Microsoft 365 Security
For most companies, Microsoft 365 is where identities, email and documents live. One compromised account can mean access to mailboxes, files, Teams and every connected application. Many tenants also pay for security features that were never turned on. We assess, harden and test your tenant so the protection you are licensed for actually works.
Starting at $3,500 for one tenant with up to 50 users. Final price depends on scope.
What we review and harden
Identity (Microsoft Entra ID)
Conditional Access, phishing-resistant MFA such as passkeys for administrators, blocking legacy authentication, privileged roles with just-in-time access, guest access, and application consent.
Email (Exchange Online and Defender for Office 365)
Anti-phishing policies, Safe Links and Safe Attachments, SPF, DKIM and DMARC, and external forwarding rules.
Endpoints and detection (Microsoft Defender XDR)
Defender for Endpoint onboarding, attack surface reduction rules, and alert and incident tuning.
Data (SharePoint, OneDrive and Microsoft Purview)
External sharing, sensitivity labels, DLP, and oversharing that Copilot could expose.
Devices (Intune)
Compliance policies that Conditional Access can rely on.
What we enable depends on your licenses. We tell you when a feature requires a different plan.
Benchmarks we use
Published in May 2026, the industry reference for tenant hardening.
Mandatory for U.S. federal civilian agencies and a strong reference for any organization.
Microsoft Secure Score
Used as a progress indicator rather than a goal.
Common gaps we fix
MFA registered but not enforced on every application and sign-in, or legacy authentication still allowed.
Too many Global Administrators, with standing access instead of just-in-time elevation.
Users allowed to consent to third-party applications, which enables consent phishing.
Automatic forwarding to external addresses left enabled.
"Anyone" sharing links open by default in SharePoint and OneDrive.
Licensed Defender features never turned on.
Who it's for
Companies on Microsoft 365 Business Premium, E3 or E5 that want to know whether their tenant is really protected, and companies preparing for an audit, a cyber insurance questionnaire or a customer security review.
How we work
01
Assessment: read-only review of your tenant against the benchmarks, with a report prioritized by real risk.
02
Hardening plan: changes grouped and sequenced, with Conditional Access policies tested in report-only mode before enforcement.
03
Implementation: we make the changes ourselves or guide your team, with emergency access accounts protected and excluded where appropriate.
04
Validation: as penetration testers, we test the result: legacy protocols that bypass MFA, consent phishing, and paths to privileged roles.
05
Ongoing support (optional): periodic reviews as Microsoft changes defaults and adds features.
FAQ
Do you need Global Administrator access?
No. The assessment uses read-only roles such as Global Reader and Security Reader. Changes use least-privilege roles agreed with you in advance.
Will hardening lock users out?
We test Conditional Access in report-only mode first, roll out in stages, and keep emergency access accounts in place.
Do we need to buy more licenses?
Not necessarily. We start with what you already pay for and show where an upgrade would close a real gap.