A specialist service from CyPro
Expert Microsoft 365 tenant security assessment, at a fixed published price
UK security consultants review your Microsoft 365 tenant against the CIS benchmark, find the misconfigurations attackers actually use, and hand you a remediation roadmap in priority order.
- Fixed fees, published in full
- CIS-benchmarked, expert-led
- Read-only access, zero disruption
- UK consultants, named on the report
Trusted by
The assessment
What your Microsoft 365 security assessment covers
Six areas of your tenant's configuration, reviewed by a consultant who assesses Microsoft 365 and Office 365 environments every week.
Identity & Entra ID
Admin roles, stale accounts, privileged access and sign-in risk settings reviewed line by line, because identity is where almost every tenant breach starts.
Conditional Access & MFA
Every policy read and tested against the baseline a UK business tenant actually needs, including the legacy authentication gaps that quietly bypass MFA.
Exchange & Email Protection
Mail flow rules, forwarding, anti-phishing and anti-spoofing configuration checked against the tricks used in real business email compromise cases.
SharePoint, Teams & OneDrive
Sharing settings, guest access and data exposure across your collaboration workloads, where sensitive files leak without anyone noticing.
Defender & Audit Logging
Threat policies, alerting and audit log coverage verified so that when something does happen, your tenant has actually recorded it.
Secure Score & Roadmap
Your Microsoft Secure Score interpreted against real UK benchmarks, and every finding ranked into a remediation roadmap by impact and effort.
What does a Microsoft 365 security assessment include?
A Microsoft 365 security assessment is an expert review of your tenant's configuration: identities and admin roles, Conditional Access and MFA, email protection, sharing settings, Defender policies and audit logging, scored against the CIS Microsoft 365 Foundations Benchmark. You receive a prioritised remediation roadmap, a board-level risk summary and your Secure Score put into real context. The same review is often called a tenant security assessment, an Office 365 security assessment or an M365 security evaluation: the substance is identical.
Why this assessment
Microsoft 365 security services without the mystery
A fixed price, published in full
Almost nobody in this market publishes what an assessment costs. We do: fixed fees by workload scope, on the pricing page, before you ever speak to us.
Experts, not just a scan
Free scanners list settings. Our consultants interpret them: which findings matter for your business, which are noise and what to fix first.
CIS-benchmarked method
Every check maps to the CIS Microsoft 365 Foundations Benchmark and Microsoft's own security baselines, so the findings stand up to scrutiny.
Read-only and disruption-free
The assessment uses read-only access. Nothing is changed in your tenant, nobody is interrupted and your users never notice it happened.
A roadmap, not a data dump
You receive a prioritised fix list your team can start the same day, with a board-level summary of risk and cost alongside the technical detail.
A path to 24/7 coverage
When you want your tenant watched continuously after the fixes land, the CyPro SOC can monitor it around the clock. No rip and replace.
Your experts hold
Results, not promises
What clients say
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project 
Good questions
Frequently asked questions
Is Microsoft 365 secure by default?
No, and Microsoft says as much: the platform ships with security defaults that stop the crudest attacks, then hands you several hundred configuration decisions under the shared responsibility model. Microsoft secures the infrastructure; the configuration of your tenant, where almost every real-world breach happens, is yours. That gap between a secure platform and a secured tenant is exactly what an assessment measures.
What does a tenant security assessment include?
An expert review of your Microsoft 365 configuration against the CIS Microsoft 365 Foundations Benchmark: identities and admin roles, Conditional Access and MFA, Exchange and email protection, SharePoint, Teams and OneDrive sharing, Defender policies and audit logging, plus your Secure Score in real context. The output is a prioritised remediation roadmap, a board-level summary and a debrief.
How is this different from a free tool like Secure Score or a tenant scanner?
Free scanners compare settings against a baseline and output everything that deviates, in minutes, for nothing. They are a fine temperature check. What they cannot do is interpret the results for your business: which of the forty findings matter, which are noise, what to fix first and how to do it without breaking anything. The assessment is the judgement, not the list.
How much does a Microsoft 365 security assessment cost?
Our fees are fixed, banded by which workloads are in scope, and published in full on the pricing page, which makes us nearly unique in this market. Elsewhere, published UK day rates for comparable work run £850 to £1,250 with a three to four day standard shape, revealed only after you ask.
Take the first step
Find out what your tenant is really exposing
Book a free 45 minute scoping call to talk through your Microsoft 365 estate and see exactly what an expert assessment would check, cost and deliver. No obligation, no hard sell.