testing or simulated attacks
- On-premises Active Directory, servers and firewalls
- Device security posture (see the Endpoint Security Assessment)
- Third-party SaaS applications connected to the tenant beyond listing their consent grants
- Legal, regulatory or compliance opinions
What we need from you
- A named contact who can approve access and answer questions about how staff work
- Temporary assignment of the Global Reader and Security Reader roles to a Podium Catchers account, or a guest account you create
- A list of the domains you send email from, including any marketing or invoicing platforms
- About 30 minutes for a short kickoff call to confirm business context
- Notice of any planned changes, such as a migration, that would affect the findings
Who this is for
A good fit
Organizations of roughly 5 to 200 users on Microsoft 365 Business Basic, Standard or Premium, or Office 365 and Microsoft 365 E3 or E5, that want an independent view of tenant security.
Needs a custom quote
Multiple tenants, hybrid identity with complex synchronization, more than about 200 users, or a request to include remediation. These are scoped separately before purchase.
Consider a different product
If your concern is licence waste, stale accounts or Teams sprawl rather than security controls, the Microsoft 365 Tenant Review is the better starting point.
Options and pricing basis
This is a single fixed-scope product with no quantity selector: one tenant, one report, one readout. The proposed price is CAD 499 before applicable tax, and it is a proposal pending business approval. Your written quotation confirms the price before any payment.
If you want us to fix what we find, remediation is quoted afterwards as a separate project or folded into Microsoft 365 Administration or a managed IT package. Buying the assessment does not commit you to either.
How delivery works
Timing below is typical, not guaranteed, and starts when read-only access is in place.
Kickoff
A short call to confirm domains, licence plans, key business applications and anything you are already worried about.
Access
You assign read-only roles. We confirm we can see the admin centres we need and nothing more.
Review
Over roughly five business days we collect configuration evidence, check DNS records and analyse sign-in and audit settings.
Report and readout
You receive the report, then we walk through it together. Afterwards you remove our access, or we confirm its removal with you.
Terms to know
Pricing, scope and service terms are drafts awaiting business and legal approval and will be presented in full before checkout. The report reflects configuration at the time of review; it is a point-in-time assessment, not ongoing monitoring, and it does not certify compliance with any standard. Taxes are calculated at checkout.
Frequently asked questions
Will the assessment change anything in our tenant?
No. We use read-only roles and collect evidence only. Any change is your decision after the readout, and remediation is quoted separately.
How is this different from Microsoft Secure Score?
Secure Score lists generic recommendations. We check which ones apply to your licences and ways of working, rate them by business risk, and include areas such as DMARC and forwarding rules that need human interpretation.
How long does it take?
Typically one to two weeks from the time access is granted to the readout meeting. Delays in access or scheduling extend this.
Do we need Microsoft 365 Business Premium?
No. The assessment works on any Business or Enterprise plan. Where a recommended control needs a higher licence, the report says so and explains the alternative.
Can you fix the issues you find?
Yes, as a separate engagement. You can then move into Microsoft 365 Administration or a managed IT package so fixes are maintained rather than applied once.
Get a clear picture of your Microsoft 365 security
Request the assessment from the store, or book a consultation if you have more than one tenant or want remediation scoped at the same time.