What’s new in ConfigCheckup.

People

• NewStarters and leavers: everyone joining and leaving at every tenant on one page, under Work, with who leaves this week, what waits for an approver and what was done lately, each leaver with their certificate. Each tenant has its own under Users & mail, with Offboard a leaver and New starter beside the list.
• NewMark a leaver in their name: offboarding can put a prefix before their display name, such as “LEAVER - Ann Lee”, so colleagues and admins see they have gone. Set a prefix on the tenant record and every leaver there gets it; rolling back puts their own name back.
• NewA new starter’s first day: give it on New user and their account is made at 08:00 on the working day before, ready to hand over.
• ImprovedThe leaver form groups its steps: lock them out, mark them as a leaver, their mail, files and Teams, licences and devices, each with who takes over beside it.

• ImprovedOn a wide screen, Home, My work, Evidence and a tenant’s findings plan keep their summary, sharing, quick routes and the button that sets the plan in a panel beside the work, rather than at the foot of a long page. Home leads with its four figures.
• ImprovedLong pages are shorter: a tenant’s people list runs in two columns when nobody is open, licence savings and Cyber Essentials themes sit side by side, integrations not yet connected fold to one line, and a tenant’s permissions list folds away until opened.
• FixedThe evidence pack could show another framework’s controls after switching frameworks, and two controls named without a number (in Secure Score and the DSPT) could share one 90-day history.

• NewLaunch offer: 30% off every plan, monthly or yearly, for your first 12 months, for the first 50 customers. It is taken off at checkout, with no code to enter, and the pricing page says how many places are left. Pricing
• ImprovedCheckout shows what your plan is made of, offers yearly billing with what it saves, and says who to ask and how to pay by invoice. Above the pay button: you can cancel or pause any time.

People

• NewPasswordless rollouts: start one from a tenant’s passwordless plan, under People. Switch on passkeys and Microsoft Authenticator as a change an approver signs off, with a dry run and rollback, then email each wave plain steps to add a passkey at Microsoft’s My Security Info, from you in your brand. Each assessment shows who has registered, stalled waves show on Home, and once everyone has, the next step is the phishing-resistant Conditional Access fix.
• NewIn a passwordless rollout, add a wave’s people to a security group, as a change with a dry run and rollback, so the methods or a Conditional Access policy can follow the waves; and mark someone you are helping in person not to be emailed. They still count until they register.
• NewStored in Hudu (beta): a person’s panel lists the credentials in Hudu whose username is theirs, with the website, when it last changed and whether it has a one-time code, and a leaver’s offboarding lists them to rotate. Details only: ConfigCheckup never stores, logs or shows a password or one-time code. Connect your PSA

Search and settings

• NewDomain renewal watch: once a day ConfigCheckup asks each tenant domain’s registry, through public RDAP, when it is registered until. A domain 30, 14 or 7 days from expiry, or expired, shows in Needs you and is sent to Owners, Admins and the tenant’s account manager, and each tenant’s Overview has a Domain renewals card.
• NewHaloPSA webhook (beta): a ticket closed or reopened in HaloPSA is followed at once rather than at the next assessment. Set a leaver ticket type, and a new leaver ticket drafts an offboarding for the person it names, waiting for approval, with a note on the ticket saying where. Connect your PSA
• NewCancel or pause your plan from Plan and billing: it shows what stops when a plan ends, offers Monitor or a pause of one to three months for a monthly plan, and asks why before the plan ends with the period you have paid for. A paused workspace stays readable and nothing is charged until it resumes.
• ImprovedWhen a plan starts, its Owners get an email with the next things to set up; after a trial ends unpaid, a reminder that everything it found is still there.
• ImprovedThe audit log’s word search is much faster on a busy workspace, and the API’s audit log takes the same groups as the console (?group=approvals,settings).
• ImprovedA SIEM stream that keeps failing stays in Needs you until it sends again. Asking to reset the password of an account that signs in with Microsoft or single sign-on now sends an email saying which button to use, and a reset clears the lockout from wrong passwords.

Search and settings

• NewGetting started on Home has a Fix a first finding step, which ticks itself off once an assessment finds one resolved.
• NewA new trial that has not connected a tenant yet gets three short emails over its first week: how to connect, how consent works when you are not the tenant’s administrator, and a reminder that the trial has not started yet.
• ImprovedIf you start choosing a plan and the payment is not finished, we send one reminder an hour later that goes straight back to the same plan. Nothing is charged until you pay.
• ImprovedPlan and billing points out that annual billing is two months free, once a monthly plan has paid for two months. Pricing

Search and settings

• NewChoosing a plan now takes you to a Confirm your plan page where you pay, with your plan, tenants and billing period shown above Stripe’s payment form. The prices, tax, promotion codes and receipts are the same, your card details still go straight to Stripe, and Back to plans is one click away. Pricing

People

• NewStart a new user like someone already in the job: under New user, choose Like an existing user and pick a colleague. Their job title, department and country fill the form, and their licences, groups and Teams are copied in the same change (never groups that give admin roles), each one listed in the dry run before anything is made. Everyday admin
• ImprovedA person’s Access actions offer New user like them, and the search box finds New user like a colleague at any tenant.

Search and settings

• ImprovedThe free email security check writes out the DNS records to publish for the domain you checked, built from what it publishes now: one SPF record keeping your other senders, DMARC from p=none to reject, Microsoft 365’s DKIM records and an MTA-STS policy naming your own mail servers, each ready to copy, with the commands that show it worked. Email security check

• ImprovedPrices for new subscriptions have gone up. Monitor is now £35 a month for your first tenant, then £10 a tenant to the 50th and £6 from the 51st; Automate is £69, then £15 and £8. A year still costs ten months, by card or by invoice with a purchase order, and nothing else about the plans has changed. Pricing
• ImprovedIf you already pay, you keep the price you subscribed at, including when you add or remove tenants or change how often you pay; if today’s prices would cost less for your tenants, you pay those instead. Choosing the other plan moves you to today’s price for that plan, as before, and a founding price lock still holds for its whole term.

• NewScanning a device’s label opens one page for it: what is wrong with it first, its asset record to edit, everything ConfigCheckup read from Intune and Entra ID, and the Intune actions it can send for approval. The same page opens from the Devices list, the asset register (for every role, beside the list) and a person’s devices on People. Where something could not be read, such as Intune or Defender alerts, the page says so rather than calling the device fine.
• NewFrom a device’s page, on a plan with changes: check in now, restart, rename in Intune, lock, retire, wipe, or disable in Entra ID a device not seen for 90 days. Each is a change with its dry run and approval as before, on the exact Intune record shown when Intune lists the device twice. Lock, retire and wipe start here now, or from the person on People for a lost device.
• NewRename a company-owned Windows PC in Intune, with a restart straight after if you choose, or restart it, as an approved change. The dry run says if the new name would move the PC into or out of a dynamic group or a Conditional Access policy, and then approving it needs a tick. Neither can be undone: rename it back as a new change.
• NewGive a device its own name on the register, such as “Reception laptop 2”, on its page or from the Name on the register column of the register’s spreadsheet. It shows on the register, on the device’s page, in the Scan page’s results and on its printed label, with its name in Intune beside it. Nothing changes on the device or in Intune, and every change, typed confirmation and the export’s Device column still use the name in Intune.
• ImprovedA serial number typed on the Scan page now finds the device even before it is recorded on the register, from the tenant’s latest device inventory. A ten-character serial number, as on most HP devices, is searched as a serial number when no label has that code. Where the phone’s browser can read barcodes, the camera on the Scan page reads the maker’s serial number barcode too, and says so. A printed label’s own link still opens only the device with that label.
• ImprovedA label that is not on a register you can see now says you may be signed in to another workspace, and offers to sign in as someone else and come straight back to it.
• FixedWhen an assessment could not read Intune’s devices, the asset register showed every recorded device as no longer in Intune. It now says Intune was not read, and why; no device is shown as missing; the export’s In Intune column says “Not read”; and the device lifecycle report says none is shown as no longer in Intune.
• FixedWhen Intune lists one serial number twice, usually an old enrolment not yet removed, the register now shows the record that checked in most recently, not the one on the oldest system.
• ImprovedAsking devices to check in now says plainly, in its dry run and on the help pages, that a device picks up any policy waiting for it as soon as it checks in.

• NewAsk for help without leaving ConfigCheckup: Support, in your account menu, sends your question to the ConfigCheckup team with your workspace, so we know which workspace you mean. Each request has a ticket number. Our replies appear on the page, where you can answer or mark it solved, and come by email once your address is confirmed. Only you see your tickets, unless you choose to share one with your workspace’s Owners and Admins.

• ImprovedExchange Online is read from the start of an assessment, beside Microsoft Graph, and its organisation settings and mailbox access are read at the same time rather than one after the other.
• ImprovedWhile an assessment runs, the progress line names what is still being read, and a second line says how many Exchange settings and mailboxes are read so far. Its last step says when it is drafting the fixes your automation policies ask for, with each dry run by name, and when it is sending notices and reports.
• ImprovedThe assessment speed page shows how long the work after scoring takes, step by step: notices, fix drafts, tickets, reports and webhooks.
• ImprovedThe Connection page lists each setting that was not read, why, and when it is read again.
• ImprovedWhile Exchange Online settings an assessment could not read wait to be read again on their own, the tenant’s overview says so and at what time, and Findings says they are still being read.
• ImprovedWhen those settings are read again, the tenant’s pages update on their own once the read has finished.
• FixedThe Connection page showed a source Exchange Online read only in part as “Refused”, and counted all its checks as waiting on access. It now shows it as partly read, with Read again.
• FixedIf Exchange Online’s answer could not be read in full, ConfigCheckup could take it as an empty list. It now treats it as not read, and the checks on it show as not checked.
• FixedA check that failed, could not be read in one assessment and failed again is no longer sent to webhooks and the SIEM as newly failing.
• FixedThe email after an assessment no longer says the score is up when checks that failed last time could not be read this time. It says how many, and that the score leaves them out.

Changes

• ImprovedChanges that are high-risk, or that cannot be fully undone, now say so, with the reason, wherever you start, approve or schedule them: on the change, on the finding’s fix and its free dry run, in every list of changes, on automation policies and baselines, on the everyday admin forms, in approval emails, the bell, Teams and Slack, and on your tenant’s portal before they say “Go ahead”. Lists tag them “Cannot be undone” or “Partial rollback”, and Teams and Slack offer Reject and send you to the change to approve it. Turn on automation
• ImprovedThe API’s changes now say how far each can be undone, why it is high-risk at that tenant, and whether it is not safe to make there.
• ImprovedApproving a change that is high-risk at that tenant, or that cannot be fully undone, now needs a tick on the change’s own page, under its reasons. Such a change is never approved in bulk, from a list or under an automatic policy. Automatic containment, which you set up, is the one exception. Rejecting never needs the tick. Turn on automation
• ImprovedBefore some changes ConfigCheckup now checks the tenant first: who still sends with SMTP AUTH, which inbox rules forward outside, who has only text, call or email codes, which apps signed in lately, whether a domain signs in through federation, DMARC and SPF getting stricter, and whether Conditional Access would keep devices out under new compliance policies. What it finds makes the change high-risk there, and a change found unsafe there cannot be sent for approval or run. Facts it could not read count as a risk, never as safe. Turn on automation
• ImprovedFixes that rolling back cannot fully undo, such as a Windows upgrade, Windows LAPS, the BitLocker policy and retention labels, and fixes that turn off “Anyone” links or reject Direct Send, now always wait for a person. Simulations count them as fixes that need approval. Turn on automation
• ImprovedWhere a tenant has Microsoft Entra ID P1, and Intune or only hybrid joined Windows computers, the OneDrive sync check now offers a report-only Conditional Access policy. Once switched on, Word, Excel, Teams and OneDrive on a personal computer cannot open work files; the browser still can. Automatic policies draft it for approval until an Admin approves them again. Restriction of OneDrive sync to managed devices
• ImprovedWhen ConfigCheckup changes the fix a check offers, an automatic policy or baseline approved before the change drafts that fix for approval, with the reason, instead of running it by itself. Owners and Admins are told once, and Changes › Automation says which policies wait, with Approve again. Turn on automation
• ImprovedConditional Access policies drafted from Microsoft Secure Score recommendations now leave out your emergency access accounts, as the checks’ own drafts do.

People

• ImprovedBlocking several accounts at once leaves out any that look like an emergency access account, and warns when an account is synchronised from Active Directory. The dormant accounts check leaves out emergency access accounts and Entra Connect’s sync account.

Changes

• ImprovedA change that failed, was only partly made, did not stick, did not run, or was followed by a check getting worse now shows under Needs attention on the Changes page, the tenant’s Changes tab, Home and Today, and in your morning email. Each one says what Microsoft answered and how to make the change, or put it back, by hand: the admin centre and the steps for exactly the objects still to do, and the PowerShell for them where the change can be undone and you may raise it. Turn on automation
• ImprovedOwners and Admins, and whoever raised or approved a change, are told when it needs attention, in the bell and by email. Several at one tenant within ten minutes come as one notice, and nobody is told twice about the same thing. The Changes count in the menu includes them. Turn on automation
• ImprovedOn a change that needs attention you can say you did it by hand (ConfigCheckup checks the tenant afterwards, and opens it again if something is still to change), check the tenant now, raise it again as a new change, read the checks that got worse again, or close it without fixing with a reason. Anyone from Consultant up can report a problem with a change that ConfigCheckup cannot read, such as devices that stopped syncing; Owners and Admins are told straight away. Turn on automation
• ImprovedThe change.succeeded webhook now carries partlyDone, true when some steps could not be made. API keys and webhooks

• FixedWhen a fix finds its setting already in place, nothing is changed and the finding is read again at once. It closes when its check agrees. For settings where the check and its fix are proven to agree, such as who can invite guests, SharePoint sharing and audit logging, the finding is marked done straight away and then confirmed. Turn on automation
• FixedA change waiting to run whose dry run, read again, finds nothing to change now closes as “Nothing to change”. Nobody is asked to approve it again, and whoever raised or approved it is told.
• ImprovedIf a check still fails after its fix was found already in place, the fix is not offered again for 7 days at that tenant, and the finding says what to check by hand. A dry run that finds something to change offers it again at once.
• FixedSome checks no longer offer a fix that would change nothing: dormant guests already blocked from signing in, and Conditional Access policies that are already there in report-only mode, which the finding now asks you to switch on.
• FixedThe MFA and password reset registration checks offer Microsoft’s registration campaign only while it is not on for everyone. When it is, the finding says so and what is left. A campaign on for a pilot group is no longer called “already on”: the fix turns it on for everyone, keeping anyone it leaves out.
• FixedThe checks on who may consent to apps now read the setting however Microsoft returns it, so they no longer say “Not checked” where the fix could read it.
• ImprovedThe Conditional Access fix no longer makes a second copy of a standard policy that is already there under another name. A policy of the same name that is switched off, or set up differently, is named in the dry run and left alone. Excluded accounts that no longer exist are left out of new policies, with a note, as Microsoft refuses them.
• ImprovedTurning off text message, voice and email codes, showing the app and location in Microsoft Authenticator, and system-preferred MFA now also mark their finding done straight away when a fix finds them already in place, and the next read confirms it.
• FixedExchange Online fixes now change the same default policy their check reads, by its own name, for calendar sharing, shared Bookings pages, anti-spam, anti-malware and the rest. Where Exchange does not say how a setting is, nothing is changed, and it is not called already set.
• ImprovedExchange Online settings ConfigCheckup reads itself, such as SMTP AUTH, the External tag, MailTips and POP and IMAP for new mailboxes, now mark their finding done straight away when a fix finds them already in place, and the next read confirms it.
• ImprovedBefore an Exchange Online setting is changed, the read of how it is now waits out Exchange being busy and tries again. If Exchange still does not answer, the change stops at a step that names Exchange Online and says what to do, and nothing is changed.
• FixedDKIM counts as already in place only when Exchange Online signs, calls the keys valid, and both selector records are published at the DNS host. A missing record is now published, where before the fix said “Already signing” and stopped.
• ImprovedWhen an SPF, DMARC, DKIM or MTA-STS fix finds its record already published, the finding is read again once public DNS can show it, up to an hour later. A record still cached elsewhere no longer counts against the fix.
• FixedThe Secure Score action “Set the phishing email level threshold at 2 or higher” is now fixed by impersonation protection, which sets the threshold. A Secure Score action is marked done from a live read straight away only when its fix is all the action asks. The others are read again, and Secure Score decides, which can take up to 48 hours.
• FixedA Secure Score action that would create a Conditional Access policy no longer offers it again when that policy is already there, on, off or in report-only mode. The finding says which, and what to do.
• ImprovedAssessments now read Intune update rings, BitLocker and Windows LAPS policies, and who each is assigned to. If Intune does not answer for one of them, the findings say so, and a fix reads it again in its dry run before anything changes.
• FixedThe Intune baseline fix no longer makes a second policy when one of its name is already in Intune. If that policy is assigned, the finding is marked done straight away and then confirmed. If it is assigned to nobody, the finding says so and where to assign it.
• FixedWhen an Intune policy already sets BitLocker, the encryption check names it and no longer offers a second one, which could conflict. Devices still not encrypted may not have checked in yet.
• FixedThe Windows LAPS check offers its fix only while no LAPS policy is for all devices. With several LAPS policies, the fix widens the one that reaches the most devices and leaves the others alone, as two policies on one device can conflict.
• FixedThe Windows upgrade checks offer to change the update rings only while there is no ring or a ring holds devices back. When every ring lets devices upgrade, the finding says the devices are waiting on the upgrade itself, and where to see each one.
• FixedThe sensitivity label check counts labels as published only when a label policy that is switched on publishes them to someone. Where label policies exist but publish nothing, the finding says what to turn on instead of offering another.
• FixedThe Secure Score actions for sensitivity labels, DLP and retention labels no longer offer a fix when Purview already has what it would create. The finding says what Secure Score asks for beyond it.
• FixedThe stale devices check no longer offers to disable devices that are already disabled in Entra ID. It counts them and says to delete them when the tenant agrees.

• FixedThe fix for OneDrive sync on managed computers no longer turns on SharePoint’s “domain-joined computers only” setting. On computers that are Microsoft Entra joined, as in a cloud-only organisation, it stopped OneDrive syncing, even where Intune manages them. Changes still waiting with it are withdrawn. Where it ran, Owners and Admins are told, with how to roll it back. The check now fails when the setting is on with no domain listed. Restriction of OneDrive sync to managed devices
• ImprovedWith the SharePoint setting on, the OneDrive sync check names the Windows computers that are Microsoft Entra joined, which cannot sync. With it off, the check passes when a Conditional Access policy that is switched on requires a managed computer for OneDrive sync.
• FixedRestoring SharePoint settings from a backup no longer turns that setting on with no domain listed. If that is really meant, do it in the SharePoint admin centre.

• FixedOn the Monitor plan no change is approved, run, resumed, rolled back or undone in a tenant, and no first sign-in pass or password is set, including for a change approved or set for a later date before the workspace moved to Monitor. Before, such a change could still run, be approved or be rolled back.
• ImprovedMoving to Monitor now tells you first how many waiting changes it cancels, including leavers, and asks you to confirm. Each member is then told which, and each cancelled change shows what it would have changed, so you can make it by hand. Turn on automation
• ImprovedOn Monitor and the trial, ConfigCheckup no longer offers to set up its automation app or give it roles. A tenant that gave it access earlier keeps it, used only to read.
• ImprovedDry runs and rollback checks now only read your tenants, on every plan. Anything in them that would change Microsoft 365, a DNS record, MTA-STS hosting or a Partner Center subscription is refused before it is sent.

• ImprovedEvery picture of ConfigCheckup on the website is now the console itself: a capture of the demo workspace, a film of it, a page the report renderer made, or the interactive demo. The drawn stand-ins for a change record, a leaver’s form, the report builder, a laptop’s life and the savings worksheet are replaced by the screens they stood for. Features
• ImprovedThe home page is shorter: what ConfigCheckup does and who it is for, a film of one fix from finding to done, how it works in three steps with the console to try, five things it does, each shown as the product shows it, then the price. Home
• NewConfigCheckup in 22 seconds: a short film of the console’s own screens from the demo workspace, set to music, on the home page and first on the demo page. 2-minute tour
• ImprovedThe website’s text now uses Geist, the console’s own typeface.

• NewYour plan now includes credits each month for optional extras: Monitor 10, plus 2 for each tenant after the first; Automate 25, plus 4. They refresh on the 1st of each month and do not carry over. Credits pay for optional extras. Everything else is included, and nothing that runs by itself uses them.
• NewA trial includes 10 credits, and your first plan payment comes with 100 welcome credits. Each lasts 12 months.
• NewRecommend a colleague: Owners and Admins share a link from Extras › Credits. A workspace that signs up from it gets a 30-day trial instead of 14 once its owner confirms their email address (up to 10 a year from one link). When it has paid for two months and assessed a tenant, you both get 300 credits. Neither of you is told which workspace the other is. Credits and extras
• NewWhen an extra uses credits, the ones that end soonest are used first, so you lose as few as possible.
• NewExtras › Credits shows how many credits you have and why, in one sentence, and everything that used or added credits each month, in plain words. Your credits are also in the top bar, on every page.
• NewAn Owner can buy packs of credits: 100 for £15, 500 for £60 or 2,000 for £200, each lasting 12 months. Credits each month can be added on Plan and billing: 100 a month for £10 a month, or £100 a year. Each change asks you to confirm what it costs first, and stopping them refunds nothing: what you have stays until it ends. Anyone else can ask the Owner for more.
• NewAn Owner can choose who can use credits: Consultants and above, or Admins and Owners only. Owners and Admins are emailed once a month when most of the month’s credits are used.
• NewExtras shows every extra in one place: what each gives you, what it reads, what is already included, and what it costs before you make it. Nothing is used until you confirm, and what you made in the last 30 days is there to download.
• ImprovedEach extra’s card shows an example of when to use it, and the cards can be searched and filtered by job and by cost. Wherever an extra helps with what you are looking at, such as a tenant’s Licences page or a lead’s page, a link opens it, and the search (Ctrl K) finds each one. Nothing is used until you confirm on its page. After buying credits, a link takes you back to the extra you were making, and the Credits page’s history exports as CSV or Excel. Credits and extras
• NewFour extras that use credits. A proposal document for a lead, in your brand, with your covering letter, what their full check found, a priced quote and a plan for what to fix first: 3 credits a lead. A sealed auditor bundle: one dated zip of a tenant’s evidence for one framework, with the evidence pack as a PDF, every file attached to it, the change log and a SHA-256 fingerprint of every file, to hand an auditor: 5 credits a tenant and framework; the evidence pack and its share link stay free. A like-for-like history of a tenant’s last 12 months, each kept week checked again with today’s checks beside the score it had then, so you can show whether things got worse or new checks moved the score: 10 credits a tenant; your recorded scores never change. Each of those can be made again free twice within 24 hours. And the workspace archive: every tenant’s records in one download, each table the same as its free export: 10 credits, and free while your workspace is read-only.
• NewDownload any tenant’s set-up as a Word document from its Reports page: score, open critical and high findings, Conditional Access, partner access, licences, devices and domains, in your brand. Free on every plan.
• NewMore extras that use credits. A bulk prospect scan: paste up to 200 domains, and each gets the free lead health check’s public check, in one Excel sheet ranked with businesses on Microsoft 365 and the weakest public email security first: 1 credit for each 10 domains. It reads only public records, emails nobody and makes no leads; the single health check stays free. A domain exposure sweep: every name under one of a tenant’s domains that has had a public certificate, each checked in public DNS for records left pointing at cloud names that no longer exist, private addresses, mail without SPF, DMARC and certificates ending, as Word and Excel: 5 credits a domain. It reads public certificate logs and public DNS only, and visits no web server. Each extra only reads, and shows its cost before you make it. Domain exposure sweeps
• NewA licence what-if: move a tenant’s people between plans, such as Microsoft 365 E3 to Business Premium, or add Microsoft 365 Copilot, in up to five moves, and see the cost a month and a year before and after at your prices, the features each move gains or loses and whether a lost one is in use today, seats to buy and to reduce, and what to check first, including how Microsoft sells the enterprise suites without Teams. A Word document for the tenant and a spreadsheet of each person moved: 3 credits a scenario. It is an estimate, not a quote, and it changes nothing.
• NewA tenant comparison workbook: two to 20 tenants side by side, setting by setting, from each one’s latest assessment, across identity and Conditional Access, devices and Intune, Exchange, SharePoint and OneDrive, Teams, Purview, email DNS and licences, with “Same everywhere” or “Differs” on each row, every Conditional Access and compliance policy listed by tenant, and each check’s result: 3 credits a comparison. Baselines stay free: they say whether each tenant meets your standard; this shows what each one has.
• NewTwo more extras that use credits. Customer security questionnaire answers: common supplier-security questions answered from a tenant’s real settings, with how we know and the standard each relates to, as Excel and Word, ready to copy into the questionnaire a tenant’s customer sent: 2 credits a questionnaire. Questionnaires you have been sent are not read. Licence cost by department: a tenant’s licence costs split by department, cost centre, division, company or office, at your licence prices, as Excel and a one-page summary: 2 credits a run. Each only reads, and shows its cost before you make it.
• NewA renewal calendar and budget forecast: the next 12 months of each of a tenant’s Microsoft subscriptions, with its own renewal date, seats, seats in use and cost at your prices, a budget month by month, and the seats worth cutting before each renews, as Excel, a one-page budget in Word and a calendar file: 2 credits a tenant. Where Partner Center is connected, it also says whether each renews by itself. The free list of renewals in the next 90 days stays on Licences.
• NewA connected apps review: a dated review of every app connected to a tenant that is not Microsoft’s, with what each can reach, who consented to it and for whom, who owns it, whether its publisher is verified, when it was last used, and a suggested decision with a column for yours, as Excel and Word: 3 credits a tenant. The free Connected apps page stays, and blocking an app is still an approved change there.
• NewA Conditional Access what-if checker: type a person and choose an app, a device platform and a country, and see which of the tenant’s policies would apply and what each asks for, which would not, and which Microsoft could not evaluate. Those are never shown as passing. It is Microsoft’s own What If evaluation of the policies as they are now, answered on the page: 1 credit a check, given back if Microsoft does not answer. It changes nothing.
• NewFour more extras for planning. Each only reads, and changes nothing. A Teams and SharePoint tidy-up plan: teams, groups and sites unused for 90 days or more, ones with no owner or many guests, OneDrives of people who have left and the storage they hold, in six steps, as Word and Excel: 3 credits a tenant. A passwordless rollout planner: who already signs in without a password, who is ready for passkeys or Windows Hello for Business, and who needs a sign-in method or a device first, in waves with administrators first, as Word and Excel: 3 credits a tenant. A mailbox storage forecast: the mailboxes that will be full within 3 months, or in 3 to 6, at the rate they grew between assessments, and what to do about each: 2 credits a tenant; it needs two readings at least 30 days apart. A migration sizing pack: the size and count of every mailbox, OneDrive, site and team, with people, groups, licences, domains and devices and a checklist, for a merger or a tenant move: 5 credits a tenant. If a tenant hides names in its usage reports, you are told before anything is used.
• NewA new help page, Credits and extras, says in one place what uses credits, what never does, how many you get, and every extra with its cost. Extras and Credits each have How this works, which says the same in short and links to it.

• NewStart a free trial from the Cyber Essentials pages, and Get set up takes you to your first tenant’s Cyber Essentials readiness once its first assessment finishes: what is ready, and what to do first. Readiness, not certification. Cyber Essentials checklist

• NewThe website is rewritten around the five jobs ConfigCheckup does, each with a page of its own: automated fixes, everyday admin, reporting, devices and assets, and cost saving. Each page shows the real console with demo data, step by step, and says what it can’t do. Features
• NewSix short films of the real console, each starting on Home and going by the menu to the page where the work is done: approve a fix, then see how it runs and is read back; offboard a leaver on their last day; build a tenant review and schedule it monthly; put a laptop on the asset register and print its label; find unused licences and check the invoice against what each tenant holds; and set an automation policy. Each has captions and a list of its steps to jump between, and where the demo cannot reach Microsoft, the film says so. 2-minute tour
• NewTry the work on the page, with demo data: tick the steps of a leaver’s offboarding and see what changes for them; choose a report’s sections and see the pages the report renderer makes; follow one laptop from delivery to disposal; cost replacing a tenant’s devices at four budgets; and type your own licence prices into the savings worksheet. Nothing you type there is kept or sent anywhere. Everyday admin
• ImprovedThe trust centre has a one-page datasheet you can print: what ConfigCheckup reads and never reads, how changes are approved, the limits on automatic fixes, and what it can’t do. Beside it, the figures the website quotes, such as the number of checks and kinds of change, are listed with what each is counted from. Trust centre
• ImprovedA sample tenant review and a sample executive report, with demo data, can be downloaded as PDFs from the reporting page. Reports

• FixedAfter signing out and signing in as another person on the same browser tab, the sidebar could still list a tenant the previous person had opened recently. Opening it showed nothing, as it belonged to another workspace. The list and the tenant names the tab remembers now belong to whoever is signed in, and signing out clears them.

• FixedWhen Exchange Online answered slowly, an assessment could leave some of a tenant’s Exchange settings unread, with “Some data was read only in part” and those checks not checked until the next assessment. ConfigCheckup now reads the settings a few at a time, longest first, asks again when Exchange does not answer, and gives them more time.
• ImprovedAny Exchange setting still not read is read again about 12 minutes after the assessment, and the result is added to that same assessment: the findings, the score and the note on what was not read update on their own, and Recent checks on the tenant’s overview shows it. If a newer assessment has started by then, it reads everything itself instead.
• ImprovedConfigCheckup only ever reads Exchange Online settings during an assessment: any command that is not a read is refused before it is sent.

• NewThe website’s pictures of the console are now the console itself, with demo data: open the tenant list, a tenant’s Overview and its changes since the last assessment, findings with their evidence, fix and dry run, a tenant’s people and what can be done for them, changes waiting for approval, alerts and drift, baselines and reports, from the same menus as the real one, on a computer or a phone. 2-minute tour
• NewApprove a change and watch it run and read back from Microsoft, roll it back, dismiss an alert or build a report: each is shown as it happens in the console, marked “Demo data: nothing is changed”, and Reset puts the demo back. Nothing you do there is sent anywhere, and fixes still wait for approval, as they do in the console.

• ImprovedThe pricing page says how tenants are counted beside the plans: 1 tenant is up to 300 staff users, and a larger one counts once for every 300, so 650 staff users count as 3. Students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count, and every page, the Terms included, now says so in the same words. Pricing
• ImprovedSettings → Plan and billing shows what your tenants count as before you pay, tenant by tenant (Contoso: 650 staff users, counts as 3), and starts the tenants to pay for there. A tenant not counted yet shows where its first assessment is; give an estimate of its staff users, or of your own organisation’s before you connect it, and the tenants are filled in from it. The first assessment checks the estimate.
• ImprovedConnecting a tenant when your plan has room says how a large one counts. If its first assessment finds it counts as more than your plan has left, Owners and Admins see a banner naming it, its staff users, what it counts as, what your plan covers and the day the workspace would turn read-only, with an Add tenants button that fills in the number needed. The Owners get one email with the same. You have 14 days with everything working, and adding tenants or removing one ends it straight away.
• ImprovedOn the trial each tenant still counts once, and Plan and billing and the trial-ending emails say what a large tenant would count as on a paid plan, so you choose the right number.

• ImprovedThe 2-minute tour and the demo video are made again on today’s console, in the order a buyer asks about it: connecting a tenant and its first assessment, findings worst first with their evidence and fix steps, an automated fix with its dry run, two approvers and Microsoft’s confirmation, a person’s record with a password reset, mailboxes, an impossible-travel alert contained, and reports and frameworks. 2-minute tour
• ImprovedA new, more natural voice reads each step in plain spoken words, with its own pauses where a person would breathe, and says the product names (Microsoft 365, CIS, NIS2) as people do. The video has sound and captions in the same words, and the screen-by-screen tour on the demo page shows the same screens. 2-minute tour

People

• ImprovedA person’s panel puts what you do most at the top: Reset password, Add to a group, Give a licence and Offboard as a leaver are buttons under their name (Contain this account first when Microsoft counts them at risk), and More actions shows everything else at once, grouped as Access, Mail, Security and Leaver. Nothing in the panel scrolls on its own any more: the page scrolls it as one, and the list beside it stays put.
• ImprovedOverview leads with their sign-in and security as cards (last active, MFA, admin roles, risk and forwarding), each with a coloured dot when it needs a look, then contact and account details.
• ImprovedThe list beside an open person is compact: one row each, with their address on one line and their pills side by side. Groups, mailboxes and guests open the same way, with their actions as buttons and in More actions.

Changes

• FixedA tenant’s Changes history is newest first by when each change ran or closed, the time each row shows, on every page of it. A person’s, group’s and mailbox’s Changes tab follows the same order.

• ImprovedThe home page opens on two lines and the tenant Overview from the demo workspace, built live in the page rather than a picture: a change is approved by two people, then the tenant’s quick wins pass one by one and the score rises to what the score simulator works out. It plays only while on screen, stops while your pointer or keyboard is on it, has a Pause button, and stays still with reduced motion. Home
• ImprovedHow it works keeps each step’s screen in view while the four steps scroll past, and is a plain list on a phone. The frameworks run in one slow line you can pause, and the safety band shows one change from its dry run to its two approvers, then applied and reversible. Home
• ImprovedThe header’s Start free trial is always in the brand’s teal, and Features, Pricing, the tour and the pages for schools and in-house IT take the same opening: the headline arrives word by word in front of a slowly turning teal halo, and on Features and those two pages the console window settles flat as you scroll. Features

• ImprovedThe home page opens on a real tenant Overview from the demo workspace, then shows how it works in four steps, each opening the screen it happens on: connecting tenants, the findings, a change’s dry run and a report. Home
• NewTabs on the home page show each part of the console, with a few silent seconds of approving a change and opening a person. They play only while on screen, never with reduced motion, and each has a pause button. Home
• NewSwitch one finding from the demo workspace between before and after its fix, to see the setting the dry run changes and the score it moves. Home
• ImprovedFeatures and the pages for schools and in-house IT open on a real screen from the console, and Pricing and the tour page take the same look. Features

• NewWhere Purview is set up for a tenant, assessments now read its retention policies and retention labels too, with Purview’s read-only commands, and three new checks decide from them: a retention policy keeps Exchange email, SharePoint and OneDrive for everyone (NL-PVW-108), every retention policy that is on has been applied without errors (NL-PVW-109), and retention labels are published or applied automatically (NL-PVW-110). Each finding gives the steps in the Microsoft Purview portal and in PowerShell, and how to confirm the fix. Nothing is changed in the tenant. Retention policies keep email and files
• ImprovedWhen a tenant’s latest assessment read a source only in part or not at all (Full Access read on some mailboxes only, Exchange settings not finished in time, a source refused or left out), the tenant’s overview says so above the score, source by source, and their Findings say it above the list. A check that passed there passed on what was read, and both link to the Connection page for the detail. A source the tenant has no licence for is not counted.

Groups

• ImprovedA group opens in a wider panel beside a narrower list, as a person does. Its top says what kind of group it is, its address, who can see it and how many own it and are in it, with No owner, Empty and Has guests. Its details are in sections: Overview, Members, Owners and Changes, the last listing what was done to it through ConfigCheckup. What you can do is one menu beside them, in three groups: Members, Owners and the group itself.
• ImprovedOn Groups, Mailboxes and Guests, previous and next step through the list without leaving the panel, J and K keep the section you are on, and Escape steps back from an open form before it closes the panel. Once you have typed in a form, neither Escape nor J and K do anything.

Mailboxes

• ImprovedA mailbox opens in the same wider panel, with its address, who has access, where its mail goes and how full it is at the top. Its sections are Overview (its size and settings), Access, Calendar and Changes, and its menu has two groups: giving access, and its own settings, each saying whether it needs an approver. Its calendar is read from Exchange when you open Calendar, so a mailbox opens without waiting for it.

Guests

• ImprovedA guest opens in the same wider panel, with their state, address and last sign-in at the top, and sections for Overview, Groups and Changes. Their groups are read from Microsoft when you open Groups.

People

• ImprovedOpening a person’s Sign-ins reads their recent sign-ins from Microsoft straight away, with no button to press first. Read them again from the foot of the list. It is for a Technician or above, as before, and each read is recorded in the audit log under your name.
• ImprovedA person’s panel opens faster as you move down the list: their devices, and a leaver’s certificate, now arrive just after the rest of the panel instead of holding it up.

• NewMy work starts with Today: one list of what needs you today, most urgent first. High alerts nobody is on, today’s leavers, fixes about to go back to the open findings after 48 hours, changes waiting for your decision, your findings past due or due today, and data sources Microsoft did not answer for. Each row names the tenant, says why it is there now and links straight to where you deal with it.
• ImprovedToday lists only what your role acts on, at the tenants you can see. Alerts, leavers and data sources are for the tenants you look after, or for every tenant when you look after none. A Technician’s Home shows how many things are on it and the first one.
• NewTenant reports and the tenant review pack show the score over the last 3, 6 or 12 months: a trend, the score at the start and now, and what changed in that time (findings fixed and improved, new or worse, and changes made in the tenant). Choose the period in the report builder; six months unless you choose. A tenant with one assessment so far is told so, with no empty chart. In the PDF, the web view and Word.

People

• ImprovedA person opens in a wider panel beside a narrower list, brought into view as it opens. Its top says who they are at a glance: whether they can sign in, their job, licences and last activity, and every flag the list gives them (at risk, no MFA, mail forwarded outside, admin). Previous and next step through the list without leaving the panel. On a smaller laptop screen, fold the sidebar ([) for more room.
• ImprovedEverything you can do for a person is one menu beside their details, in three groups (Everyday, Security and Leaver), each row saying whether it needs an approver or is waiting for one. A form you open takes the panel. Resetting a password or MFA, unblocking, containing, signing them out and a lost or stolen device show their phone numbers and manager above the form, so you can call them back first.
• ImprovedA person’s details are in sections: Overview, Sign-ins (for a Technician or above), Access (their groups and mailbox access), Changes and Devices. Each section has its own link to share, and J and K keep the section you are on as you move down the list.
• ImprovedEscape in a person’s panel steps back from an open form to the person, then closes it. It does nothing once you have typed in the form, or while a new password is on screen, and nor do J and K, so nothing is lost by a stray key.

• ImprovedA tenant’s Settings no longer offer an app registration of the tenant’s own: every tenant is read and changed through the shared ConfigCheckup apps. A tenant that already has one keeps it, with “Test it” and “Switch back to the shared app” on its Settings.
• ImprovedEach finding’s panel leads with what was found, why it matters and what to do, in a few lines each. The evidence, the full explanation and the step-by-step guide are one “More” click away in each step, and the owner, due date and snooze fold into one line that says where they stand.
• NewFindings has an Awaiting confirmation section above the open list. A finding whose automated fix is approved, or that someone marked done, waits there until Microsoft 365 confirms it, and is resolved once it passes. One not confirmed within 48 hours is back in the open findings, as is one whose fix fails or is rolled back or dismissed.
• ImprovedFindings awaiting confirmation are out of the open count on Home, a tenant’s overview and Findings, which say how many are waiting.
• ImprovedPrompting everyone to set up Microsoft Authenticator no longer reads as still failing minutes after it starts: its check waits the days people may put it off, and a week to sign in. MFA registration waits in Awaiting confirmation for 48 hours, as every fix does, and is open again after that until the campaign shows it passing.
• ImprovedChecking a finding from one of ConfigCheckup’s own Exchange Online checks (Check now, marking it resolved, or confirming a fix) reads only the setting it is about: one or two Exchange commands, in seconds, where it used to read every Exchange setting, which could take several minutes. Every check also goes ahead of an assessment’s Exchange reads for the same tenant rather than waiting behind them.
• ImprovedAssessments read Full Access on two mailboxes at a time, as many as Exchange is sent at once for a tenant, rather than one, so that part of mailbox access takes about half as long. One assessment now reads Full Access on as many mailboxes as Exchange answers for in five minutes, rather than stopping at 250, so a tenant with a few hundred mailboxes is read in full each time. The Exchange read that lists every account starts first rather than last.
• FixedWhen Exchange Online answers too slowly, the organisation settings it had answered by the six-minute deadline are kept and the rest show as not checked, with the slowest Exchange commands named. The whole source could instead run on to its 10-minute limit and lose every setting.
• FixedA fix’s follow-up check due later (Secure Score’s 48 hours, say) no longer shows in a tenant’s header as “Checking in Microsoft 365” with a spinner until it runs. Work shows there once it is due within 15 minutes, and a time on another day says which day.

People

• ImprovedUnblock sign-in goes to an approver, asked for by a Technician or above. Two different people approve it for an admin, or for someone blocked by a containment or the incident response runbook in the last 90 days. Turn on automation
• ImprovedReset MFA and issue an access pass shows the pass once, to the approver who runs it. Nobody gets a pass for a reset they asked for themselves, and no admin or emergency access account gets one. Turn on automation
• ImprovedThe bulk bar says who each choice would leave out, and why, before you start; Act on all ticks everyone in the list, up to 200 at a time.
• FixedWhoever the bulk bar shows as left out is left out of the change too: a shared mailbox or room is never given a licence, and an admin is never blocked or offboarded with the others. Delete accounts’ list follows the “Not used for” days you choose.
• FixedThe x beside a distribution list in someone’s groups takes them off it through Exchange, as the Groups page does.
• ImprovedLost or stolen device carries the page’s ticket number on each change, and does not send a second sign-out while one is waiting. New user, joiner templates and Import starters give a starter the same country: the tenant’s, else the one most people have.

Groups

• ImprovedTaking more than one person out of a group or a distribution list in one change goes to an approver, from Remove members and Take them out alike. Taking one person out still runs straight away. Turn on automation

Mailboxes

• ImprovedForwarding a mailbox’s mail outside the organisation, or changing an admin’s mailbox, needs two different approvers. Turn on automation
• ImprovedTaking a group or a contact off a calendar goes to an approver, as it takes everyone in it off. Taking one person’s access away still runs straight away. Turn on automation
• ImprovedCreate a shared mailbox at the address of a shared mailbox that is already there gives the access only, and two different people approve it when the mailbox belongs to someone who holds an admin role, as Give mailbox access does.

Changes

• ImprovedRolling a change back never writes a setting back over one it could not read: tick the box to write it back anyway. A rollback that cannot check the tenant first changes nothing. Turn on automation
• ImprovedA change made for a ticket updates that ticket in your PSA when it is done: what it did goes on as a note, its time is logged there, and the ticket stays open for you to close. If your PSA has no ticket by that number, a ticket of its own names it instead and logs no time, so nothing is billed twice. No MFA on People, Needs attention and the MFA chase now leave out pupils and accounts with no licence. Change webhooks carry the ticket number too. A leaver or starter asked for on the tenant portal is never sent for approval twice alongside the same change from the console.

• NewSign in with your company: connect any identity provider that speaks OpenID Connect, such as Okta, Google Workspace, Auth0, JumpCloud or another Microsoft Entra tenant, in Settings → Your sign-in and security → Single sign-on. Prove your email domains with a DNS record, run a test sign-in, then require it if you want everyone to use it. Owners with two-step verification keep their password as a way back in. On Monitor and Automate. Single sign-on
• NewSCIM provisioning: your identity provider can add members, change their names and suspend them, and push groups that give roles (Admin, Technician, Consultant or Viewer; the highest wins). It never changes an Owner. Single sign-on
• NewMembers limited to some tenants: on Settings → Team, an Owner or Admin can limit a member to the tenants ticked by name, or carrying chosen tags. They then see and act on only those tenants, everywhere in the console, in their notices and through the API keys they make. Limiting someone withdraws their approvals at other tenants.
• NewSearch the audit log by who did it (a member, ConfigCheckup itself or an API key), what was done, the tenant, a date range and words, save the view, and export exactly what is shown. A tenant’s Activity page lists everything done there, and “Who changed this?” in the search palette opens the answer.
• NewStream the audit log, and if you choose alerts and the checks that start or stop failing, to Microsoft Sentinel or any HTTPS endpoint that takes JSON. Records go in order, and none is sent twice. In beta, with Automate. API keys and webhooks
• NewWrite your own checks: pick the data an assessment reads, a field, a test and a value, and try it on a tenant’s latest read before you save it. Your checks show as findings in your own words and stay out of the score, as template checks do. Available with Automate.
• NewSend tenant emails from your own domain: add it on Settings → Branding, and publish the DKIM, SPF and DMARC records shown, or let ConfigCheckup publish them through a DNS host you have connected. Once DNS checks out, reports, quotes, portal invitations, access reviews and your other tenant emails come from your address, signed with DKIM. Part of white label, on Monitor and Automate.
• NewA tenant’s own app registration: for a tenant that insists on one, enter its client ID with a secret or certificate on the tenant’s Settings. It is tested before it is saved, and every read and change for that tenant then runs as that app. You can switch back to the shared app at any time.
• NewDocumentation sync to IT Glue and Hudu (beta): each tenant mapped to its organisation or company gets a “ConfigCheckup as-built” page, updated daily and on demand, with its score and grade, open critical and high findings, Conditional Access, GDAP, licences and devices. Connect your PSA
• NewNinjaOne as an RMM (beta), beside Datto RMM and N-able N-central: devices matched by serial number, and open alerts. Connect your PSA
• NewA Power Automate custom connector, made from the API reference, to download from Settings → API and webhooks. Zapier and Make work through webhooks and the API. API keys and webhooks
• ImprovedTeams and Slack alert addresses are kept encrypted and never shown again. A retired Office 365 connector address is refused, with what to use instead (a Workflow in Power Automate), and a channel that keeps failing is paused, and Owners and Admins are told.
• FixedAn organisation running its own Microsoft 365 now reads its own words on the board summary link and in its emails: its managers confirm accepted risks and sign answers and access reviews there, and “your IT team”, not an IT provider, acts on what they send.

• NewSchedule for…: choose when a change runs, in the tenant’s own time, as you send it for approval, approve it, or approve several at once. Just before it runs it is dry-run again; if anything differs it does not run, its approvals are void, and whoever raised and approved it are told. With Automate.
• NewChange windows for each tenant (days, start and end in the tenant’s time zone, past midnight allowed): approved and automatic changes outside the window wait as “Held: outside the change window” and run when it opens. Containment and signing someone out run at once, and an Admin can run any change now as urgent, with a reason.
• ImprovedAll changes lists every change waiting for you, not only those among the newest 100, with Tenant, Type, Risk and Raised by filters, and pages; a tenant’s History pages too, so every run and its Roll back can be reached. Send all for approval and Reject selected, with a reason, act on many at once.
• NewA change nobody decides expires 14 days after it was raised or sent, and its row says how long it has left; whoever raised it is told. Approvers are reminded after a day, and every Admin and Owner after two. Whoever raised a change hears when it is rejected, and whoever asked to accept a risk hears the decision. Changes raised before this release do not expire.
• NewCheck the rollback: before a rollback runs, see what it would put back in the tenant as it is now, and what was changed there since. Overwriting a later change needs a tick.
• NewA fix across tenants can go to pilot tenants first, picked or by tag. The rest wait until every pilot reads back clean, then go on by themselves or on a click, and a failed pilot stops them. Roll back everywhere undoes the fix at every tenant and shows each tenant’s outcome.
• NewYour own templates: save a tenant’s backed-up Conditional Access or Intune policy as a template, and deploy it to other tenants through approval, with its groups, locations and emergency access accounts matched at each. Conditional Access policies are always created report-only.
• ImprovedRunbooks, Backups and Templates under Changes show every tenant on one page, instead of asking you to choose one. Automation policies can take several tags, as baselines do.

• NewNeeds you on Home now lists requests to accept a risk, stuck and failed changes, read-backs that differ, reports that were not made or not posted, accepted risks and deviations running out within 14 days, today’s leavers, API keys running out, paused webhooks and the trial’s last week. A row about one tenant can be put aside until its next assessment.
• NewA morning digest: on weekday mornings at about 08:00 in your workspace’s time zone, each member gets their own Needs you by email, and nothing on a day with nothing to do. Turn it off in Settings → Profile. An Admin can post the team’s digest to your Teams or Slack channel too.
• NewLeavers on their last day: the offboarding form takes the day and time in the tenant’s time zone, and the change runs then, dry-run again just before. Offboarding can now remove admin roles, hide the leaver from the address book, hand over the groups and Teams they own and deal with each of their devices, and it warns about large mailboxes, holds and accounts synchronised from on-premises.
• NewReset MFA and issue an access pass for anyone, not only a new account: approved by an Admin, and the pass is shown once, to whoever runs it. Under People’s No MFA filter, Remind emails each person without MFA from you, in your brand, or turns on Microsoft’s registration campaign.
• ImprovedPSA tickets are followed both ways, in HaloPSA, ConnectWise, Autotask, NinjaOne and Kaseya BMS (beta): a ticket closed by hand while its check still fails is flagged on the finding and can be raised again, tickets for accepted risks are closed with a note, and no ticket is raised twice. The finding shows its ticket, and you can create one by hand. Connect your PSA
• NewAlerts and drift can raise PSA tickets at the severities you choose, and admin work (people, groups, licences, mailboxes and leavers) can post a ticket saying what was done, closed at once, with the time logged where your PSA takes it. Each tenant’s PSA company is chosen from a list instead of typed in.
• NewAPI v1.1: every list pages by cursor and takes updatedSince; the rate limit is shared and every answer says it in RateLimit headers; POSTs take an Idempotency-Key; keys can be limited to some tenants and to IP ranges; and each key’s requests are kept for 30 days. New reads for alerts, drift, the audit log, framework readiness, licences, devices and every console export. Developers
• ImprovedWebhooks you can rely on: every delivery is logged with what your address answered, and can be sent again; a failed one is tried again over about a day; an endpoint paused after 20 failures in a row emails the Owners and Admins; and a secret can be rotated with an overlap. New events for changes, findings, tenants, leads, quotes and access reviews. API keys and webhooks

• NewNamed portal users: invite people at the tenant from the tenant’s Settings. They sign in with an emailed link and an authenticator app, and what they approve or sign is kept under their own name. Each tenant’s portal can stay open to anyone with the link, or only to the people you invite; new tenants start with invited people only, and an organisation’s own board summary link stays a link.
• NewQuotes are accepted by a link in their email, or in the portal, with a typed name and the time kept, instead of “Reply to this email”. You are told, and an accepted quote offers to draft its fixes or raise PSA tickets. Quotes can carry lines of your own (licences, hardware, a fixed fee or labour), and can be changed, duplicated or deleted.
• NewAsk the tenant to confirm an accepted risk from the risk register: they see the check, the reason and the review date on their portal and confirm it or say why not, and the evidence pack then names them as accepting it.
• NewThe portal gains Documents (reports you publish, framework readiness and Cyber Essentials status, with a log of who opened what), reply threads that keep every message and your answers, and, for the portal users you allow, new starter and leaver requests that arrive as draft changes for you to check. Nothing runs from the portal.
• ImprovedOn a paid plan the portal shows nothing of ConfigCheckup, as reports and tenant emails already did. On a trial its footer reads “Made with ConfigCheckup · Trial”, the same line reports and emails carry, in place of “Powered by ConfigCheckup”: a deliberate change, so one line names us everywhere.
• NewReports as Word documents, to edit before you send them. What changed and Licensing review are now reports of their own, and there is a Copilot readiness report, and a leaver certificate after each offboarding, emailed to the tenant’s contacts who authorise leavers.
• ImprovedWrite your own introduction and next steps, choose the assessment a report covers and the one it measures from, put the sections in your order, and keep templates for one tenant. Progress is measured from the last report you sent, the review pack lists the work you did, and “Saved this year” counts the licences you reclaimed.
• ImprovedShare links say who each was for and how often it was opened, and can be stopped one at a time or all together. Reports can be deleted, Branding takes a contact email for a report’s closing line, scheduled assessments no longer make reports nobody asked for, and the scheduled report email carries the score, what changed and the first things to do, with a link to the portal.
• NewFreeze insurance or Cyber Essentials answers for a renewal, signed by you and, if you ask, by the tenant in the portal, with a link for the broker. Answers keep their history, and you are told when a later assessment contradicts one.
• NewThe evidence pack shows each control over the last 90 days, the files you attach for “your own records”, the change log and the accepted risks the tenant confirmed, with an expiring link for your auditor. Access reviews remind at day 7, day 13 and once overdue, then ask the tenant’s other signers; answers can be saved and finished later; and reviews can run monthly, quarterly or yearly.
• NewLeads keep notes, an owner and a follow-up day; the free health check can sit on your own website; and the invoice check reads Partner Center month by month and shows what changed.

People

• NewEach person’s panel shows their MFA methods, admin roles, risk in Microsoft Entra ID Protection and any inbox rule forwarding mail outside, and their row flags the most urgent. How the numbers work
• NewNeeds attention counts who to act on now, from people at risk to blocked people still holding a paid licence, and Show them lists them, most urgent first. How the numbers work
• ImprovedFilter People by licence, department or class, account kind and when the account was made, sort by last active or newest, and see 100 people a page.
• NewNot used in 90 days now shows the accounts that can sign in but have no sign-in recorded at all, the ones to tidy up first.
• NewExport People as CSV or Excel: everyone your view, filters and search show, in the order you sorted them.
• NewCheck a person’s last five sign-ins from their panel, read from Microsoft there and then and explained in plain words, at tenants with Microsoft Entra ID P1.
• ImprovedWherever a person is named, in a group, a mailbox, a change, an alert or a finding, their name now opens them.
• NewA person’s row says when a change for them is under way, or has run but not yet been read back, and their panel lists their changes from the last 90 days.
• ImprovedA button or tick whose change is already waiting opens that change, or cannot be ticked again, so two of you do not send the same thing.
• ImprovedA person’s actions are in three lists, Everyday, Security and Leaver, which fold away on a phone.
• NewUnblock sign-in lets a blocked person back in without rolling back what blocked them, once an approver agrees: a Technician or above asks for it.
• ImprovedReset now: where one approver is enough, an Admin or Owner can approve their own password reset and run it within 30 minutes, never for an admin.
• NewReset MFA for a lost or replaced phone removes a person’s sign-in methods and signs them out, approved in the console and never from Teams or Slack.
• NewThe MFA reset makes a one-time access pass as it runs, shown once to the approver who runs it: never to whoever asked for the reset, and never for an admin or an emergency access account.
• NewContain an account from People to block its sign-in, sign it out and turn off suspicious inbox rules, with no alert needed first.
• ImprovedContainment removes MFA methods only when a Technician or above asks for it.
• NewTurn off inbox rules that forward a person’s mail outside the organisation; rolling back switches them on again.
• NewDelete a blocked leaver’s account; rolling back within 30 days restores it.
• ImprovedSet up like a colleague, a group’s new owner and a mailbox delegate are chosen from lists you can filter by name, job or address.
• ImprovedNew user suggests a free sign-in name in the tenant’s own style, offers job titles and departments already in use, and starts at the tenant’s country.
• NewNew user can copy a colleague’s groups and licences in the same change, never their admin roles or a group that can hold them.
• NewImport starters from a CSV or Excel file, each from a joiner template, every row checked before anything is made.
• NewTick several people, or act on all your view shows, to give or take back licences, add them to groups, sign them out, block or unblock them, or delete them, and see who each choice leaves out and why before you start.
• NewOffboard up to 20 leavers at once from the bulk bar: one change for each, and two different people approve them when more than one is raised together.
• NewOffboard someone on a date up to 60 days ahead: approved beforehand, with its dry run made again just before it runs.
• ImprovedRolling back an offboarding puts back exactly what was there, keeps a manager’s access from before, and leaves an automatic reply or forwarding changed since as it is now.
• ImprovedOffboarding can hide the mailbox from the address book once it is shared, and its automatic reply now works without Exchange automation.

Groups

• ImprovedEach group shows its email address, the bar filters by kind of group, and a synced or role-assignable group says where its members are changed.
• ImprovedA group that can hold admin roles is never deleted from ConfigCheckup, however the change is asked for.
• NewAdd people to distribution lists and mail-enabled security groups, or take them out, through Exchange Online where it is set up.
• ImprovedA group’s members say who is blocked, with Take them out for up to 100, and Remove members lists only the group’s own members.
• ImprovedTaking one person out of a group still runs straight away. Taking more than one out at once, Take them out included, now goes to an approver, as your tenant’s setting asks, and so does taking a group out of a group, which takes everyone in it.
• ImprovedA group’s panel names its owners, and a Team with no owner, or only blocked ones, says that nobody can look after it.
• NewRemove an owner from a Team or Microsoft 365 group, never leaving it with no owner, or with only apps as owners.
• ImprovedAdding people to a group, or taking them out, warns when a Conditional Access policy names that group.
• NewSchools: reset the passwords of up to 30 pupils in a class, approved on the change’s page and never from Teams or Slack.

Mailboxes

• ImprovedWho has access lists each person once with every kind of access they hold; the x takes it all away and Choose takes some.
• NewGive up to 20 people access to a mailbox in one go, and choose whether Outlook adds it for them.
• NewAll mailboxes lists every mailbox, people’s own too, and a shared mailbox anyone can sign in to says Sign-in allowed.
• NewSee where a mailbox forwards its mail, and whether it keeps a copy, is hidden from the address book, has an archive or is on hold.
• NewSet, change or turn off someone’s automatic reply, between two dates or until it is turned off, from Mailboxes or People.
• NewForward a mailbox’s new mail, change where it goes or stop it, from Mailboxes or People.
• NewMake a person’s mailbox shared, or a shared one a person’s again, and hide a mailbox from the address book or show it again.
• NewCreate a shared mailbox with who can open it and who can send as it; it only adds, so it runs straight away.
• FixedThe Mailboxes export holds only what your search finds, and the search finds “smith john” word by word.

Guests

• NewInvitation not accepted lists the guests who have not accepted yet, and each guest’s panel says when they were invited or accepted. How the numbers work
• NewSend the invitation again from a guest’s panel, with a message of your own if you like.
• ImprovedInvite up to 20 guests at once and add them straight to groups and Teams in the same change.
• NewA guest’s panel lists their groups and Teams, each with an x that takes them out straight away, and their changes from the last 90 days.
• NewTick several guests, or act on all in the list, to add them to groups and Teams or block their sign-in in one change.
• ImprovedBlock dormant guests lists every guest it would block, all ticked, and leaves alone anyone who has signed in since, checked with Microsoft.
• NewRemove guest deletes a guest’s account; rolling back within 30 days restores it.

Licences

• ImprovedPaid licences come first, the costliest first, with what their seats cost a month, and say when more are given than bought, when a trial ends and when one renews.
• NewA licence’s panel lists everyone who holds it, and Take back opens with the blocked or the unused ticked, each checked with Microsoft first.
• ImprovedWhere you are the only Admin or Owner and the tenant asks for one approver, you can approve taking a licence back yourself, as you already could a block. It can still be rolled back, and an admin’s licence still needs two people.
• NewSwap a licence for another, such as E3 for E5, in one change with no gap and no paying for both.
• ImprovedLeavers not fully offboarded no longer counts free licences, such as Office 365 A1, so a school’s score may rise.

Changes

• NewAdd your PSA or helpdesk ticket number to any change from Users & mail, and find it by searching Changes, in the export or as ticketRef in the API.
• NewA link with ?ticket= fills the ticket number in on every form on People, Groups, Mailboxes, Guests and Licences.
• NewUndo a change from its result for 30 minutes after it ran: taking someone out of a group or mailbox, or a licence, group membership, owner or mailbox access you just gave. An Admin or Owner can also undo what someone else gave.
• NewAn Admin or Owner can give every account a change made a one-time access pass or a temporary password at once, from the change’s page, shown once and never stored.
• ImprovedDeleting an account, removing a guest, leavers raised together and swapping a licence always need two different people to approve them, whatever the tenant’s setting.
• ImprovedWhere an account holds an admin role, two different people approve blocking it, signing it out, taking its licences back, resetting its MFA, letting it sign in again, or giving access to, forwarding or changing its mailbox. A mailbox change held since it was asked for checks the roles again before it runs.
• ImprovedCustom admin roles, roles limited to an administrative unit and roles held through a group now count as admin roles.
• ImprovedForwarding mail outside the organisation, and letting in someone blocked by a containment or the incident response runbook in the last 90 days, need two different approvers; such a block is not rolled back by one person either.
• ImprovedA password reset and an MFA reset for the same person within a day need two different approvers, and Reset now is not offered. A containment or offboarding that removes MFA methods counts as an MFA reset.
• ImprovedWhen Microsoft refuses to change an administrator’s account, the change says why in plain words and what to do.
• ImprovedHow many people approve a waiting change follows your team as people join, leave or change role, and the audit log says when one was enough.
• ImprovedAn offboarding, a containment, letting someone sign in again and any scheduled change are checked against the tenant just before they run, and go back for approval if anything differs.
• ImprovedThe same change for the same person cannot be sent twice, nor one that undoes a change still under way; the second links to the first.
• ImprovedConnecting a tenant when you are the only approver asks whether one or two people approve its changes, choosing neither for you.

Search and settings

• NewFind a person at any tenant by typing at least three letters of their name or email in search (Ctrl K) or on People.
• ImprovedType “reset” and a name in search to open that person’s password form, at any tenant.
• ImprovedRead again reads just one Users & mail list from Microsoft where the last assessment could not, without using an assessment.
• NewSchools: say in the tenant’s Settings when School Data Sync or your MIS makes accounts, and People marks them and warns before a duplicate.

• ImprovedThere is now one price list, the same for an MSP, an organisation, a school or a trust, priced by tenant. Monitor is £29 a month for your first tenant, then £8 a tenant to the 50th and £5 from the 51st; Automate is £59, then £12 and £7. A year still costs ten months, by card or by invoice with a purchase order. Pricing
• ImprovedA tenant counts once for every 300 staff users, for everyone. Pupils, students, guests, shared mailboxes and rooms never count, each school in a trust with its own Microsoft 365 is a tenant, and a tenant moves to Enterprise only above 2,500 staff users (it was 2,000), as does a workspace with more than 300 tenants. You can’t pay for fewer tenants than you have counted, and if your tenants come to count as more than you pay for, for any reason, Owners are told and have 14 days to add tenants or remove some before the workspace turns read-only. Pricing
• NewAutomate includes a free test tenant to try each fix on first: a tenant marked Pilot or Lab, with up to 25 licensed users, whose only domains are onmicrosoft.com or subdomains of another of your tenants. Mark a tenant Pilot or Lab when you connect it, or later on its settings page (Owners and Admins). A Pilot or Lab tenant that is not a test tenant counts like any other. Monitor makes no changes, so it has none. Terms of service
• ImprovedEvery feature is for every buyer: white label, Partner Center import and lead health checks are on both plans and no longer for MSPs only. Seats grow with your tenants: Monitor has 10 and Automate 25, or one for each tenant you pay for when that is more.
• ImprovedOne trial for everyone: 14 days on 3 tenants from your first connected tenant, or 30 days for a school, college or public body we have verified. Evidence-pack downloads are no longer held back during a trial.
• NewYou can buy a plan straight from the pricing page, without trying it first: choose Buy Monitor or Buy Automate, or a plan in the price calculator, which carries the tenants you counted and monthly or yearly billing. Sign-up shows the price, and once your workspace exists you go straight to paying by card, or to the invoice form for a yearly plan paid with a purchase order. There is no trial first: the plan starts as soon as it is paid for, or, for a yearly plan paid by invoice, as soon as it is invoiced. Leave checkout without paying and you can pay later, or start the free trial instead if your email address has not had one in the last 60 days. The plans and prices are the same as after a trial. Pricing
• ImprovedA move to Monitor or to fewer tenants, on the same billing period, is made at once, and the lower price is charged from your next renewal, with no credit for the time already paid. A move up is charged at once, prorated. Automate has a 3-month minimum before a workspace can move to Monitor, whether by changing plan or by cancelling and then buying Monitor; until then it can choose Automate again, and cancelling is never refused. Subscriptions already on Automate are not held to it. Terms of service
• ImprovedThe Direct plans, Scale and the Schools & Trusts quotes are no longer sold, and their pricing pages now lead to the one price list. Organisations and schools pay the same or less, most of them much less, and so do trusts of up to 27 schools on Monitor or 36 on Automate; a larger trust, with a tenant for each school, can pay more than the old trust price. Automate costs less than before for them and for MSPs with up to 15 tenants, and more for larger MSPs: £407 a month for 30 tenants against £309 on the last Automate package, and £857 for 80 against £624 on Scale. Monitor for 8 to 31 tenants costs up to £22 a month more than the last Monitor package. Pricing
• ImprovedIf you already pay for a plan, it keeps its price, and you can still change its tenants or billing period yourself (a quoted plan changes through us). On an earlier Monitor or Automate price you can choose fewer tenants than it came with, and you pay whichever is lower for them: your price or today’s list. Choosing Monitor or Automate moves a plan no longer sold to today’s list. A founding price lock stays a ceiling until it ends: when today’s list comes to less for your tenants you pay the list, and if your tenants change so that the lock comes to less again, you pay the lock. Terms of service

• ImprovedAccepted risk is one state: a finding stays “Risk accepted” after the next assessment. Every acceptance has a review date at most 12 months away (“Never” is gone, and older acceptances without one now review 12 months from this release), Owners, Admins and whoever accepted it are told 14 days before and when it runs out, and Findings → Risk register lists every accepted risk, with Renew, Withdraw and requests to decide.
• ImprovedFindings shows Open and In progress by default, with a Status filter. The list is ordered and paged in the database, so its counts agree at any size; it sorts by due date, age and effort, and has a Quick wins filter. Saved views keep every filter, can be shared with the team, and work on Alerts, Changes, Tenants and the Audit log too. My work lists what is yours.
• NewTeam notes on a finding with @mentions, a short history, Snooze until a date or the next assessment (it still counts in the score), and a notice when a finding is given to you.
• NewFix targets for the workspace and for each tenant set each finding’s due date, with one meaning of “past due” everywhere. The score simulator shows what fixing the findings you tick would do to the score and each framework, and Turn the roadmap into a plan sets owners and dates by phase in one step.
• NewClaim an alert with “I’m on it”, so everyone sees who is on it; Previous and Next on an alert; drift in pages, with bulk Mark seen; and a tenant filter you can search.
• ImprovedHome counts the changes waiting for you, shows what Automate would have fixed instead of a locked page, remembers Everyone or My tenants, and Later, Mark seen, Mark handled and Mark done each have Undo. Anyone who cannot choose the plan can Ask the Owner from a locked prompt.
• ImprovedThe trial’s days left show on a phone and with the sidebar folded; phones have the New menu and Scan; notifications are read when you open them, with Unread and kind filters; recent tenants are the same everywhere; and ? lists the keyboard shortcuts, / searches and g then a letter jumps to a page.
• NewYour workspace’s own time zone and date format, in Settings → Workspace, for the console’s dates, the night window and tenant reports. Each member chooses which notices they get, in the bell and by email, and can keep them to their own tenants, in Settings → Profile.
• NewA Profile page for your name, address and notices; invitations whose link has run out no longer take a seat, and can be sent again; Team shows each member’s two-step verification; and Settings → Security checks the workspace itself: two-step coverage, how many Owners, single sign-on, API keys and unconfirmed addresses.

• NewPeople: tick rows to give a licence, add to a group, block or unblock, sign out everywhere or offboard several leavers at once. Joiner templates for each tenant, Import starters from a CSV or Excel file checked row by row, Unblock for someone blocked, usage location from the tenant’s country, a No MFA filter and an export.
• NewDevices: a search box and Non-compliant and Not encrypted filters; a person’s devices on their panel; Lost phone from the person (sign out everywhere, then lock, retire or wipe the device, and mark it lost); remote lock; Sync and remind for non-compliant devices; and warranty lookup from Dell, Lenovo and HP (beta).
• NewLicences, guests and mail: Add seats where Partner Center sells the licence, a renewal calendar with the seats to reclaim first, guests waiting to accept and Remove guest, mailbox sizes with a Nearly full filter, forwarding, distribution lists, calendar access and new shared mailboxes.
• NewTenants: the consent queue puts whoever has waited longest first, emails the consent request and chases everyone waiting over a week; Connect several at once by pasting domains; the connect page shows the tenant’s public posture while consent is pending; each tenant has a record (notes, contacts with their roles, systems to remove leavers from, its time zone); new tenants get your defaults; the tenant list sets tags and account managers in bulk; and you can find a person by email address across tenants.

• NewThere is a “Forgot password?” link under the password on the sign-in page. Enter your email address and, if an account uses it, a link is on its way. The link works for an hour and once, and the page says the same thing whether or not the address has an account. Sign in
• NewChoosing a new password this way signs you out on every device and emails you a notice that it changed. It does not sign you in: if you use two-step verification, you still need your code at the next sign-in.

• ImprovedThe plans for organisations that run their own Microsoft 365 are now Direct Monitor and Direct Automate, and cost less for smaller organisations: up to 100 staff, £29 or £59 a month; 101 to 300 staff, £69 or £149. The larger bands are unchanged, and a year is still ten months. Pricing
• ImprovedDirect Automate adds a free test tenant, marked Pilot or Lab, to try each fix on first. Direct Monitor covers your own tenant. A verified group still adds the tenants of the organisations it owns. Terms of service
• ImprovedThe Direct prices show the yearly price first, two months free, with the monthly price one click away.
• NewSchools and academy trusts have prices of their own: per school a year, by quote, from £290 for a primary, with a trust fee and a yearly cap for a trust. A school or trust we have verified gets a 30-day trial, then pays yearly by invoice with a purchase order. It never pays more than Direct would charge for its staff. Pricing
• ImprovedConfigCheckup is not registered for VAT yet, so no VAT is charged, and the prices now say so.

• NewEach tenant on an MSP plan covers up to 300 staff users, the same limit Microsoft puts on its Business plans. A larger tenant counts once for every 300, so 1,000 staff users counts as 4, and a tenant with more than 2,000 is on Enterprise. Staff users are counted as for the in-house bands: guests, students, shared mailboxes and disabled accounts don’t count. Pricing
• ImprovedSettings → Plan and billing lists each larger tenant and what it counts as, and fills in the extra tenants your tenants need. If your tenants grow past your plan, Owners are told and have 14 days to add tenants before the workspace turns read-only.

• FixedAfter “Give the roles now” finds or gives the Teams role, Teams is read again straight away where it was refused, so the Teams row on the roles card no longer says “Not assigned yet” while the role is there. A tenant connected with the read-only step is read again the same way once its first assessment finishes.
• ImprovedThe Teams row shows what Microsoft said when Teams refused, says when Teams is being read, and has a Read Teams again button. Where ConfigCheckup could not read which roles the app holds, the row says so rather than “Not assigned yet”.
• FixedRead again no longer does nothing when it is pressed just as an assessment is finishing, and a finding check that reads a source in full clears that source’s gap on the Connection page.

• ImprovedPeople’s views now say what they count: “Active” is now “Can sign in”, “Blocked (leavers)” is now “Blocked”, and “Quiet 90 days” is now “Not used in 90 days”. The numbers guide says what each view and pill means. How the numbers work
• ImprovedShared mailboxes and room or equipment accounts are no longer counted as people. People lists them apart, with a line under the count to show them, and a shared mailbox’s panel links to it in Mailboxes. Until Exchange is set up for a tenant, its shared mailboxes still count as people, and the page says so.
• ImprovedAt a school, staff and pupils are counted apart: choose Everyone, Staff or Pupils above the list. “Not used in 90 days” leaves pupils out, and says how many, unless you choose Pupils.
• Improved“Not used in 90 days” follows the same rule as licence savings and the dormant-account checks: sign-ins through an app count as well as typed ones, only successful sign-ins count where Microsoft returns them, and an account made in the last 90 days is new, not unused. Without sign-in times it lists nobody, its count shows “—” and the page says why. A person’s panel shows when they were last active. How the numbers work
• FixedLicence savings no longer call accounts unused when sign-in times were not read, as happens without Microsoft Entra ID P1. Every account older than 90 days looked unused, so the saving was too high. Licences on blocked accounts are still listed, and Licences says “Unused accounts were not checked”. Savings totals go down for tenants without P1. How the numbers work
• ImprovedThe “Dormant enabled accounts” check gives an account made in the last 90 days time to be used, so a new starter, or a pupil added at the start of term, is no longer dormant on day one. Where Microsoft returns successful sign-ins, only those count, so a failed attempt no longer makes an account look active. “Licences assigned to dormant accounts” follows the same rule and now counts sign-ins through an app too, and so does the “No long-inactive accounts” custom check, which no longer fails for every account when sign-in times were not read: it says they were not read. “Disabled or dormant accounts holding privileged roles” also flags an admin with no successful sign-in for 90 days, or none on record, so failed attempts such as a password spray cannot make a dormant admin look active. Results and scores for these checks may move.
• FixedThe “Guest access exposure” check counts a guest’s sign-ins through an app, as Guests does, so a guest who signed in through an app last week is no longer called dormant.
• Improved“Multi-factor authentication registration coverage” recognises more student licences, so at a school it may leave a few more pupil accounts out of its count.
• FixedOffboarding no longer risks a leaver’s mail. When the mailbox cannot be made shared first, because Exchange automation is not set up for the tenant or making it shared fails, their licences are kept, and so are the groups that give them a licence, so Microsoft does not delete the mailbox 30 days later. Without Exchange automation, “Remove their licences” starts unticked and says why. The dry run says the mail is kept only when the mailbox really is made shared first, and warns when removing a licence will delete it.
• ImprovedOffboarding someone who holds an admin role, or who is in a group that can hold one, now needs two different people to approve it, as a password reset for them already did. So does offboarding someone whose roles could not be read. The dry run says why. In a workspace with one approver, remove the role in Entra ID first. Turn on automation
• FixedTaking someone out of a group that can hold admin roles is now left out of the dry run, as adding them already was, so a removal that runs without approval can never take an admin role away; change those groups in Entra ID. When every part of a change is skipped for the same reason, it says that reason, such as “Nothing to change: Already disabled.”
• FixedTaking someone’s Send on Behalf access away now matches them exactly, by their address, sign-in name or Exchange’s own name for them, never by part of a name. Removing Ann no longer takes Joann off the list, and Ann is found when Exchange lists her by name.
• FixedMailboxes no longer match access by a display name two people share, so the x cannot take the wrong Sam Smith’s access away; it asks who is meant instead. Rooms and equipment are labelled as such, Full Access warns only on a person’s own mailbox, and “Give mailbox access” is there whenever it can be used.
• FixedRolling back a guest invitation no longer deletes a guest who was already in the directory under another address. Only a guest the invitation created is removed.
• FixedGroups Microsoft would refuse are no longer offered. Mail-enabled security groups are left out of the group lists, and a change that meets one skips it with “change its members in Exchange”. A new Microsoft 365 group needs at least one owner and takes up to 20 owners and members; add the rest from its panel once it exists.
• ImprovedChanges have clear size limits: up to 200 accounts in a licence removal, 50 people when giving a licence, and 100 people or 200 memberships when adding people to groups. A list that is too long says “Choose 50 or fewer. Send the rest as a second change.” rather than “Check the form”. Reclaiming a saving for more than 200 accounts takes the first 200 and says how many are left.
• NewBefore you start a change, Users & mail says how many people will approve it: “1 approver” or “2 approvers”. Where nobody in your workspace can, it says “Can’t be approved here”, why, and what would change that, in the tenant’s Changes › Automation or in Settings › Team, and the button is off. The People panel says how many people approve changes at the tenant. Turn on automation
• ImprovedChange titles name what changes, such as “Give Microsoft 365 A1 to 12 people”, “Remove Ann Lee from Year 4 Team” or “Remove Ann Lee’s access to Office”, not “Add people to a group”.
• FixedA form that fails keeps what you ticked: an unticked “Remove their MFA methods” no longer comes back ticked after an error.
• ImprovedA person’s panel offers only what can work: no Block for someone already blocked or synced from Active Directory (block them there), no “Remove a licence” for someone who holds none, “Finish offboarding” for someone already blocked, and “Give mailbox access” leads to Settings when Exchange is not set up. A blocked guest is not offered a group.
• NewA person’s panel reads them live from Microsoft as it opens, and stores nothing: their manager, phone numbers and email addresses, and the groups they are in directly. Each group has an x that takes them out straight away, or a label saying where to change it instead. Where Exchange automation is set up, mailbox access can be taken away from their panel too. The DPA and the data protection page list what is read this way.
• ImprovedOffboarding fills in their manager as who takes over, “Add to a group” cannot choose a group they are already in, and the reset form asks you to check it is them by calling back on a number on file.
• ImprovedOffboarding, password reset, New user, New group, Set up like a colleague, Block dormant guests and reclaiming a saving now stay on the page and show the result, with a link to the change. A form that worked shows Done and cannot be sent twice. Taking someone out of a group shows Removing, then Removed or why not, or Waiting where automation is off or paused, and the page says while Microsoft is being read back.
• ImprovedWhen the latest assessment could not read a tenant’s people, groups, licences or mailbox access, each tab shows the last read that worked and says so, with Microsoft’s words. Each tab’s “read …” time is now when Microsoft was actually read, so a fix check or a partial run no longer makes old data look new.
• ImprovedPeople rows show each person’s department or job and when they were last active, and pills appear only where something needs doing, such as “Paid licence still on” for a leaver. Names sort by number, so “Employee 2” comes before “Employee 10”, and every list shows its range, such as “41–80 of 1,901”.
• ImprovedSearching People looks through everyone, by email address too and word by word, so a leaver is found from the first view, marked Blocked. When only one person matches, their panel opens. Guests are searched the same way, Licences can be searched, and the command palette finds people by email address and opens guests in Guests. “Leavers not fully offboarded” opens People on Blocked.
• ImprovedLong tick lists, such as Groups › Add members, can be filtered, say how many are chosen against the change’s limit, and can tick everything shown or show only what is chosen.
• ImprovedClosing a person, group, guest, licence or mailbox brings you back to its row, and focus moves into a panel as it opens. As on Findings, J and K move between rows, Escape closes the panel and / goes to the search. People and Guests have Copy address.
• ImprovedLicences in Microsoft’s grace period, or suspended, no longer vanish from Licences while people still hold them. They stay listed by name, marked “Expired: grace period” or “Suspended”, but cannot be given, and a person’s panel names them rather than saying “A licence”. Seat counts stop at “None left”, and names under “Who has it” open that person.
• ImprovedBlock dormant guests recounts as you choose 90, 180 or 365 days, and no longer claims its dry run reads each guest again. Without sign-in times, Dormant and No sign-in recorded list nobody. A guest invited before December 2023 with no successful sign-in on record is no longer called “Never signed in”, since Microsoft records successful sign-ins only from then. The guest export follows the Blocked filter and the search.
• ImprovedThe notice that automation is off or paused shows on every Users & mail tab, and every panel form ends with Cancel, then the button that sends it. Wording is plainer, such as “Has guests”, “Spare seats”, “Country (for licences)” and “Synced from Active Directory”, and screen readers hear each part of a row separately.
• ImprovedThe “Respond to a compromised account” runbook resets the password from People, where an approver sees the one-time password once, and checks MFA methods in the Entra admin centre as a step of its own.
• FixedOffice 365 A1, priced at zero, is no longer called unpriced in licence savings. A failed dry run no longer ends in “..”. When Microsoft is busy or slow to return sign-in times, the warning says the next assessment tries again, rather than blaming a missing Entra ID P1 licence. The command palette offers a password reset only to Technicians and above, who can ask for one.

• NewIf you run IT for your own organisation, choose In-house Monitor or In-house Automate: one price for your organisation, set by its number of staff users, not a charge per user. Each covers your own tenant and a free test tenant; another organisation’s tenant connected later stays readable but is not assessed again until your plan covers it. Say who the workspace is for at sign-up, with a password or with Microsoft, or in Settings → Plan and billing until you buy a plan. Terms of service
• NewYour staff users are counted at each assessment, and Settings → Plan and billing shows them against your band. If your organisation grows past its band, we tell you 60 days ahead, and it moves only at renewal, one band at a time. We never move you down without asking.
• NewAnnual in-house plans can be paid by invoice, with your purchase-order number on it, by bank transfer, Bacs Direct Debit or card.
• ImprovedThe in-house trial covers your own tenant for 14 days, with Cyber Essentials readiness, a board report and the board summary link. Groups such as academy trusts can add the tenants of the organisations they own once we have checked the group.
• NewThe in-house prices have a page of their own: every staff band, In-house Monitor beside In-house Automate, and how staff are counted. Switch between the MSP and in-house plans at the top of the pricing page. Pricing
• ImprovedFor an in-house workspace, the console talks about your tenants, not tenants: the menu, the tenant list, empty pages and plan messages. The read-only portal is your board summary link.

• NewOn the trial and Monitor, run the dry run of a finding’s fix and see exactly what it would change in your tenant. Nothing is changed: applying it comes with Automate, and the step-by-step guide stays beside it. Fixes made through Microsoft Graph show their dry run straight away. Exchange Online and Purview settings are read through the ConfigCheckup Automation app, so their dry runs come with Automate, and the finding says so.
• NewSimulate policies now work on the trial and Monitor. After each assessment they dry-run the fixes they cover, record what would change and change nothing. The Automation page, and an email each Monday, say what Automate would have fixed in the last 7 days, with the list. Turn on automation
• NewTell us at sign-up which tool you use now, and the trial’s prompts and emails offer the switch offer by name. Hosted CIPP is billed monthly, so it is worded for the month you have already paid for. Pricing

• ImprovedThe trial now runs for 14 days from the day your first tenant connects, and you have 30 days from sign-up to connect one, so waiting for a tenant’s consent still costs you nothing. Need longer? The workspace Owner can add 7 days, once, from Settings → Plan and billing. Pricing
• ImprovedThe trial is daily monitoring and alerts, every finding with its fix guide, and reports, on up to 3 tenants with 3 seats. Approved changes, automatic fixes, the API, webhooks, custom rules, white label and tenant replies on the portal come with a plan. Each tenant can have 5 assessments you start and 3 reports a month; scheduled runs and fix checks do not count. Up to 3 leads at once, and 3 lead health checks a month. Pricing
• ImprovedReports made in the trial carry a small “Made with ConfigCheckup · Trial” line. Any plan removes it.
• NewTwo emails before a trial ends, four days and one day before, with what the trial found in your own figures, the price of each plan and a link straight to it.
• ImprovedWhere the trial stops you, the prompt says what the plan that does it costs: applying a fix, adding a fourth tenant (with what all your tenants would cost), inviting a fourth person, the API, and the trial line on reports.
• ImprovedThe switch offer is now free until your old contract ends for up to 2 months, down from 6. It is billed monthly, and does not combine with annual billing or a promotion code. A free period already agreed keeps its date. Pricing
• ImprovedA trial already running keeps the terms it started with, 30 days of everything in Automate with 5 seats, until it ends.

• ImprovedNew prices: Monitor £79 a month for 10 tenants, then £9 a tenant; Automate £229 for 20, then £8; Scale £599 for 75, then £5. A year is still ten months, and what each plan includes is unchanged. Pricing
• ImprovedMonitor now costs less than Automate up to 79 tenants, and Scale costs the least from 68 tenants. Earlier entries saying Monitor and Automate cost the same at 25 tenants, or that Automate costs less past 25, describe the prices before this change. Pricing
• ImprovedA subscription bought before keeps its price and the tenants it includes, also when it changes its extra tenants or billing period. Only choosing another plan moves it to today’s price, and a renewal never raises it.
• NewFounding partners: subscribe while places are left and the price of your plan and of each extra tenant is fixed until 31 October 2029, including when you change your extras. It replaces the founding discount, and there is no code to enter. Pricing
• ImprovedA plan card and the plan picker now name the cheapest bigger plan, not always the next one up: at 80 tenants Monitor’s card points to Scale, which costs less than both. Pricing

• Fixed“Give the roles now” can now give the Teams role. The administrator’s sign-in could not look up ConfigCheckup’s read-only app in the tenant, so Microsoft answered “Insufficient privileges” before the role was ever asked for. ConfigCheckup now finds the app with its own read access, and a refusal says which step Microsoft refused.

• FixedWhere Microsoft will not give ConfigCheckup’s read-only app Teams Reader, “Give the roles now” gives it Global Reader instead. Global Reader is read-only too, and Teams accepts it, so the Teams checks no longer stop at “Insufficient privileges”.
• ImprovedAn app that already holds Global Reader is no longer given Teams Reader as well, and the result says which role it has. The roles card explains that an app’s own Roles and administrators page in Entra lists who may manage the app, not the roles it holds.

• FixedTimes are shown in UK time everywhere: a fix’s progress, when a change runs or tries again, dry runs, emails and reports. Some were in UTC, an hour behind during British Summer Time.

• FixedA dry run no longer says a policy “Does not exist” and then skips it because it does. It shows what is there now, including how an Intune policy is assigned and whether a Conditional Access policy is on, and says “Nothing to create” when everything is already in place. Taking a role away, making roles eligible in PIM, the policy for privileged apps and a leaver’s mail forwarding now show their real starting point too.
• FixedThe Intune policies for BitLocker and the firewall, and for Defender Antivirus, now have names of their own. Both were called “Windows baseline”, so whichever was created first stopped the other, and the fix for “Devices without disk encryption” could create nothing.

• Fixed“Give the roles now” no longer stops at “Insufficient privileges” in tenants that use Privileged Identity Management. A role Microsoft will not give directly is given through PIM, active and permanent, and a role the app holds only as eligible, which an app cannot use, is replaced with an active one.
• ImprovedWhen a role still cannot be given, the message says why, including when the tenant’s PIM settings allow no permanent active assignment, and how to give it by hand as an active, permanent assignment.

• NewStock-takes: walk round scanning labels with a phone camera, a USB scanner or by typing, and see which devices were found and which were not. Finishing can record the ones not found as lost or stolen.
• NewUpdate ticked devices at once (state, location, supplier, purchase date and cost, warranty), or update them from a spreadsheet: export the register, fill it in, and choose it again. Check first to see what would change.
• NewA forecast of devices due for replacement and warranties ending in each of the next four quarters, with costs estimated from what the tenant paid.
• NewEach device’s page shows its history: what was changed, by whom, and when it was found in stock-takes. The register can be filtered by location.
• ImprovedNone of these ever adds a device: a spreadsheet row or scanned code that matches nothing is reported and left out, so no device appears on the register twice. One asset tag can no longer be given to two devices, and existing tags used twice are flagged.
• ImprovedA group’s members are now listed below its actions and details.

• NewOpen a group to see who is in it, read from Microsoft as it opens, with an x beside each person to take them out. Names are shown, never stored.
• ImprovedTaking someone out of a group, or taking someone’s access to a mailbox away, now runs straight away without approval, after its dry run. Mailboxes have the same x beside each person with access. Each removal is a change in the log that can be rolled back.
• NewAsset labels print on Dymo, Brother and Zebra label printers, one label to a page, as well as Avery L7160, L7163, L7651 and US Letter 5160 sheets.
• NewDownload asset labels as a PDF at the exact size of the label stock, for printing from a label printer’s own software or wherever a browser scales the page.
• ImprovedThe label stock you choose is remembered, and Print on the register, or Print this label again on a device, opens the print window straight away.

• FixedA tenant whose administrator had accepted the automation permissions could still show them as not granted. “Check again” now records the automation consent within seconds, even while Exchange Online is slow to answer, and Exchange is checked on its own afterwards.
• FixedConditional Access fixes failed with “required scopes are missing in the token” although ConfigCheckup Automation held Policy.ReadWrite.ConditionalAccess: Microsoft also requires Policy.Read.All on the app making the change. ConfigCheckup Automation now asks for it, lists it among its permissions, and a fix that needs it says so, with where to add it.
• FixedAfter the one-step role setup, the Compliance Administrator row is checked again straight away rather than still saying “Not assigned yet” when the role is in place.
• ImprovedWhen Microsoft refuses to give a role, the message now says whether the account that signed in is an active Global Administrator or Privileged Role Administrator, so an account that is not, or holds the role only as eligible in Privileged Identity Management, is pointed out at once.
• FixedExchange.ManageAsApp no longer shows as not granted after the tenant has accepted it. “Check again” now reads it from the automation app’s Exchange sign-in, so an older answer from before the consent is replaced even while Exchange is slow to run its first command.
• FixedWhen the tenant’s administrator accepts the automation link without a ConfigCheckup account, the acceptance is now checked with Microsoft straight away rather than waiting for someone to check again.

• NewPrint QR asset labels from the asset register onto Avery L7160 or L7651 sheets: tick the devices you want, or print a whole view, starting part-way down a used sheet. Each device keeps its code, so a reprinted label matches the one already on it.
• NewConfigCheckup can number asset tags for devices that have none, from a prefix made from the tenant’s name (Contoso Group Ltd gives CG-0001, CG-0002…) that you can change. Numbering carries on from the highest tag the tenant already has, never changes a tag typed by hand, and the new tags print on the labels.
• NewScan a label with the camera on Scan an asset label (in search, or on the register) to open everything about the device: who has it, purchase and warranty, hardware, support life and disposal. A phone’s own camera works too. Codes, asset tags and serial numbers can be typed in instead, and a label opens nothing outside your workspace.

• NewEach tenant has an asset register under Devices: every device from Intune with its asset tag, purchase date and cost, supplier, warranty, location and state, and a record of how each one was disposed of. Devices are matched by serial number, so a device wiped and enrolled again keeps its record, and book value is worked out over the tenant’s refresh cycle. Export it as CSV or Excel.
• NewA new report type, Device lifecycle: the fleet by support status, what replacing end-of-life devices costs at four budgets and what to buy, a four-year forecast, purchase and book value, warranty, disposals with their certificates, and every device to act on.

• ImprovedA tenant’s Connection page now lists every data source with the checks it is used for, what it needs, and whether access is granted, refused (with Microsoft’s message), missing, or not licensed. The counts at the top say how many permissions are granted and how many checks are waiting on access.

• ImprovedAfter a fix runs, its check now shows when it started and when it will answer, two minutes later at most. It then says Confirmed, Still failing, or Couldn’t read, with the reason and the role or permission that would let it read, instead of checking for up to two hours.
• ImprovedChecks Microsoft re-scores in Secure Score say Waiting for Microsoft, with the date they will be checked once more.

• ImprovedA fix is now dry-run against the tenant before it becomes a change. When the setting is already in place, no change is made, nothing goes for approval, and the finding is read again so it passes on what Microsoft 365 shows now.

• ImprovedEach finding now says whether it was read directly from Microsoft 365 or comes from Microsoft Secure Score, which can be up to 48 hours behind a change.
• FixedA check that can read its setting directly no longer fails on Secure Score’s word alone when that read was not possible. It shows as Unconfirmed: left out of the score, with no fix offered until the setting is read.

• ImprovedThe score dial no longer carries the goal on its bezel; the goal is written in the line beneath it, which reads at any screen resolution. In the light theme the dial is white with the score in ink.
• FixedA fix that finds its setting already in place now says so (“Already in place, so nothing was changed”) instead of “Fixed”, and a check that rests on Secure Score alone, because Exchange Online could not be read, says so in its summary.

• ImprovedThe tenant portal opens with the score on a larger eclipse in your brand colour, with the band, grade and goal beneath it and the open findings, critical or high count and change since the last check beside the title. The free check result follows the same layout.
• ImprovedSign-in, sign-up and the website’s page openings drop the fine grid for the dark band lit by the brand teal.

• ImprovedReports open on a near-black cover lit by your brand colour, with the score on the eclipse. The full report shows it beside the open findings, the score over the last six checks and the hands-on hours; the review pack and the portfolio report put the eclipse alone at the top. Every page after the cover stays white for printing.

• ImprovedThe console, the tenant portal and the website use Geist, with small capital labels in Geist Mono, and open in a near-black dark theme with glass cards. Light is one click away in the theme switch, and System follows your device.
• ImprovedA tenant’s score now sits on the eclipse: a dark dial ringed by a glow in your brand colour. The tenant portal and the free check result open on a dark band lit by your brand.

• ImprovedEvery screen now uses the same text sizes, spacing, corners, shadows and timings, and every icon comes from one set, so pages line up and read the same wherever you are in the console, the portal or the site.
• ImprovedThe tenant portal shows the score over time on the same chart as the console, with the goal and the grade bands.

• ImprovedThe report and review pack covers, the tenant portal, the free check result and the sign-in page show panes of glass instead of fine engraved lines, which shimmered on ordinary 1080p screens. The covers draw it as vector art, so it prints crisply.
• FixedA long primary domain on a report cover stays inside its box: its column widens, and the name breaks at a dot if it still does not fit.

• ImprovedPage headers on the public site are light in the light theme and midnight in the dark one, instead of a dark band over a light page, and the changelog lists its months in a rail beside the releases.
• ImprovedThe comparison page sets ConfigCheckup beside Microsoft Secure Score and beside checking tenants by hand in the admin centres, instead of beside other vendors. Every Secure Score statement links to Microsoft’s own documentation, and the page says how the two work together: ConfigCheckup shows each tenant’s Secure Score recommendations as findings. Compare

• ImprovedOn a phone, the Needs you list shows the whole tenant name and task over two lines instead of cutting them off, and the mailbox search box takes the full width.
• ImprovedAccess reviews lists tenants that have not started one together, instead of repeating “Portal off · Never · Not scheduled” on every row.
• ImprovedHome and the tenant list count tenants, not tenants, to match the menu.
• ImprovedA page that cannot be found now fills the page, with a link back to Home and to your tenants.

• ImprovedThe report cover is now full bleed in your colour, with a fine engraving and the score as a watch-face dial on glass, its goal marked on the bezel.
• ImprovedThe tenant portal opens on the same: your colour, the engraving, and the tenant’s score on its glass dial, so the portal and the report look like one product.
• ImprovedA tenant’s Overview shows its score on the glass dial, and the free health check result shows a prospect’s score on your colour.

• ImprovedInter 4 with optical sizes: large headings take a tighter display cut, and a tailed l tells l, I and 1 apart in account names and IDs.
• ImprovedIn dark mode, primary buttons are a deep teal with white text rather than a bright mint slab, and pages, cards and the sidebar sit on clearer steps.
• ImprovedPassing green and the warning yellow now read clearly apart from the brand teal and from Medium findings, still with a word beside every colour.

• NewOn Alerts › Drift, Put it back drafts each drifted control’s own fix for approval, reusing one already open; controls without an automated fix are counted for doing by hand.
• NewA signed access review can draft its removals in one step: admin roles removed, guests disabled and apps blocked, each a change that needs approval. Each removal then shows Gone or Still there from the next assessment, rather than a box someone ticked.
• NewOn Alert rules, switch on automatic containment for every tenant with a tag, approved by you, with each tenant’s emergency access accounts left out.
• ImprovedPropose fix now sends the change for approval as soon as its dry run passes, as Fix this on a finding does; a failed dry run stays a draft with the reason.
• ImprovedAsking devices to check in can be part of a Fix automatically policy: it changes nothing on the device, so there is nothing to undo.
• ImprovedAutomation › Policies also lists every tenant that drafts fixes or contains accounts by itself, so everything that runs on its own is in one place. Waiting on set-up offers to grant the automation permissions to many GDAP tenants with one Partner Center sign-in.

• NewOn Findings, tick findings and choose Check again now: the data behind each is read again and re-scored, with nothing changed in the tenant. Each updates in place as its check finishes.
• NewWith automation in your plan, tick findings and choose Draft fixes: up to 25 at once, each dry-run first and still needing approval. Findings without an automated fix are left out and counted.
• NewCreate and check now on a new baseline reads its checks again at every tenant it covers, so you see who meets it in a minute or two. Each baseline also has Check now.
• ImprovedAdding an automation policy, the name is optional (it is named for what it does), and one click ticks every check whose fix can run on its own.
• ImprovedTurning on automatic containment for a tenant, the accounts never to contain are filled in with the emergency access accounts its last assessment found, for you to check before saving.

• NewOn Schedules, set one assessment schedule for every tenant the list shows (its tag, search and view, across all its pages) in one step, or turn schedules off for them. Tenants waiting for consent are left as they are, and Undo on the confirmation puts every tenant back for 15 minutes.
• NewEmail a quote to the tenant from the quote itself: every line with its hours, the total excluding VAT and how long it stands are in the email, replies come to you, and the quote is marked sent unless it already has an answer.
• ImprovedThe audit log reads as sentences, such as “Approved a change” or “Emailed quote Q-0012 to 2 people”, with who did it and at which tenant beside each. The raw record is a click away, and the export carries the sentence too.
• ImprovedUpgrade to a plan from a locked page and Plan and billing opens with that plan already chosen and in view.

• ImprovedConnecting a tenant, tag it as you add it, and (with automation in your plan) ask for the automation consent at the same time: its link appears beside the read-only one, for the same administrator. It changes nothing by itself; automation stays off until an Admin switches it on.
• ImprovedImporting from Partner Center, give every tenant one tag and one owner in the same step.
• NewEach tenant’s Overview says what needs doing there, what runs by itself (automation, drafting, containment and policies) and what is waiting on the tenant (consent, an access review, a quote), each plainly saying so when there is nothing.

• ImprovedNeeds you is first on Home, grouped by kind (security events, connections, changes to approve, drift, tenant replies and so on) with a count for each, the most urgent first. Long groups show their first few and the rest are a click away.
• NewAct from the row: approve a waiting change against the dry run it shows, run a missed assessment, copy a tenant’s consent link, or mark drift and replies seen. A password reset, a full wipe and any change that asks you to type a name still open their own page.
• NewPut a Needs you item aside until tomorrow or for a week. It is put aside for you only, and comes back by itself; “put aside by you” lists them, with Bring back.
• NewHome shows the checks failing at two or more tenants that can be fixed across them, worst first, and an Admin can invite a teammate from the Team card, which shows the seats used and invitations not yet accepted.
• NewAlerts lists drift as well as security events: a Drift filter shows each tenant whose controls stopped passing between assessments, which controls, and since when, with Mark seen. It can be exported.
• ImprovedAlerts is a table, with Dealt with on each event (one click, for that event alone), and each account-takeover event says whether the account was contained, is waiting for approval, or can be contained from the event.
• ImprovedOn Findings, set a finding’s owner and due date together from its panel, or for every ticked finding from the bulk bar. After updating a finding, Next finding takes you straight to the one after it. A Not assessed filter lists the checks that could not be read, apart from those failing.
• ImprovedAll changes is the one place to approve several at once: tick the changes whose dry run you have checked and approve them together. Each is approved against the dry run on its row, and refused if it has been run again since with a different result. Every change says what happens next: how many approvals it still needs, when it runs, and how long its check is re-run for.

• NewSearch (Ctrl+K) can do things as well as find them: assess or check the connection of the tenant you are on, approve waiting changes, build a report, set up a new starter, offboard a leaver, reset a password, restore a policy, apply a template, make a quote, connect a tenant or invite a teammate. Each shows only to the roles that can use it, one your plan lacks says so, and anything that changes a tenant opens its page with the dry run and approval as usual. With nothing typed it offers your three most likely.
• NewOn a tenant’s page, search finds its people by name or sign-in address and opens their panel.
• ImprovedQuotes lists every quote at every tenant, with its status and value, and what is accepted and waiting in total. Licence savings ranks your tenants by what they could save a year, the same figure as each tenant’s Licences page. Access reviews lists each tenant’s last signed review, the one waiting and when it is due, and the next quarterly one, overdue first. Each can be exported as CSV or Excel.
• ImprovedA finding with an automated fix links to fixing the same check at every tenant that fails it. Alerts › Alert rules shows which tenants contain a taken-over account automatically.
• ImprovedA tenant’s Actions menu is a secondary button and no longer offers “Refresh device data”, which ran the same assessment as “Run assessment”. Breadcrumbs no longer repeat a name (“Alerts › Alert”, not “Alerts › Alerts › Alert”), and a tenant’s page headings no longer repeat its name.

• ImprovedThe menu is grouped by what you do: Work (Alerts, Changes and Findings), Reporting (Reports and Compliance) and Growth (Leads and savings). Changes has two tabs, All changes and Automation (it was Auto-fix); Templates, Runbooks and Backups are still found from search, Home and each tenant. Findings has a Fix across tenants tab, Reports’ first tab is called Reports, and Insurance is found from search and each tenant’s Compliance tab.
• ImprovedTenants shows a Waiting for consent tab while a tenant is waiting for its administrator to consent, and not otherwise.
• ImprovedA tenant’s automation has its own page, Changes › Automation: switching it on, who approves, drafting and pausing, and automatic containment, beside the changes they control. The tenant’s Settings page points there. Its Exchange, Teams and Purview roles stay on Settings, under Permissions.
• ImprovedA tenant’s connection health has its own page under the Overview tab, with a one-line summary on the Overview: what the latest assessment read, each data source and Microsoft’s own lists.
• ImprovedA tenant’s Devices tab opens on the device list; the cost at each budget, what to buy and the forecast are on its new Replacement plan tab. Its Reports tab has Reports and Quotes; licence savings are on Users & mail › Licences, where the old address now leads.
• ImprovedWhere alerts go and whether drift and security event alerts are on are set on Alerts › Alert rules, beside the rules that raise them. The free check page is part of Leads and savings. Settings is grouped as Workspace, People, You, Checks and Connections, and the New menu can start a new starter or a leaver.
• ImprovedEvery old address still works and goes straight to the new page: Changes › Auto-fix, the free check page under Settings, and a tenant’s Licence savings.

• Improved“Fix this” on a finding now starts the dry run at once and shows it on the finding when it is done, instead of holding the page while it runs and then sending you to the change. A change that only adds, or changes nothing, then runs. Otherwise, where your role may approve it and the tenant needs one approver, “Approve and run” approves it against the dry run you are shown and runs it straight away; where it needs someone else, “Send for approval” sends it. Nothing is skipped: the same dry run, checks before it runs, read-back, rollback plan and audit log. Turn on automation
• ImprovedWhile a fix runs, its finding says how long a change like it usually takes, from your workspace’s own recent runs, and links to the change to follow it.

• ImprovedA check whose fix needs a licence the tenant does not have is no longer listed as a finding or counted in the score: Intune settings without Intune, DLP and sensitivity labels without Microsoft Purview, Safe Links and Safe Attachments without Defender for Office 365, named locations and password protection without Entra ID P1, a year of audit records without Audit (Premium), and Conditional Access for apps without Workload ID. Each is kept as not applicable, with the licence it needs and the subscriptions that include it. Where the licences could not be read, nothing is hidden. It takes effect at each tenant’s next assessment.
• ImprovedDLP that covers every location only asks for Teams and devices where the tenant is licensed for DLP there (Microsoft 365 E5 or E5 Compliance). Legacy sign-in on a tenant without Conditional Access now says to turn on security defaults, rather than to create a policy the tenant cannot have.
• FixedA change Microsoft refuses because the tenant is not licensed for it now says so: nothing was changed, and which licence it needs. It used to say Microsoft might have made the change. The DLP policy ConfigCheckup creates leaves out Teams where the tenant is not licensed for DLP in Teams, rather than failing.

• NewA new help guide explains where the console’s numbers come from: the posture score and grades, severity and fix targets, checks that could not run, how fixes are confirmed, drift, framework readiness, Cyber Essentials, insurance answers, service levels, security events and their thresholds, licence savings, Copilot, device budgets, settings backups and plan limits. Every figure in it is read from the product’s own settings, so it says what the product does today. How the numbers work
• ImprovedThe automation guide now takes its timings and limits from the product: how often a fix is checked again, how often drift and security events are read on each plan, the size limit for automatic fixes, how many fixes one assessment drafts, the longest a baseline deviation can run and how long an access pass lasts. It also says plainly that changes to a setting are approved, as removals are. Turn on automation
• ImprovedAsking non-compliant devices to check in with Intune now runs as soon as a Consultant or above asks for it, with no approval, because it changes nothing on the devices. It still has its dry run and an audit log entry naming who asked. Drafted by a policy, a baseline or a fix across tenants, it waits for approval as before. Turn on automation
• ImprovedA change that needs no approval now says why, on its page and in a finding’s fix: “Approval not needed: it only adds” or “Approval not needed: it changes nothing”. The numbers guide can be opened from the command palette (Ctrl+K), and Team’s list of roles ends with how approvals work, under “How this works”.
• FixedSteps for giving ConfigCheckup a role by hand now say to choose an Active assignment: an app cannot activate an Eligible one, so it never took effect. The connect guide also says the administrator’s own role must be active when they accept. Connect a tenant
• FixedReaching your plan’s tenant limit now says you can add tenants to your plan in Settings → Billing, or move to a larger plan, rather than only telling you to upgrade.
• FixedA licence that matches in the billing check now reads “Invoice and seats agree, and every seat is assigned”: the check compares assignments, not whether people use their seats.

• ImprovedEvery status in the console now uses the same words and the same look: a green tick for passing, a red cross for failing, an amber half circle for partly, an amber outline with a clock when a person needs to act (“Waiting for approval”, “Waiting for consent”), a grey spinner while something runs, a dashed outline for not assessed, and plain grey once closed. The brand colour now marks only buttons and “Automated fix”, so a change waiting for approval no longer looks like one that is done, and statuses read in plain words instead of “Pending Approval” or “In Progress”.
• ImprovedSeverity looks the same on findings, alerts and the risk of a change: four bars for Critical, three for High, two for Medium and one for Low, with one colour per level. Critical and High are now easy to tell apart in dark mode, and Low and amber are easier to see in light mode.
• ImprovedA score’s colour and word now follow its grade letter everywhere: A and A- are green and Strong, B+ and B amber and Good, C+ and C orange and Fair, D and E red and Weak, and a tenant never assessed is grey. Scores of 50 to 53, which are a D, now show as red and Weak instead of orange and Fair; no grade changes.
• ImprovedFocus rings are solid wherever they appear, including the sidebar and scrollable tables, input borders are easier to see, and on a phone a field or button reached with the keyboard is never hidden behind the menu bar at the bottom. Sections that fold open now open at once when your device asks for less motion.

• ImprovedNotifications, Team and Leave a review now open with a one-line summary of where things stand, such as how many notifications are new or how many seats are in use, and a “How this works” section you can open on the page instead of leaving for the website. Each ends with the next thing to do.
• ImprovedAsking before something that cannot simply be taken back, such as removing a member, revoking an API key or deleting a tenant, now happens in a dialog of the console’s own: it says what will happen, puts the safe choice first, closes with Escape and returns you to where you were.
• ImprovedWhile a page loads, its outline matches the page that is coming: a settings form for Settings, a list for Notifications, the list and its detail for Findings, instead of the same figures and rows everywhere.

• FixedLicence savings counted a dormant account more than once when it also held a licence that could be downgraded, so the saving shown was too high. A dormant account is now counted once, as a licence to take back, and only active accounts are offered a cheaper licence. Savings in some workspaces will go down: the new figure is the one you can actually make.
• FixedLicence savings now say whose prices they use: your own prices where you have set them, otherwise the UK list price, with a link to set your own. Where your workspace is not in pounds the amounts say they are in GBP.
• FixedCopilot adoption counted a seat given out within the report period when it had been used, but not when it had not, so adoption read higher than it was. Seats that new are now left out of both sides of the figure until they have been held for a full report period, and "Never used" now reads "Not used in the report period".
• FixedAn approved change that is held back, because automation is off for the tenant or it waits for its time, now says "Approved · held" and why, rather than "Pending approval". Home and the Changes badge count only changes that still need someone to approve them, and each change says how many approvals it has and needs.
• FixedAsking for a fix that already has a change waiting now opens that change rather than drafting a second one.
• FixedWording about approval follows each tenant’s setting everywhere: one approver, or two different people where the tenant asks for two. Automation on a plan without it says "Available with Automate".
• FixedTimings in the console now come from what actually runs: the checks after a fix (about 2 hours, or 48 hours for Secure Score), security events every 15 minutes (5 with self-healing), daily drift checks, and the device warning window from your own policy.
• FixedA fix whose check no longer applies to the tenant now says "No longer applies", not "Confirmed: this finding now passes".
• FixedMenus no longer offer a page your role cannot open. Opening one by its address shows which role it needs inside the console, and a record that does not exist shows "We could not find that" inside the console, rather than an error page.
• FixedSet-up problems are described in plain words. The setting names behind them are under Details, for the Owner only.
• FixedHigh security events nobody has dealt with now come first in Home’s Needs you, from the same count as the Alerts badge.
• FixedThe Findings list and its counts leave informational findings out, as the tenant’s Overview does, so the two numbers agree; each group shows how many findings match the filters as well as how many are on the page.
• FixedPosture by area on a tenant’s Overview now shows each area’s weighted score, scored like the posture score. An older assessment without area scores says it is showing a count of checks passing.
• FixedAccepting a risk now says what happens: the check leaves the score from the next assessment, and frameworks still show it as not met.
• FixedA scheduled assessment or tenant report whose date has passed now says "Overdue since" that date, rather than "Next" a date in the past.
• FixedLinks to a tenant use its name in the address everywhere. A tenant’s Alerts tab no longer shows a removable filter for the tenant itself. Check now on a stalled consent check is offered to Admins and Owners, who can use it.
• FixedOn a phone, the item you move to with the keyboard is no longer hidden under the bottom bar. Focus rings are solid everywhere, and the edges of inputs and drop-downs are easier to see, in light and dark.
• FixedChanges waiting for approval no longer say they expire: they stay open until someone approves, rejects or cancels them.

• FixedA change that stops answering is now closed 10 minutes after its own 20-minute limit, failed with the reason, so the next change for the tenant can start. What it did before then stays recorded on its page and can be rolled back. Each change also writes a step-by-step trace to the worker log, including every Exchange command and how long it waited and took, so a slow change shows where the time went.

• ImprovedThe tour on the demo page now follows the console as it is today, in 12 steps and about two minutes of recorded voice: connecting a tenant, the evidence behind a finding, the dry run and approval, fixing one check at every tenant, reports, the tenant portal, alerts including Microsoft Defender, and your own alert rules. 2-minute tour

• ImprovedA tenant’s Users & mail tab is now People, Groups, Mailboxes, Guests and Licences, each the same way round: counts that filter the list, a search, and a panel for the person, group, mailbox, guest or licence you choose, with what can be done as buttons. Leavers are a filter and an action on People. The old addresses still work. Turn on automation
• NewChanges that only add now run straight away when a Consultant or above asks for them, with no approval: a new user or group, adding people to groups and Teams, a group owner, a licence, mailbox access (Full Access, Send As or Send on Behalf) and inviting a guest. Each still has its dry run, read-back, rollback and audit log entry. Removing, disabling, signing out, resetting a password and offboarding still go to an approver, under each tenant’s one- or two-person setting. Turn on automation
• NewNew from the panels: add people to groups, remove them, give and remove licences, give and remove mailbox access, invite a guest, block sign-in and sign someone out everywhere.
• NewWhere a tenant has Temporary Access Pass switched off, give a new user a temporary password instead, from the change’s page: they must change it when they first sign in, it is shown once with a copy button, and it is never stored or logged. Turn on automation

• ImprovedThe comparison with Lighthouse, CIPP, Inforcer, Augmentt and Octiga is brought up to date on both sides. It now shows what ConfigCheckup has added, such as fixing one check across tenants, settings backup and restore, report schedules sent to your PSA, Microsoft Defender alerts and an API that drafts changes, and says plainly where it is still behind, such as consent one tenant at a time. Cells for the other tools now include their report builders and customer reports, test suites, alerts, licence tools and fixes across tenants, each linked to the vendor’s own page. Compare

• FixedWhen Exchange Online or Microsoft Teams turns ConfigCheckup away, the tenant’s Data sources no longer say “Consent is re-run from Settings”. They name the role that is missing and the ConfigCheckup app it is missing on (Exchange Administrator on ConfigCheckup Automation, Teams Reader on the read-only ConfigCheckup app), say whether the app holds it not at all, only as eligible in Privileged Identity Management (which an app cannot activate), or as active but not yet applied by Microsoft, quote what Microsoft said, and link straight to Settings → Permissions → Roles to give it.
• ImprovedA source Microsoft answered too slowly for, or kept asking ConfigCheckup to slow down for, is shown as such, with “Read again” to read just that source now; the rest of the assessment is kept. The Settings roles card shows a Teams Reader that is only eligible, or given but not applied yet.
• FixedExchange Online mailbox access and organisation settings no longer go unread when Exchange is slow: each stops at its own time limit and keeps what it read, a single command Exchange refuses no longer marks the whole source as missing a role, and settings two checks share are asked for once. Where reported Teams messages go no longer waits behind the mailbox reads, which could leave all of Teams unread. Test data sources now reads Exchange too, and an Exchange refusal in an assessment has Exchange checked again.

• NewIntune configuration profiles (the template profiles) and the cross-tenant access defaults are now backed up with the other settings, the last versions of each kept. Conditional Access and settings backup
• NewPut back user and guest permissions, security defaults, the cross-tenant access defaults, and Intune compliance policies and configuration profiles from a backup, as an approved change with a dry run and a way back. The authentication methods policy, Intune policies deleted from the tenant and Intune profiles holding keys or certificates are still compared and set back by hand. Conditional Access and settings backup

• ImprovedWhere role setup and the administrator sign-in at consent are both on, turning on automation now gives the Exchange, Teams and Purview roles in the same step. The sign-in after the automation consent, which records who consented, also asks for permission to assign roles, and ConfigCheckup gives them there and then as that administrator. No separate “Give the roles now” step is needed then; it stays under Settings → Permissions → Roles for trying again. Connect a tenant

• NewAdmins can connect GDAP tenants in bulk from Tenants → Connect a tenant → Partner Center: sign in once as your partner admin, tick the tenants, and ConfigCheckup gives its read-only permissions in each, as you, with the automation permissions and the roles too if you tick them. Your sign-in is deleted when the run ends, the permissions it needed in each tenant are taken off again, and every tenant’s outcome is audited. Connect a tenant

• NewSecurity events now include Microsoft Defender XDR alerts where the tenant has Defender: a suspicious forwarding or inbox rule, files downloaded in bulk, malware, a phishing link clicked and the rest. Each medium or high alert is raised once, with Microsoft’s title, category, severity and status, the accounts, mailboxes, devices and apps it names (never mail or file content), a link to the alert in Defender, and containment where an account is involved. A tenant whose Defender alerts cannot be read, for want of a licence or the permission, is listed as such on Alerts and on the tenant’s page, never shown as having none.
• NewWrite your own alert rules over each tenant’s Entra ID audit log on the Alert rules page: match an activity (pick one or type any), a category, the result, who made the change (a person or an app, leaving out ConfigCheckup’s own) and what it was done to. Each rule has a severity, can be limited to tenants with a tag, and switches on and off. Matches become security events under the rule’s name, with the fields that matched. Up to 25 rules, each raising at most 10 events for one tenant in an hour; part of custom rules.
• NewFive more detections from the audit log: consent to an app from an unverified publisher (high when it can read mail or files), someone added to a group that holds admin roles, the authentication methods policy changed, a guest given a directory role, and a Conditional Access policy switched off or to report-only, now raised as high rather than as an ordinary change.
• ImprovedOn plans with self-healing, each tenant’s audit and sign-in logs and Defender alerts are now checked every 5 minutes rather than 15. The extra checks wait behind scheduled assessments, so they never hold up other work, and no tenant goes longer than 15 minutes between checks.

• NewA baseline can now act when a tenant falls short. Leave it on report only, as every existing baseline is; let it draft each missing fix for approval, once per check and tenant, with a dry run like any other change; or let it fix automatically where the automatic-fix safeguards allow (fixes that can be undone and are not high-risk, after a clean dry run, within a size limit) and draft the rest. It acts after each assessment and as soon as a drift check or a re-check finds one of its checks newly failing. Turn on automation
• NewBaselines hold the values their fixes use: the MTA-STS mode, the partner domains people may share with, the office IP ranges, the label for groups and more, entered with the same inputs as on the finding and checked the same way. Values and report only work on every plan.
• NewAccept a deviation for a tenant and a check, with the reason and a date it runs out, at most 12 months away. Until then the check counts as met with an exception and nothing is drafted or run for it; when it runs out, admins and whoever accepted it are told and it counts again.
• ImprovedA baseline’s page shows each tenant as meeting it, meeting it with an exception (and until when), not met (with the fix that is drafted or waiting) or couldn’t be checked, which never counts as met, and a trend of how many tenants meet it.

• ImprovedThe website is rebuilt around the product itself: readable close-ups of real console screens, numbered to show what matters, in place of shrunken whole windows. The menu follows the same four jobs as the console: see every tenant, fix safely, prove it to tenants, and grow the account.
• NewA page on how changes stay safe, from the dry run to the way back, with every kind of change listed and whether it can be undone or always needs two people. A searchable page of every check, with its frameworks and whether it has an approved fix. New pages for baselines, account takeover alerts, and leavers and helpdesk tasks.
• ImprovedEvery figure on the site is read from the product, so it cannot drift. The data protection page lists every permission and admin role a tenant gives, including the Exchange role. Help guides end with where to go next.
• ImprovedDark mode has depth again, the type is easier to read on phones, nothing on the page waits to fade in, and the decorative movement is gone.

• FixedAn approved Exchange Online or Purview change no longer sits on “Executing” while an assessment reads the same tenant’s Exchange (mailbox access can be hundreds of requests). A change’s requests now go ahead of the assessment’s, so it runs straight away and the tenant’s other changes are no longer held “Queued” behind it.

• NewNew user, on a tenant’s People page: enter their name, sign-in address, job title and department, tick their licences and pick their groups, and ConfigCheckup drafts it as one change with a dry run first. The dry run refuses a domain the tenant does not own, an address already in use, a group that grants an admin role and a licence that has run out. Nobody sees a password: once it runs, issue a one-time access pass from the change’s page for their first sign-in.
• NewNew group, on a tenant’s Groups page: a security group, or a private Microsoft 365 group, with its owners and members, as one approved change. Rolling back either change deletes what it created; Microsoft keeps it restorable for 30 days.

• FixedEvery kind of background job now has a time limit, so one that hangs no longer holds up the work queued behind it. A report whose PDF does not finish printing in 5 minutes stops and says so, and the next one starts.
• FixedOne tenant whose scheduled assessment cannot be queued no longer stops scheduled assessments for every other tenant, and a regular check that fails three times comes back on its own instead of waiting for a restart.
• ImprovedAlerts shows 50 events a page with full counts, and opens in about a quarter of the time with many tenants. The Reports, Changes and tenant overview pages read less and open faster.
• ImprovedWhen a page fails to load, the menu stays and the page says so, instead of the whole console disappearing.

• NewConnect a tenant’s Azure DNS without making an app registration or a secret: on the tenant’s Settings, under DNS host, choose Connect Azure DNS and sign in as an Owner or User Access Administrator of their Azure subscription. ConfigCheckup finds the DNS zones for the tenant’s own domains and gives the ConfigCheckup Automation app the DNS Zone Contributor role on those zones only, as that person, so Azure’s activity log shows who did it. SPF and DMARC fixes are then approved changes as before.
• ImprovedWhen the one-step role setup is refused, it now says that a role only eligible in Privileged Identity Management has to be activated before signing in.

• FixedAn approved change no longer sits “Queued” behind a finding check or the background security, drift and backup reads. Changes now have a worker slot of their own and start straight away; two changes to the same tenant still run one after the other.
• FixedExchange Online organisation settings no longer go unread when Exchange is slow. They are read before mailbox access, which had been taking Exchange’s attention first, and what is read in time is kept: any setting Exchange did not answer by then shows as not checked and is read again next time.
• ImprovedMailbox access now covers every mailbox over successive assessments. Each one reads Full Access first on the mailboxes the last one did not reach, and keeps the Full Access an earlier assessment found on the rest, marked with when it was read. The Mailboxes page and its export show which. Connect a tenant
• FixedTeams Reader now has its own row under Settings → Permissions → Roles, with whether the last assessment found it. While it is missing, “Give the roles now” is offered, and gives it with the other roles in one sign-in. “Consent needed” in the Data sources table links straight there.
• FixedThe Data sources table names what Exchange, Teams and Purview need, such as the Exchange Administrator role or Teams Reader, instead of “Public DNS (no permission)”.

• NewChoose how often each tenant’s report goes: monthly on the 1st, as before, quarterly on the 1st of January, April, July and October, or after every assessment. Set it in the tenant’s settings or for every tenant at once under Reports › Schedules. A report is never sent twice for the same month, quarter or assessment.
• NewPost a tenant’s report to HaloPSA, ConnectWise Manage, Autotask or NinjaOne as well as, or instead of, emailing it: one ticket for the tenant’s company with the score, what is failing by severity and the report’s 30-day link. If the PSA refuses, the report and the tenant’s settings show its answer, and your Owners and Admins are told. Connect your PSA
• NewA monthly portfolio report for your own team: switch it on under Reports › Schedules and, on the 1st of each month, the portfolio report across every tenant is made and a link to it emailed to your Owners and Admins, or the members you choose. Each month’s copy is kept and opens in ConfigCheckup once signed in. Off unless you turn it on. Exporting your data
• NewAPI keys can now draft changes: give a key the new changes:draft scope and it can turn a finding into a change, with the dry run against the live tenant, as Propose automated fix does. For a fix that needs a choice, such as office IP ranges, send the choice with it. A key never approves or runs a change; people do that in the console, and each draft is recorded in the audit log as made by the key for the person who created it. Needs the Automate plan. Developers
• NewThe API also reads changes, with their dry run, approvals so far and each run with its read-back and rollback, and baselines, with each check’s result for each tenant. Developers

• NewChange your password under Settings › Security. Changing it signs you out everywhere else, and it is recorded in the audit log.
• ImprovedWrong two-step codes are counted per account, wherever they come from, so a code cannot be guessed by switching networks. Turning on “require two-step verification” for the workspace now ends sessions that began with a password alone.
• ImprovedAn approval stops counting as soon as the person who gave it loses the role that let them, for every kind of change. Moving someone below Admin also revokes the API keys they created.
• FixedA one-time access pass can no longer be issued for an emergency access account that has already been set up. Emails waiting to be sent are now encrypted, so an invitation link cannot be read from a copy of the database. Reports are turned into PDFs with scripts off.
• FixedSigning in with a password picks the workspace whose password matches, so another workspace inviting your address can no longer lock you out.

• NewFix across tenants: where the same check fails at two or more tenants and has an automated fix, Findings offers to fix it at all of them from one screen. Each tenant is listed with whether the fix can be prepared there and, if not, why: no automation consent, automation off or paused, an input it needs, a change already open, or a lead. Tick the tenants, enter any answer once (a DMARC mode, a label, a policy name), and ConfigCheckup drafts one change per tenant in the background, each dry-run against that tenant. Turn on automation
• NewReview every tenant’s dry run and approve them together. Each approval is recorded on its own change, for the dry run you were shown; a tenant that needs two people waits for a second approver, and a failed or changed dry run cannot be approved from there. One row per tenant then shows it waiting, running, done and confirmed, failed with Microsoft’s reason, or rolled back.
• ImprovedEach fix across tenants is kept with who started it, the check, the answers and every tenant’s change, and starting and approving one are in the audit log. A change already open for the check is linked, never drafted twice. Included from Automate.

• FixedAn assessment no longer waits indefinitely for one slow data source. Each has 10 minutes; past that the assessment finishes without it, and its checks show as not assessed, never as passed. Cancelling now stops the reads still running straight away.
• FixedFull Access on mailboxes is read for up to 4 minutes, shared mailboxes first, and the page says how many mailboxes were read. A school’s first assessment with Exchange set up had sat on one step for over 20 minutes.
• FixedThe progress line names the data source the assessment is waiting on, such as “Exchange Online mailbox access and 1 more”, instead of the last one to start.
• FixedA change can no longer stay “running” indefinitely and hold up every change after it for the same tenant. When Exchange or Purview asks ConfigCheckup to wait more than a minute, the command stops waiting and the change engine tries again a few times before giving up cleanly. A change still running after 20 minutes stops, says why, keeps a record of what it did, and can be resumed from its page.
• FixedThe website now says exactly what ConfigCheckup reads and does. It reads settings and activity records (such as sign-ins and the audit log), never content; its one file permission lets an approved offboarding give a leaver’s manager their OneDrive, and no file is opened. It does the common admin jobs as approved changes. Some higher-risk changes always need two approvers. History is kept for your plan’s period. The FAQ no longer compares Automate with itself.
• FixedThe keyboard focus ring is fully opaque, so it stands out at the contrast accessibility guidelines ask for.
• FixedPIM role settings are read again. Microsoft’s PIM service turned the requests away with “Culture is not supported” because they named no language; every request to Microsoft now does.
• FixedPurview is now addressed the way Microsoft’s own PowerShell module addresses it. Purview had answered “Value cannot be null. Parameter name: orgUnit” to every command. Run Check Exchange and Purview on the tenant’s Settings tab to try it again.

• ImprovedThere is no longer a free plan. Every new workspace still gets 30 days of everything in Automate with no card, and then Monitor, Automate or Scale. Every plan has every check, unlimited assessments and unlimited reports in your brand. Pricing
• ImprovedWhen a trial or a subscription ends without a plan chosen, the workspace turns read-only instead of moving to Free: you can still sign in, read every finding and download every report and export, and choosing a plan picks up where you left off.

• NewEvery finding now explains itself in depth: what the setting is and exactly what the check found, how an attacker or an everyday failure takes advantage of it, what it costs a small or medium organisation, and which standards ask for it. Then the fix by hand, step by step in today’s admin centres, ending with how to confirm it worked.
• ImprovedFix times are now the hands-on time an engineer spends, not elapsed time: one setting is 15 minutes, taking a Conditional Access policy from report-only to on about an hour, and only real rollouts (phishing-resistant MFA, PIM, enrolling every device) take 3 to 6 hours. Across all 176 checks, fixing everything by hand now adds up to about 143 hours, down from about 447. Reports, the roadmap, quotes and review packs use the new times.
• FixedThe checks for dormant administrators and administrators without MFA no longer list Microsoft Entra Connect’s sync account, which signs in only in the background and cannot register MFA, and ConfigCheckup never offers to remove its role: doing so stops directory sync.
• FixedFour fix guides corrected: Anyone links (the organisation setting caps every site), who may join devices (user-driven Autopilot needs the person in the group), risk-based Conditional Access (high-risk sign-ins must be blocked, not only asked for MFA), and synchronised administrators.

• NewStraight after the automation consent, Give the roles now signs the tenant’s Global Administrator or Privileged Role Administrator in to Microsoft once more, and ConfigCheckup gives its apps the roles Exchange Online and Teams check: Exchange Administrator for ConfigCheckup Automation, Teams Reader for the read-only app, and Compliance Administrator when Purview automation is on. The assignments are made as that administrator, so Entra’s audit log records them; roles already given are left alone, and Exchange is checked again by itself. ConfigCheckup still never gives itself a role. Connect a tenant
• ImprovedThe sign-in is used once and not kept, and the permission it allows is taken off the app straight afterwards.
• FixedGive the roles now no longer stops with “The token does not identify a work account” after the administrator signs in. If a sign-in fails for any reason, the permission it allowed is still taken off the app.
• FixedWhen Microsoft refuses one of the roles, the message now gives Microsoft’s own reason and how to give that role by hand, instead of always saying the account cannot assign roles.

• NewOn a tenant’s Conditional Access page, a policy that is on now shows what it did over the last 7 days, from the sign-in logs: the sign-ins it applied to, how many it blocked and asked for MFA, who it stopped most and from which apps. It warns when it applied to nobody, excludes no break-glass account, keeps blocking a service or shared account, or blocked older clients that had the right password.
• NewCheck all policies reads the sign-in logs once and checks every policy that is on or report-only, and counts the sign-ins that succeeded with no policy applying to them, by app and by person.
• FixedThe link on a finished Conditional Access, runbook or backup job now opens the page it ran for.

• NewThe portfolio report covers all your tenants, or one tag’s, in one document for your own team or a quarterly review: each tenant’s score, its six-month trend and change since last month, the worst open findings across tenants, the fixes made and how long they took, the licence savings found, and the tenants slipping, with why. Choose Portfolio in the report builder and download it as a PDF, HTML or JSON, in your brand.
• NewEvery table in the console now has Export: CSV and Excel. The file holds what your filters and tag show, every page of it, not just the rows on screen. Each export is recorded in the audit log. Exporting your data
• NewDownload any ready report as JSON: the same figures, findings and evidence its pages are drawn from, for your own charts or records. The API returns it too. Exporting your data
• NewThe API is described in OpenAPI 3.1 at /api/v1/openapi.json, ready for Postman, Insomnia or a code generator, and the API reference is drawn from it, webhook events included. Developers
• ImprovedThe device replacement plan and the invoice check now download as Excel as well as CSV.
• FixedThe webhook signature check on the API reference no longer throws an error when a signature is malformed; it returns false. Developers

• NewConnect a tenant by typing their domain, such as contoso.com, or any email address at it. ConfigCheckup finds their Microsoft 365 tenant as you type, and shows it before anything is added, so there is no tenant ID to look up. A tenant ID or an onmicrosoft.com name still works.
• NewIf a domain cannot be connected you are told why, in plain English: there is no such domain, it is a personal Microsoft account (Outlook.com, Hotmail, Live), or its email is on Google Workspace.
• NewWhen a new tenant’s first assessment finishes, its first report is made for you, in your brand. You get a notification and an email, “Your first report for Contoso is ready”, with a link to download it or send it to the tenant. If you made a report yourself first, no second one is made.
• ImprovedOnce the tenant’s administrator accepts, you go straight to a page that follows the first assessment, showing what is being checked and how long is left, and then the report. If you are their Global Administrator, Grant consent now does it in one click.
• ImprovedA new workspace can connect its first tenant from Home, and Get set up ticks off “First report” and offers to send it to the tenant.
• ImprovedGranting consent again to a tenant that already has a report no longer makes another one by itself. Scheduled assessments still make theirs.

• NewReset someone’s password from a tenant’s Users & mail › People and leavers. ConfigCheckup makes a strong one-time password that they must change when they next sign in, and signs them out everywhere unless you untick it. Once approved, the approver resets it from the change’s page and sees the password there once, to give to the person directly. ConfigCheckup never stores, emails or logs it, so it is gone when the page is refreshed. An account with any admin role always needs two approvers. Turn on automation
• NewWipe or retire a lost, stolen or leaver’s device from a tenant’s Devices tab. Retire, the gentler choice, removes company data and leaves the person’s own. A full wipe needs two different people to approve it in ConfigCheckup, each typing the device’s name, and can never be approved from Teams or Slack. The dry run shows the device, its owner, when it last checked in and the wipe options first. At most five full wipes run per workspace per hour unless an Owner lets one through. Turn on automation
• NewA new Technician role, between Consultant and Admin: Technicians can ask for password resets and device wipes, and approve device actions, without access to billing or workspace settings. Everyone keeps the role they have.
• NewEach tenant’s Settings → Automation now says whether a password reset can be approved from the Teams and Slack buttons. The password is still only shown in ConfigCheckup.

• FixedIntune’s managed devices could not be read in any tenant. ConfigCheckup asked Microsoft Graph for a field that only its preview (beta) version has, so Microsoft refused the whole list and only devices registered in Entra ID were shown. Device compliance, encryption, update and hardware details from Intune are read again.
• FixedStraight after a tenant consents, Microsoft can take a few minutes to apply every permission. The first assessment no longer runs with only some of them, which showed most of the tenant as refused (“Partial access”) until it was run again. It now waits for Microsoft to apply them, for up to three minutes, and says so while it waits.
• FixedConnected apps show their publisher and whether they come from Microsoft, your own organisation or a third party: each app’s details were refused for the same reason as the Intune devices.
• ImprovedWhen Intune devices cannot be read, the message says why: the licence the tenant lacks, the permission it has not granted, or what Microsoft answered.
• FixedTurning on automation could stop at “ConfigCheckup Automation could not sign in to this tenant”, blaming the app’s secret. Microsoft had only said the app was not in the tenant yet, which is what it says before the automation consent is accepted and for a minute after. That now reads as not granted yet, and the check keeps looking while Microsoft adds the app. Turn on automation
• FixedAfter the automation consent, the check could say “taking longer than it should” and give up after five minutes, though Check now showed every permission granted at once. It was waiting on Exchange Online, which can take minutes to answer a new app. The permissions are now recorded straight away, and Exchange is checked separately, within a minute, and again in the background if it is slow.
• ImprovedExchange.ManageAsApp shows as granted as soon as the automation consent is accepted, with the other automation permissions, since the same consent grants it. The Exchange Administrator role is shown separately until an Exchange check confirms it.
• FixedLicence prices: free plans such as Stream and the A1 plans are no longer listed as needing a price, and each licence says which tenants hold it.
• FixedAn approved change could fail with “required scopes are missing in the token” for a permission the tenant had granted. Microsoft had issued a token while the consent was still being applied, and it was kept for its hour. A change now starts with fresh tokens, and any request Microsoft refuses with a token more than a couple of minutes old is asked again once with a fresh one.
• FixedThe tab row under a tenant’s name no longer shows a scroll bar.
• ImprovedTenant replies from the portal, on a tenant’s Settings tab, show the finding each is about: its severity, whether it is still open, and the approved fix. A “Go ahead” can be turned into a proposed fix there, dry-run first, and each reply can be marked handled.

• NewEighteen Teams checks: anonymous join, who bypasses the lobby, who can present, external control of shared screens, meeting chat and recording, chat and calls with other organisations, personal Teams accounts, trial-only tenants, third-party storage, email into channels, which apps people can add, and whether people can report suspicious messages. They need a read-only role: give the ConfigCheckup app the Teams Reader role in the tenant’s Entra admin centre. ConfigCheckup never gives itself a role; until then the Teams checks show as not assessed and say what to do. Connect a tenant
• NewIntune: whether a device with no compliance policy counts as compliant, and whether personal devices can enrol. The enrolment check needs one more read-only permission, DeviceManagementServiceConfig.Read.All; ask the tenant to grant consent again to add it. Connect a tenant
• NewSharePoint and OneDrive: whether external sharing is limited to an allow list of partner domains. Enter the domains on the finding and it becomes an approved change, dry-run first and reversible.
• NewPurview, where Purview is set up for the tenant: whether DLP policies are enforced rather than in test mode, cover Teams and every location, block sharing and tell people why; whether sensitivity labels are published; and whether the alerts for a compromised mail account are on. These read the policies themselves, not Secure Score.
• ImprovedEach new check is mapped to the CIS Microsoft 365 benchmark and CISA’s SCuBA baselines by number, with a fix guide. ConfigCheckup now checks 76% of CIS Microsoft 365 v6 recommendations in full, and 57% of CISA’s SCuBA policies.

• New59 new checks for Entra ID, Exchange Online and Defender for Office 365, from the CIS Microsoft 365 Foundations Benchmark v6.0.0 and CISA’s SCuBA baselines. ConfigCheckup now checks 61% of CIS recommendations in full (up from 21%) and 43% of SCuBA policies (up from 24%).
• NewThe Entra ID checks cover administrator accounts with mailboxes, the idle session timeout, who can join devices and become their local administrator, Windows LAPS, BitLocker key access, guest invitation domains, the Conditional Access policies CIS describes, password protection, system-preferred MFA, PIM approval and alerts, access reviews, and app secrets and certificates.
• NewThe Exchange Online and Defender checks cover sign-in to shared mailboxes, Safe Links, Safe Attachments, impersonation protection, DKIM signing, attachment filtering, domains allowed past spam filtering, outbound sending limits, preset and priority-account protection, mailbox auditing, Outlook add-ins, MailTips, Direct Send and Customer Lockbox.
• New28 of them offer an approved fix from the finding, such as a report-only Conditional Access policy, blocking sign-in to shared mailboxes or turning on Safe Links; DKIM signing is turned on once you choose the domains. Every fix is dry-run first and can be rolled back.
• ImprovedOn a tenant’s Frameworks page, CIS and SCuBA now list every recommendation no check covers in full, so you can see what is left to review by hand.
• ImprovedFive optional read permissions widen the Entra ID checks: device settings, access reviews, guest invitation domains, Microsoft 365 app and trial settings, and Microsoft Forms. Ask the tenant to grant consent again to use them; until then those checks say “not checked” and why. Connect a tenant
• ImprovedExchange Online settings ConfigCheckup reads itself, such as MailTips and modern authentication, are no longer listed again as separate Secure Score findings.

• NewThe tenants you opened last are listed under Tenants in the menu, each with its grade, so getting back to one is a single click. On a phone they are in the Menu sheet too.
• ImprovedThe menu is grouped: Home and Tenants, then Work (Findings, Changes, Alerts) and Insight (Reports, Compliance, Leads and savings). Approvals is now called Changes everywhere, as its pages always were.
• ImprovedThe Tenants tabs are down to three: Tenant list, Connect a tenant, and Tags. People, groups, mailboxes, guests, devices, licences, apps and Conditional Access are tabs on each tenant, and search still finds them across tenants.
• NewFold the menu to a rail of icons with the button at its top, or the [ key, to give pages more room. The names show beside the icons as you point at them, and the menu stays folded until you open it again.
• NewA New button in the top bar: connect a tenant, start a report, apply a change template or invite a teammate from any page.

• ImprovedExchange.ManageAsApp is now listed with the other automation permissions on a tenant’s Settings tab, and granted with the same automation consent, instead of in a section of its own. Underneath, “Roles in this tenant” shows whether the Exchange Administrator and Compliance Administrator roles are working, with what Microsoft said. Connect a tenant
• FixedPurview automation answered “fetch failed” in every tenant. Microsoft sends the first call on to an address that cannot be reached from outside; ConfigCheckup now goes to the same region’s public address, as Microsoft’s own PowerShell module does. Connect a tenant
• ImprovedWhen Exchange Online or Purview cannot be reached or refuses the app, the message names the app Microsoft signed in, with its app ID, and which address could not be reached and why.
• NewA change that was refused before it changed anything, such as for a permission or a server setting, now has Try again on its page. The dry run is checked against the tenant first, and anything that changed since it was approved needs approving again.
• FixedA worker set up without the ConfigCheckup Automation app’s settings refused changes for permissions the tenant had granted, and could record Exchange as not set up. It now says exactly which settings are missing, and leaves Exchange and Purview as the console last found them.

• ImprovedMonitor is now about watching every tenant: daily checks, drift and takeover alerts, unlimited reports in your brand, the live tenant portal and the read API, at the same price. Every change made in a tenant, approved or hands-off, comes with Automate. Pricing
• NewWhat it saves you, on the pricing page: enter how many tenants you look after, how long each takes your team a month and what an hour costs, and see the time and money each plan gives back against its price, and when it pays for itself. Every figure is your estimate to change. Pricing

• ImprovedType how many tenants you look after above the plans, and every plan shows its price for that many, with the included and extra tenants spelled out. Pricing
• ImprovedA plan now says when a bigger plan costs the same or less for your tenants. Past 25 tenants, for example, Automate costs less than Monitor and does more. Pricing
• ImprovedOne table compares the plans: what changes between them first, then every other difference when you ask for it. “Which plan is for me?” now comes before it. Pricing

• NewKaseya BMS joins HaloPSA, ConnectWise, Autotask and NinjaOne for tickets: failing controls become BMS tickets on the tenant’s account, closed with a note when they pass again. Beta: tested against API documentation, not a live account. Connect your PSA
• NewConnect Datto RMM or N-able N-central under Settings › Integrations to match each tenant’s RMM devices with Intune and Entra: devices with an agent that Microsoft 365 does not know, and Windows and Mac devices with no agent. The RMM’s open alerts show beside the tenant. Read only. Beta: tested against API documentation, not a live account. Connect your PSA

• ImprovedNIST CSF 2.0 now covers nearly every check, with each subcategory’s official wording, and CIS Controls v8.1 adds encryption at rest, default accounts, audit log reviews and blocked file types. CMMC Level 2 practices now show their official titles.
• ImprovedEach framework report shows the source and edition it is mapped from. Every readiness figure covers only what Microsoft 365 settings can show; readiness is not certification.

• ImprovedOlder history is kept weekly then monthly. Every assessment is kept in full for 90 days, then one a week up to a year, then one a month. The others keep their score, so your score charts, time to fix and what changed the score look just as they did. Assessments behind a report, a change, an accepted risk or an open review are always kept in full.

• ImprovedThe menu on the left is now the same on every page and for every tenant: Home, Tenants, Findings, Approvals, Alerts, Reports, Compliance, and Leads and savings, with Settings and Help at the bottom. Nothing folds and nothing changes when you open a tenant.
• ImprovedA section’s pages are tabs at the top of the page. Approvals has All changes, Auto-fix, Templates, Runbooks and Backups; Compliance has Frameworks, Baselines, Evidence, Access reviews and Insurance; Reports has Library, New report, Schedules and Service levels.
• ImprovedOpening a tenant shows its name, connection, owner and Actions at the top, then its own tabs: Overview, Findings, Changes, Users & mail, Devices, Alerts, Reports, Compliance and Settings. The ▾ beside the name switches to another tenant and keeps you on the same tab. Press Ctrl+Alt+K to open it.
• ImprovedPeople, groups, mailbox access, guests, devices, licences, connected apps and Conditional Access across all your tenants are under Tenants, as tabs.
• ImprovedTags are now a filter. Choose Tag on the tenant list, findings, approvals, alerts or reports to see only the tenants with that tag. Old links to a tag still work.
• ImprovedThe audit log is now in Settings, and Branding has its own Settings page.
• FixedWhen a tenant’s administrator has accepted the consent and the connection check is still running, the tenant now says “Checking connection” and its next step offers Check now, instead of asking you to connect it again.
• ImprovedOn a phone, the bar at the bottom is Home, Approvals, Alerts, Tenants and Menu. Every old address keeps working.

• ImprovedBreached-account checks through Have I Been Pwned have been removed. Sign-in risk and risky users from Microsoft Entra still flag compromised accounts.

• FixedAn assessment or permission check could sit on “Queued. Starting in a moment…” while connection checks that Microsoft was slow to answer kept being tried again. Connection checks now take at most half of the work slots, so an assessment always has one free.
• FixedRemoving a tenant now cancels its queued checks and assessments, so they no longer keep retrying as “Across the workspace” in the work tray.

• FixedA new tenant could stay on “Checking the connection is taking longer than it should” for hours when Exchange Online was slow to answer. The connection check now finishes within about two minutes whatever Exchange does: the tenant connects from what Microsoft Graph says, and Exchange Online is checked again in the background.

• NewManage › External people (guests) lists each tenant’s guests with when they last signed in and when they were invited, and which have gone quiet. Disable the dormant ones as one approved change, with a dry run first. Across tenants it shows how many guests each has and how many are dormant.
• NewManage › Mailbox access shows who has Full Access, Send As and Send on Behalf on each mailbox, read through Exchange Online where it is set up. Where it is not, the page says so rather than showing nobody.
• NewManage › Groups lists groups and Teams with their owners, members and guests, and flags those with no owner or no members.
• NewAlerts › Alert rules shows which security events raise an alert, where alerts go, and the thresholds for password spraying, password guessing, MFA prompts and mass deletions. Admins can switch rules off and change the thresholds.
• NewReports › Schedules lists every tenant’s assessment schedule and monthly tenant report, and changes them in place.
• NewCompliance › Evidence gives each tenant an evidence pack for a framework: every control, the latest result of each check with its date, and the risks the tenant accepted with their reasons. Download it as a PDF from your browser.
• ImprovedShowing a tag now narrows every page that lists tenants’ data to that tag’s tenants: findings, changes, alerts, reports, frameworks, the audit log and the tenant list among them.
• ImprovedEach tenant has a readable address made from its name, such as /c/leechpool-primary. It stays the same when the tenant is renamed; an Admin can change it in Tenant settings, and old links keep working.

• ImprovedThe menu is now nine items: Home, Tenants, Findings, Changes and backups, Alerts, Manage, Reports, Compliance and frameworks, and Leads and savings, with Settings, the audit log and Help at the foot. Every page of a section is one click away, and a tenant’s pages are in the same menu instead of two rows of tabs.
• NewShowing, above the menu, chooses what you are looking at: all tenants, the tenants with one tag, or one tenant. It searches as you type, so it is quick with a thousand tenants. Changing it keeps you on the same page where it exists, so Contoso’s user licences become Fabrikam’s. Press Ctrl+Alt+K, or type @ in search, to open it. Esc closes it without changing anything.
• ImprovedA tenant’s Overview now ends with its connection health: what the last assessment could and could not read, and why.
• NewOn a phone, the bar at the bottom is Home, Approve, Alerts, Health and Menu. Menu opens the whole menu with a box to filter it. Home shows the three most urgent things first, then the rest folded, then quick links for common jobs.
• ImprovedPages have new addresses that match the menu. Old bookmarks, emails, Teams and Slack messages and links in reports you have sent still work: they take you to the new page.
• ImprovedThe numbers beside the menu now count only work waiting for someone: tenants waiting for consent or a working connection, changes waiting for approval, and high alerts not yet looked at.

• ImprovedEach API key now belongs to the member who created it, and Settings → API shows who that was. Suspending or removing the member revokes their keys at once. Keys made before this belong to the member who created them, or to the workspace’s first Owner. Developers
• ImprovedSign-in, sign-up and the other public forms keep their limits across restarts, and a visitor can no longer get round them by sending a made-up address in a header. Trust centre
• FixedSigning up with someone else’s email address no longer uses up that person’s free trial. A trial now counts against an address once its owner confirms it.
• NewConnecting a tenant can now ask the administrator who grants consent to sign in with Microsoft as well, so ConfigCheckup records which administrator in which tenant consented, and refuses a sign-in from any other tenant. This is switched on once the sign-in address is registered with Microsoft.

• NewAfter a change runs, ConfigCheckup reads every account, policy or setting it changed back from Microsoft 365 and shows each one on the change’s page: confirmed, different (with what Microsoft now shows), or could not be read (with why). If something did not stick, you are told straight away.
• NewA large change that stops part-way, because of a restart or Microsoft slowing it down, now carries on from where it stopped instead of starting again. ConfigCheckup checks the rest against the tenant first: if anything changed since it was approved, it asks for approval again and says what changed. A stopped change can be resumed for 7 days.
• NewIf a change is still running long after it should have finished, or was approved but has not started, you hear about it once, in the app, by email and in Teams or Slack, with what is holding it up where ConfigCheckup can tell.
• FixedA step that failed on a change now always names the account or setting it was for, and a step Microsoft asked to slow down waits and tries again rather than failing at once.

• ImprovedEach extra tenant on Monitor is now £8 a month, so at 25 tenants Monitor and Automate cost the same and Automate adds hands-off fixes. Existing subscriptions keep £6 until they change their extras. Pricing
• ImprovedThe pricing page sticks to our own plans. The side-by-side with other tools lives on the comparison page. Compare
• ImprovedThe pricing page is easier to read: wider plan cards, a plain list of what each plan includes (tenants, extra tenants, seats and history), and one line per feature it adds. Pricing
• NewOwners and Admins can suspend or remove a member from Settings → Team. They are signed out everywhere at once, and the changes they made keep their name. Only an Owner can suspend or remove an Owner, and the last Owner never can. A removed person can be invited again.
• NewAn Owner can delete the whole workspace from Settings: type its name to confirm, and any paid subscription is cancelled first. Everything in it goes straight away.
• ImprovedAccepting a risk now always takes an Admin or Owner and a written reason. A Consultant can ask from the finding; it stays open and in the score until an Admin or Owner accepts or declines.
• NewNew sign-ups confirm their email address from a link. Signing in works straight away; inviting your team and emailing reports to tenants wait for it.
• ImprovedShared report links show the report in a frame that cannot run anything, and say plainly when a report is no longer available instead of showing an error.
• ImprovedDownload PDF now opens the report and brings up your browser’s print window straight away: choose Save as PDF. Your tenants get the same Save as PDF button on shared reports. Reports are ready sooner, and Chrome and Edge save a searchable, accessible PDF.
• ImprovedPDF reports are printed one at a time, so a busy month of tenant reports queues rather than running out of memory, and on a server too small for PDFs the report is made as a web page instead of failing.
• FixedCheck now starts straight away instead of waiting behind other work, and a connection check asks Microsoft all its questions at once with a 20-second limit on each, so a check that took minutes now takes seconds. A slow answer from Microsoft no longer shows a permission you granted as missing.
• FixedA change waiting on Exchange Online now says why: the permission is not granted in the tenant, the app has no Exchange role yet, Exchange did not answer, or it has not been checked. It shows what Microsoft said, and links straight to Check Exchange.
• ImprovedEvery page now carries a strict Content-Security-Policy and HSTS, and sign-up, invitation links, emailed confirmation links and the lead page’s full-check request are rate limited. Trust centre

• ImprovedMonitor is now £79 a month for 10 tenants (was £149), then £6 a tenant. Automate is £199 for 25 tenants (was £249 for 15), then £5. Scale is from £499 for 100 tenants (was £999), then £3.50. A year still costs ten months. Pricing
• NewFree now covers up to 3 tenants and 3 seats, read-only: up to 4 assessments a tenant each month plus a monthly scheduled run, every finding with its fix guide, one report a month for each tenant in your brand colour with a small “Made with ConfigCheckup” line, a read-only tenant portal, Partner Center import and single sign-on. No card, no time limit. Pricing
• ImprovedThe read API now comes with Monitor. Webhooks, and API keys that can queue assessments, stay on Automate. Developers
• NewThe pricing page shows what running CIPP yourself or having it hosted costs beside ConfigCheckup, with CIPP’s own figures and the assumptions you can change.
• ImprovedAlready paying? Your subscription moves to the new, lower price at its next renewal, never during a term you have paid for, and keeps every feature and tenant it has. Assess is no longer sold; workspaces on it keep it at the same price until they choose another plan.

• ImprovedThe drift check now looks at Conditional Access, authentication policies, admin roles, SharePoint sharing and device compliance every hour, and at MFA registration and mail forwarding once a day as before.
• ImprovedWhen one of those settings changes in Microsoft 365, the findings it affects and the tenant’s score update at the next hourly check, whether the change made things better or worse, without waiting for the next scheduled assessment. Recent checks on the tenant overview show it as “Changed in Microsoft 365”, and the score history gains no extra points.
• ImprovedA drift check that finds nothing new records nothing new: the tenant overview says when it last looked.
• ImprovedScheduled assessments no longer all start at 02:00. Each tenant now has its own start time between 01:00 and 05:00 in your workspace’s time zone, the same every night, so large estates are not all read at once.
• NewA tenant’s overview and settings show the date and time of its next scheduled assessment.

• FixedWhen Microsoft refuses or fails part of a read, such as consent grants, the authentication methods policy, sign-in activity or one of the device lists, the checks that need it now say "Not checked" and why, instead of passing or calling themselves not applicable. A partial read says "Partly checked". Neither counts towards the score.
• FixedSynchronised administrators are now found: role members are read in full, page by page, with whether each is synchronised. Before, roles with more than 20 members were cut short and every administrator looked cloud-only.
• FixedA setting read directly from Exchange Online now decides in both directions. Audit logging or mailbox auditing read as off fails, even while Secure Score still shows it as done.
• FixedPassword expiry now respects the never-expire setting on each domain in the Microsoft 365 admin centre, so tenants that set it there no longer fail.
• ImprovedChecks follow the benchmarks more closely: Global Administrators are counted against two to four, user consent limited to low-impact permissions is a warning, only a phishing-resistant authentication strength covering the admin roles passes, and risk policies must block high-risk sign-ins.
• ImprovedThe SharePoint sharing fix now moves sharing to signed-in guests, which turns off Anyone links. Microsoft Graph has no setting for how long Anyone links last, so ConfigCheckup no longer claims to read or set it.
• ImprovedReports show the reason beside every check marked "Not assessed", and the coverage appendix names the parts of each data source that could not be read.

• ImprovedDisabling accounts needs two people to approve it. A workspace with only one Owner or Admin can now approve it alone, because re-enabling the accounts undoes it. The dry run, staged run, check and one-click re-enable are unchanged, and workspaces with two or more admins still need two people.

• FixedAn approved change could sit at "Approved" or "Executing" for ever if ConfigCheckup restarted at the wrong moment. Such changes are now queued again within a couple of minutes, or closed with an exact record of what they did, so every change ends as succeeded or failed.
• ImprovedChanges to many accounts, such as disabling dormant guests or stopping password expiry, now run in stages of 100, with each stage recorded as it finishes. One change can now disable up to 1,000 dormant accounts instead of stopping at 100.
• ImprovedA failed change says why on the Changes page: what Microsoft said for the first step that failed, the safety limit it hit, or that it stopped part-way. A change that stopped part-way can be rolled back.
• ImprovedAn approved change shows whether it is running, which stage it has reached, or whether it is held because automation is paused.

• FixedPurview automation could answer "Could not find the organization container" for tenants connected before ConfigCheckup recorded their .onmicrosoft.com domain. The domain is now looked up when it is missing, and Purview is asked by it first, as Microsoft expects.
• ImprovedWhen Purview still cannot find a tenant's organisation, the tenant page says what that usually means instead of pointing at permissions.

• ImprovedReport charts and scores are now drawn in your saved brand colour instead of a fixed blue, with very light brand colours darkened so they stay readable. Severity colours stay the same for every brand.
• FixedSending a report again, or making a new share link, no longer stops links already sent to a tenant. Each link works until its own expiry date.
• FixedThe score trend in reports now shows the most recent twelve assessments, not the first twelve, and the report gives the date the tenant was assessed rather than the date the report was made.
• ImprovedWhen a tenant replies to a report email, the reply goes to the person who sent it, or the tenant’s owner, rather than nowhere.

• FixedChanges that remove access, delete something or cannot be undone now always need two different people to approve them, whatever the tenant’s approval setting. Before, a tenant set to one approver let the person who raised such a change approve it alone. Turn on automation
• ImprovedA one-time access pass now works for a single sign-in, can only be issued in the week after the change created the account, and never replaces a pass that still works.
• NewStop all automatic changes, on the Automation page, halts every fix and containment made under a standing approval across the workspace at once. Fixes are drafted for approval instead.
• ImprovedAutomatic changes now have limits: 20 a day per tenant, 100 a day across the workspace, and a fix applied twice in a week without holding waits for a person.

• FixedA rollback that could not undo everything is now shown as partly rolled back or failed, with what Microsoft said, instead of “Rolled back”. The change stays as it is, you can try again, and the tenant is checked again either way, so the score shows it as it really is.
• FixedTwo approved changes to the same tenant no longer run at the same time, so one cannot undo the other.
• ImprovedSigning a high-risk user out everywhere now shows in the score straight away: the risk is marked contained until the password is reset.
• ImprovedBlocking an app from signing in now clears it from the high-privilege permissions check, because a blocked app cannot use them.
• ImprovedTurning on the audit log, mailbox auditing, modern authentication, MailTips or the third-party storage block in Exchange Online now shows within seconds, read from Exchange itself, instead of waiting up to 48 hours for Secure Score.
• FixedThe retention check is now judged from Microsoft Secure Score alone, so old data can no longer make it pass.

• ImprovedMonitor now includes approved changes: fixes with a dry run, approval, re-check and rollback, account containment in one approved step, licence reclaim and CSP seat changes. Free and Assess still show every fix, marked as available with Monitor. Pricing
• ImprovedAutomate is now the hands-off plan, from £249 a month for 15 tenants and £10 for each tenant after that (still £399 at 30). It adds fixes that run on their own under a policy you approve, automatic containment of taken-over accounts, custom rules and the API. Pricing
• ImprovedAlready on Automate? Nothing changes: your 30 tenants and price stay as they are, and if you change your extras you move to the new prices, which are never higher for the same number of tenants.

• FixedPurview automation could answer “Could not find the organization container” for a tenant that was set up correctly. ConfigCheckup now addresses Purview by the tenant’s .onmicrosoft.com domain, as Microsoft’s own tools do. Connect a tenant
• FixedExchange Online automation showed “not set up” with the set-up steps for a tenant it had never checked. It now says “not checked yet” and offers a check, and only shows the steps when Microsoft says something is missing.
• NewCheck Exchange, on a tenant’s Settings tab, asks Exchange Online and Purview straight away without rechecking the whole connection, and shows what Microsoft said.
• FixedPressing Check now on the automation consent no longer stopped Exchange fixes until a background check had run.

• ImprovedWhen an approved change succeeds, ConfigCheckup reads back just the setting it changed, straight away, and updates the finding and the tenant’s score. There is no longer a wait of a minute or a full assessment.
• ImprovedChanges approved together for one tenant are confirmed with one full assessment once the last of them has run, and you get one summary: the score before and after, and what was confirmed.
• NewApprove selected on a tenant’s Changes page approves several changes at once.
• NewThe tenant overview lists recent checks: what was read, which findings changed and how the score moved.
• ImprovedA setting Microsoft takes a while to apply is checked again after 10 seconds, then at growing intervals for about two hours, before it is reported as not taking effect. Secure Score items say they are waiting for Microsoft to re-score.
• ImprovedMarking a finding resolved checks it the same targeted way, and it is no longer reopened after a minute while Microsoft is still applying the change.
• FixedA change that had succeeded but was not yet confirmed could be drafted, and under automatic fixes run, a second time.

• ImprovedA full assessment now reads from Microsoft 365 several areas at a time, while keeping within Microsoft’s request limits for each tenant. On our test tenant it takes about a third of the time it did.
• ImprovedWork you start yourself, such as a check, a report or an assessment, starts at once and is never held up behind scheduled runs.
• NewSettings → Assessment speed shows how long your assessments take, and which part of the work takes longest.
• FixedWhen Microsoft asked us to slow down part-way through reading groups, a group could be counted as having no owners. Those reads are now tried again.

• ImprovedButtons that start work now follow it to the end where you pressed them: creating a report, testing data sources, backing up, checking breaches and making an approved change show their progress and then the result, with no reload.
• ImprovedA running assessment shows under the tenant’s name on every tab, step by step, with roughly how long is left, and in the tenant list on Home and Tenants.
• ImprovedReports being made show their progress in the report library and turn into a download link as soon as they are ready.
• ImprovedA tenant’s pages only refresh for that tenant’s activity, not for work finishing elsewhere in the workspace.

• ImprovedWhen Exchange Online, Defender or Purview automation is not ready, the tenant’s settings now show which step is missing and exactly what Microsoft said, with the steps to finish it in place. Connect a tenant
• FixedPurview automation no longer reports “not answering” in tenants where Microsoft only signs the app in through Exchange Online.

• NewThe 2-minute tour: click through the real console while a voice explains each step, from every tenant at a glance to a report in the tenant’s inbox. 2-minute tour
• ImprovedThe tour’s voiceover is now a natural, recorded British voice on every device, instead of whatever voice the browser has. 2-minute tour
• NewWhich plan is for me? Enter your tenants, team size and what you need, and the pricing page picks the plan and says why. Pricing
• ImprovedThe pricing page shows only what changes between plans, with the full comparison a click away, and says plainly what the trial includes and what happens when it ends. Pricing
• ImprovedA side-by-side comparison with Lighthouse, CIPP, Inforcer, Augmentt and Octiga, from each vendor’s own published pages, including what ConfigCheckup does not do. Compare
• ImprovedSigning up asks for less: your company name is optional and taken from your email domain if you leave it blank.

• NewA report builder: choose the tenant, the report and which sections to include, give it your own title, and see the report as it will look while you choose. Reports → Build a custom report.
• NewSave your choices as a template, such as a quarterly board pack, and start from it next time.
• NewDownload any report as a PDF from the Reports screen, and tenants can save the shared report as a PDF from its link.
• NewEmail a report to the tenant from ConfigCheckup, with a short note of your own. Their saved report contacts are filled in for you.
• NewA narrated, full-screen tour of the app on the website, with captions, that walks through each screen and what it is for. 2-minute tour

• ImprovedOn plans below Automate, every finding still shows its fix, and each place a fix or containment would be made now says it is available with Automate.
• ImprovedThe trial is now 30 days, counted from the day your first tenant connects, so time waiting for consent is not lost.
• NewFree includes three lead health checks a month, shown as prepared with ConfigCheckup.
• NewMoving from another tool under contract? Your plan is free until that contract ends, for up to six months. Choose it in Settings → Billing. Pricing
• NewThe pricing page compares a per-user price with ours for your own tenant numbers. Pricing
• NewA thank-you email when you sign up, and a note when your first tenant connects and the 30 days start. Both ask what you think; tell us at any time with “Tell us what you think” under the trial box.

• NewAutomation policies can now fix automatically: an admin approves the policy in advance, and covered fixes run as soon as an assessment finds them failing. Only fixes that can be rolled back and are not high-risk, after a clean dry run, within a size limit; each is checked again, recorded in the approver’s name and reported to admins. Turn on automation
• NewDrift is put right within hours: tenants an automatic policy covers are drift-checked every six hours, and a control that slips back is assessed and fixed at once.
• NewAutomatic containment, per tenant: on impossible travel, MFA fatigue or password spraying or guessing that got in, the account is blocked, signed out everywhere and its forwarding rules turned off straight away. Emergency and service accounts can be excluded. Turn on automation
• ImprovedTenants that need two approvers need a second admin to co-sign an automatic policy or automatic containment before either runs there.
• ImprovedThe comparison page now covers Octiga and Augmentt, with their published prices. Compare

• NewConnect your Partner Center and each tenant’s Licences page lists the tenant’s CSP subscriptions beside the licences assigned, with unassigned seats highlighted. Connect Partner Center
• NewChange a CSP seat count as an approved change: today where Microsoft allows it, otherwise from renewal, never below the seats assigned, and with a rollback.
• NewNinjaOne joins HaloPSA, ConnectWise and Autotask: failing controls become NinjaOne tickets, closed with a note when the control passes. Connect your PSA

• NewA Free plan: one tenant assessed twice a month against every check, with each finding and how to fix it. Pricing
• NewFour paid plans, each a job: Assess (£49, 3 tenants) for reports and winning tenants, Monitor (£149, 10) for watching every tenant, Automate (£399, 30) for approved fixes, and Scale (£999, 100) for the lowest price per tenant. Pricing
• NewAdd extra tenants one at a time, from £9 to £15 a month each, in Settings → Billing. No need to move up a plan for one new tenant.
• ImprovedThe trial is now everything in Automate on three tenants for 14 days, and when it ends the workspace moves to Free instead of locking. Cancelling does the same.
• ImprovedEvery paid plan includes unlimited assessments. Starter became Monitor and Growth became Automate, with more tenants and seats at the price you already pay.
• NewA calculator on the pricing page that picks the cheapest plan for your number of tenants. Pricing

• NewSecurity events now read the sign-in log too: impossible travel, the first sign-in from a new country, password spraying, password guessing (and a guess that worked), MFA prompts declined or ignored, and sign-ins by legacy protocols that skip MFA. Sign-ins need Entra ID P1 or P2.
• NewAlso alerted: an MFA method removed and a new one registered straight after, a secret or certificate added to an app, and five or more accounts deleted at once.
• NewContain an account from its event: block sign-in, sign it out everywhere and turn off inbox rules that send mail outside or delete it, as one change sent straight for approval, here or in Teams or Slack. Blocking and the rules roll back.
• ImprovedEach sign-in event shows the sign-ins behind it, and impossible travel shows the distance and the speed it would have taken.
• NewA comparison page: how ConfigCheckup fits alongside Microsoft 365 Lighthouse, CIPP, Inforcer and free assessment scripts, with sources. Compare

• NewSixteen new checks, each with an approved fix: text, voice and email sign-in codes; sign-in details in Microsoft Authenticator; device code sign-in; security info registration; phishing-resistant MFA for everyone; the admin consent workflow; group owner consent; guest invitations accepted by the right account; legacy sign-in to SharePoint; SMTP AUTH; the External tag; calendar sharing; spam filter allow lists; automatic forwarding; the attachment filter; and POP and IMAP for new mailboxes.
• NewCISA SCuBA, the US government’s secure baselines for Microsoft 365, is now one of 20 frameworks, with its own readiness report: its Entra ID, Exchange Online and SharePoint policies, each mapped to the check that evidences it.
• ImprovedWhere Exchange is set up for a tenant, Exchange Online settings are read straight from Exchange rather than inferred from Secure Score, and the evidence shows the actual values.

• ImprovedPages your plan does not include (automation, monitoring and alerts, API and webhooks, custom rules, Partner Center import, access reviews) now open to show what they do, behind a card that says which plan unlocks them and what it costs. Locked pages carry a lock in the menu.

• ImprovedThe billing check reads Excel as well as CSV, comma, semicolon or tab separated, from Pax8, TD SYNNEX, Giacom, Ingram Micro, Dicker Data, Sherweb, Crayon and Partner Center reconciliation files. When it cannot tell which column is which, you choose once and it remembers the layout.
• ImprovedInvoice customers are matched by Microsoft tenant ID or domain where the invoice gives them; refunds and credits are left out; a product that is not a Microsoft licence can be left out of the check.
• NewThe billing check shows what you may not be billing on to tenants, can be filtered by what it found, and downloads as CSV.
• ImprovedCyber Essentials shows each tenant’s readiness as a percentage with its next step, and each tenant’s page leads with what is left to fix or confirm; evidence links to its finding.
• ImprovedService levels explain the targets and terms, and show fixes within target as bars, with each tenant’s position among your tenants.

• ImprovedTags are chips now: pick from the tags you already use, and a baseline shows which tenants its tags reach as you choose them. Each tenant’s settings list the baselines it is held to, and the tag that would add another.
• ImprovedBaselines start from a template you can read before choosing, and their controls can be searched (MFA, DMARC, BitLocker) and taken a whole area at a time.
• ImprovedA lead’s tenant is now kept under Leads: out of your tenant lists, totals, alerts and reports, and outside your plan’s tenant count, until you make them a tenant.
• NewEmail a lead their full report once the full check has run: their score, what to fix first and a link to the report in your branding, with your booking link. One click on the lead’s page.
• NewEach lead shows where it is, from permissions email to consent, full check, report and tenant, and the Leads page counts how many are at each step.

• FixedAccepting the permissions in Microsoft no longer leaves the administrator on a page that keeps loading. ConfigCheckup records the consent at once, checks it in the background, and the tenant’s page shows the check running and updates by itself when it is done.
• FixedThe permissions email to a lead now sends after the tenant it was first added as has been removed.
• FixedSaving branding no longer squeezes the form into a narrow column behind a large “saved” message.

• NewTurn on DKIM signing for a domain from the finding: its two CNAME records are published at the connected DNS host and signing is switched on in Exchange Online. Turn on automation
• NewPublish MTA-STS from the finding. ConfigCheckup serves the policy file at mta-sts.<domain> itself and publishes the records at the DNS host; start in testing mode and move to enforce from the same finding. 65 of the 74 checks now offer an approved fix.
• ImprovedConnected DNS hosts (Cloudflare, Azure DNS, Route 53) now manage CNAME records as well as TXT.

• NewSwitch on Purview automation for a tenant, and sensitivity labels, a DLP policy in test mode and retention labels can be created from their findings as approved changes. It is off by default, needs the Compliance Administrator role, and never overwrites what the tenant already has. Turn on automation
• NewLabel Microsoft 365 groups, teams and sites from the finding: tick the groups and choose a label.
• ImprovedFixes Microsoft takes a day or two to reflect are checked over two days, rather than reported as still failing after two hours. 63 of the 74 checks now offer an approved fix.

• NewAdmin roles held by accounts synchronised from on-premises can be moved to cloud-only admin accounts from the finding: tick the people, and each gets an admin account on the onmicrosoft.com domain with the same roles, which leave their synchronised account. Turn on automation
• NewEmergency access accounts are created for you, with permanent Global Administrator and excluded from every Conditional Access policy.
• NewNew accounts never have a password anyone sees. Once the change runs, an admin issues each one a Temporary Access Pass on the change’s page, shown once and never stored, and the person registers a passkey or security key with it. 59 of the 74 checks now offer an approved fix.

• NewDevice checks: non-compliant devices are asked to check in and re-evaluate straight away; Windows Update rings are corrected so devices move to a supported Windows; a Windows LAPS policy backs up a rotating local administrator password for every device; and unmanaged devices get a report-only policy requiring a managed device, so people enrol at their next sign-in. Turn on automation
• NewChoose who moves from standing admin roles to just-in-time access in Privileged Identity Management. Emergency access accounts and the last active Global Administrator always stay.
• NewTick which privileged in-house apps a report-only Conditional Access policy for workload identities covers, and which Microsoft Defender alerts to close, with their classification.
• NewMake a custom domain the default, adding and verifying it through the connected DNS host if needed; and, once an on-premises directory is retired for good, switch off directory synchronisation (two approvers).
• ImprovedPassword reset registration is raised with the Microsoft Authenticator prompt, and a weak Secure Score links to the Secure Score findings that raise it. 57 of the 74 checks now offer an approved fix.
• ImprovedA Conditional Access policy created in report-only mode is reported as set up and waiting to be switched on, rather than as a fix that failed.

• NewOpen any security event for the full picture: who did it and from where, each property it changed with the value before and after, why it matters, what to check, what to do if it was not expected, and links straight to the right place in the tenant. Other events about the same people or objects are listed beside it.
• NewDismiss security events as an expected change, a false positive or dealt with, one at a time with a note or several at once. They leave the list and the counts, stay under Dismissed for 30 days, and can be restored. An Undo on the confirmation puts them straight back.
• FixedChanges made by ConfigCheckup itself, such as setting up automation in a tenant, no longer appear as security events or trigger alerts.
• NewPages update on their own. When an assessment, report, approved change or fix check finishes, the page you are on shows the result within a few seconds, without a reload.
• ImprovedAfter a fix runs, its finding is checked against the tenant again until the change shows up: after a minute, then after 4, 10, 30 and 60 minutes while Microsoft applies it, and over 48 hours for Secure Score. When it passes, the finding is resolved and the tenant’s score is updated. Turn on automation

• NewReports have a new design. The cover shows the score on a gauge under your logo; a key explains the score, severity, results, effort and change risk; the summary sets out what the score means and what fixing the critical and high findings would lift it to. A radar shows the score by area, the roadmap is a timeline with a severity-against-effort matrix that picks out the quick wins, and licences show seats in use against seats paid for.
• ImprovedDetailed findings are shorter to read and to print: each sets why it matters beside how to fix it, evidence is a small table rather than raw data, and passing controls are listed in a compact table. A full technical report is about a third shorter.
• ImprovedThe tenant review pack uses the same design, with a gauge for the score and its change, findings by severity, the trend, budget options side by side and a four-year forecast chart.
• NewAutomation is arranged by the job: To do lists what is waiting for your approval and the fixes you can propose now, and shows which tenants to set up to unlock the rest. Tenants, Policies, Activity and How checks are fixed each have their own view, and a strip at the top shows how many fixes are at each step. Turn on automation
• ImprovedTeam invitations carry your saved branding: your logo, colour and name, with who invited them, their role and what it can do, and how joining works.
• ImprovedThe permissions email to a lead is redesigned under your branding. It reminds them of their quick check result, shows what the full check covers, and walks them through granting read-only access.

• NewFindings open beside the list. Pick one and its evidence, impact and fix appear on the right while the list stays where it was; J and K move through them, Escape closes. Tick several and a bar rises from the foot of the screen to assign, date or resolve them together.
• NewTenants has its own page, with each tenant’s score, trend, open critical and high findings, connection and owner in one row. Home now opens with the four figures that matter, what needs you today, and your weakest tenants.
• NewBreadcrumbs at the top of every page, and a tenant switcher in them: choose another tenant and you stay on the same page, such as their findings or licences.
• ImprovedEvery page of a tenant shares one header with the tenant’s status, posture grade, actions and tabs, which stay in place as you move between them. The overview leads with the score, what is open by severity, the next step and the five findings to fix first.
• ImprovedA quieter look throughout: a sidebar that matches the page, severity shown as signal bars with only critical in solid red, status as a dot and a word, and figures in one panel instead of rows of separate cards. Light and dark are both designed.

• FixedThe mailbox rules check no longer fails with “not valid JSON” when Exchange answers one mailbox with a plain-text error. Those mailboxes are read one at a time, and the rest are checked as usual.
• ImprovedWhen some mailboxes cannot be read, the note says what Microsoft answered for them, and a check that could read none of them shows as failed instead of an empty result.
• ImprovedWhen each app was last used no longer blames Entra ID P1 on a tenant that has it. The note now says whether the permission is missing, or gives Microsoft’s answer.
• ImprovedData sources skipped for a permission the tenant has not consented to now offer the consent link right under the list, so permissions added since the tenant connected are one click away.

• NewAutomated fixes now use a second Microsoft app, ConfigCheckup Automation, that holds only the permissions to make changes. Connecting a tenant asks for read permissions only; the automation permissions have their own consent link on the tenant’s Automation card, sent only when the tenant wants fixes. Turn on automation
• ImprovedYour tenant sees two entries under Enterprise applications. Deleting ConfigCheckup Automation removes every write permission at once, while assessments carry on through the read-only app.
• ImprovedDuring a fix, reads still go through the read-only app; only the changes themselves are made as ConfigCheckup Automation. Exchange Online commands run as the automation app, so the Exchange Administrator role goes to it. Connect a tenant
• ImprovedThe website, FAQ, trust centre, data protection page and DPA describe the two apps.

• ImprovedAutomation is easier to scan. Each kind of fix is one row with a single Propose button, and the tenants it applies to fold away underneath. Tenants with automation on are listed first, and the approvals card only appears when something is waiting. Turn on automation
• ImprovedAll changes can be filtered by waiting, applied, failed or rejected, and the catalogue of what can be automated is a compact grid you open when you need it.
• ImprovedWorkspace settings have their own menu beside the page instead of two rows of tabs, and Branding shows a live preview of your report cover and tenant email as you edit.
• FixedThe Send invitation button on the Team page is a proper button again, and long lists of signed-in sessions fold after the first five.

• NewEvery finding with an automated fix now says what it will do before you propose it: the change in words, the accounts, apps, groups or policies it touches, how it is kept safe (dry run, approvals, rollback, risk) and the permission it uses.
• ImprovedThe console has a new look to match the website: a midnight sidebar, larger page titles and calmer cards. The dashboard opens on the overall picture, the tenant overview shows one notice when the connection needs attention, finding rows show their facts on one line, and tenant settings are flat cards rather than boxes inside boxes.
• ImprovedReports are redesigned around your brand: a full-width cover in your colour with your logo large on a white plate, your logo and the report title at the top of every page, and a closing page with your contact details. The cover no longer carries a running header. Features
• FixedYour logo now shows in lead permissions emails and monthly tenant report emails in Gmail and Outlook. An uploaded logo, including SVG and WebP, is converted to an image every mail client shows and sent inside the email, so it appears without the reader loading remote images. Features
• ImprovedThe home page shows white-label reporting and lead generation side by side, and the features list names them as such. Home
• ImprovedThe website explains how ConfigCheckup works without AI: checks are rules written by people, fixes are pre-written changes you approve, and reports are built from the assessment with fixed templates. Home

• NewFour checks that needed someone to decide can now be fixed from the finding. Tick which administrators stop being Global Administrator (two always stay, and emergency access accounts are kept); type who should own ownerless groups; tick the stale groups to delete (restorable for 30 days, and two people approve); or enter the office IP ranges to add as a trusted named location. Each becomes an ordinary change with a dry run and approval. Turn on automation
• NewConnect a tenant’s DNS host (Cloudflare, Azure DNS or Amazon Route 53) and publish SPF and DMARC records from the finding, as approved changes that can be rolled back. The findings now show the exact record for each domain, keeping the senders it already lists. 46 of the 74 checks now offer an approved fix. Turn on automation
• NewA tenant’s reply from the portal now shows on the finding it is about, with Mark handled. Notifications about a reply open that finding.
• NewWithdraw an accepted risk, from the finding or for several findings at once; the finding opens again. Accepting risk in bulk can be undone from the confirmation, like other bulk changes.
• ImprovedFindings pages load about a sixth of the data: each finding’s detail loads when you open it.
• ImprovedThe dashboard and tenant pages show an outline of the page straight away while it loads, rather than the previous page.
• ImprovedExchange Online automation setup shows only the step each tenant still needs: the consent link, the Exchange Administrator role, or nothing. After the role is assigned, the connection is checked again by itself for an hour, as Exchange can take that long to notice it. Connect a tenant

• NewThe dashboard opens on Today: one list of everything that needs you, across every tenant. It covers changes waiting for approval, fixes ready to draft, paused automation, tenants waiting for consent and data that could not be read, as well as tenant replies, drift and connections.
• NewEach tenant’s overview shows where it is in Connect, Assess, Fix and Report, with a button for the one thing to do next. The five worst findings come first; recent changes and the comparison with your other tenants are folded away until you open them.
• NewUndo a bulk change of owner, due date or status on findings from the message that confirms it, for 15 minutes afterwards.
• ImprovedNotifications and Today items open the exact place: the drift check, the tenant’s reply, the change a fix check is about, the GDAP details or the consent link, rather than the tenant overview.
• ImprovedPages that are empty until a tenant has been assessed offer Run an assessment there and then. The tenant section called Estate is now Inventory.
• FixedA button could stay on Saving… after the change had been made, and the page did not update until you reloaded it. Pages now show a thin bar across the top while the next one loads.

• NewForty of the 74 checks now offer an approved fix from the finding itself, up from 24, and five more are fixed from their own page. New fixes: revoke consent that gives apps mail or file access, remove expired app secrets, make public groups and Teams private, stop passwords expiring on cloud accounts, fill in security notification contacts, prompt everyone to set up Microsoft Authenticator, tighten the default cross-tenant settings, the Intune baseline for device checks, MFA and phishing-resistant MFA policies for admins, and OneDrive sync on managed computers only. Turn on automation
• NewAutomation policies: choose which fixes are drafted after each assessment, on every tenant or tenants with a tag. Start in simulate mode to see what a policy would do, with each dry run, before it drafts anything. Drafted fixes still need approval. Turn on automation
• NewPause automation for a tenant during a change freeze or an incident: nothing is drafted and approved changes wait until you resume. Turn on automation
• NewRunbooks in each tenant (Changes → Runbooks): onboard a new tenant, the monthly review, offboard a leaver, and respond to a compromised account. Steps tick themselves off as the tenant changes, and one click drafts the fixes a runbook still needs.
• ImprovedEvery finding has a Fix this link that opens it at the fix: a change to approve, a link to the page where it is made, or the steps and why it is done by hand. The Automation page lists how every check is fixed and proposes one fix for all tenants at once.

• NewConfigCheckup now reads Microsoft Entra recommendations, Defender for Endpoint security recommendations (with Defender for Endpoint Plan 2 or Defender for Business), and the message centre and service health. Each item is a finding, or is recorded against the check that already covers it, so nothing Microsoft lists is left out or counted twice.
• NewCoverage page in each tenant (Compliance → Coverage): every data source, what it returned and what is missing and why; Microsoft’s lists beside ConfigCheckup’s findings, with every difference explained.
• ImprovedA check that cannot run now says it was not assessed and names the missing permission or licence. Tenants show as degraded only when a required permission is missing.

• NewService levels (Work): how quickly findings are fixed, for each tenant and engineer, against a target per severity (critical 7 days, high 30, medium 90, low 180). It also shows how many fixes slipped back, what is open and overdue, over 90 days, 180 days or 12 months.
• NewEach tenant is compared with your other tenants as a percentile, overall and per area (“bottom 20% for identity”). The tenant overview shows only that tenant’s own position; Service levels shows the full comparison.

• NewApproval requests posted to Teams and Slack now have Approve and Reject buttons. Each opens the change with the decision ready to confirm (signing in first if needed), so approving takes two clicks. The usual roles and approval rules still apply.
• NewBreached-account monitoring: each tenant’s mailboxes are checked against known data breaches (Have I Been Pwned) after assessments, at most weekly, and joined to MFA status, admin roles and risk. A new check flags breached accounts without MFA and can sign them out everywhere once approved. The People page lists them. It needs a Have I Been Pwned API key.
• NewDevice baseline (Estate): create a starting set of Intune policies in one approved change. It covers Windows, macOS, iPhone and Android compliance, BitLocker and firewall, Defender Antivirus with cloud protection, and a Windows Update ring. Assign them to all devices or all users, or create them unassigned to review first; rolling back deletes them.

• NewExchange Online and Defender for Office 365 settings can now be fixed for you: Safe Links, Safe Attachments (including SharePoint, OneDrive and Teams), impersonation protection, anti-phishing, anti-spam and zero-hour purge, malware attachment filtering, external forwarding, MailTips, third-party storage in Outlook on the web, calendar sharing, modern authentication, and audit logging. Each one is dry-run, approved and can be rolled back. It needs one extra permission and role, explained in each tenant’s automation settings.
• NewConditional Access page in each tenant (Compliance): check what a report-only policy would have done from the last 7 days of sign-ins, including who would be blocked or prompted, service accounts, older apps and missing break-glass exclusions, then switch it on through an approved change that rolls back to report-only.
• NewPeople page in each tenant (Estate): offboard a leaver in one approved change. It blocks sign-in, signs them out everywhere, removes MFA methods, converts the mailbox to shared, gives the manager the mailbox and OneDrive, sets an automatic reply or forwarding, removes groups and reclaims licences. You can also set up a new starter with the same groups and licences as a colleague.

• ImprovedWhen a data source needs a licence, the note now names the licence (Entra ID P1 or P2, Intune or Defender), lists what the tenant has, and says which plans include it. If the tenant does have the licence and Microsoft still refuses, it is listed as something to look into instead of “nothing to fix”.
• FixedPurview retention is now read from Microsoft Secure Score. Microsoft does not let apps list retention labels, so the old check was refused on every tenant whatever its licences; the RecordsManagement.Read.All permission is no longer needed.

• NewEach of Microsoft Secure Score’s recommended actions now appears as a finding, with Microsoft’s title, points, remediation steps and a link to the action in Microsoft Defender. Recommendations an existing check already covers are not listed twice, and ones marked as risk accepted or handled by a third-party tool in Secure Score are shown as not applicable.
• NewMore one-click fixes, from Secure Score recommendations: admin sign-in frequency without persistent sessions, phishing-resistant MFA for admins, blocking device code sign-in, MFA for risky sign-ins, password change for high-risk users (all as report-only Conditional Access policies), modern authentication for SharePoint, and OneDrive sync only on domain-joined computers.
• NewMarking a finding resolved now checks it against the tenant about a minute later and updates the score. If it still fails, it is reopened and marked “Still failing after resolve”, with troubleshooting steps for that kind of setting, and you get a notification either way.

• NewAbout a minute after an automated fix succeeds, the data behind its finding is read again from the tenant and the tenant is re-scored, so the finding and score update without waiting for the next assessment. The change shows “Confirmed: the finding now passes” or that it still fails, and you get a notification with the new score.

• NewEach tenant has a Changes section: approve, reject or dismiss waiting changes there, send drafts for approval, propose what can be fixed next (one or all), see what has been applied and roll it back, and manage declined fixes. The tab shows how many are waiting.
• NewOne Actions button on every tenant page: run an assessment, refresh device data, check the connection, test data sources, and create an executive report, tenant review pack or technical report.
• NewDismiss a proposed change to remove it. The finding is marked “Automation previously declined”, with who and why, and is not drafted again automatically until you allow it again.
• NewNew checks with one-click fixes: guest access to the directory (restrict guests to their own objects) and self-service sign-up (stop people joining by verified email or starting trials themselves).
• ImprovedA change no longer asks you to switch on automation when it is already on for that tenant.

• ImprovedEach tenant now has seven sections that fit on one line: Overview, Findings, Reports, Compliance, Estate, Quote and Settings. Compliance and Estate show their pages as a second row. The bar stays in view as you scroll, with the tenant’s name and connection status.
• ImprovedA tenant’s findings and reports open inside the tenant, with the same filters, bulk actions and report creation, so you no longer leave the tenant to work on it. Search results, framework controls, Copilot checks and the Automation page open findings there too.
• FixedCard buttons wrap on narrow screens instead of running off the edge.

• FixedWhen a data source test runs after the last assessment, the tenant overview uses it: sources the test read are shown as fixed with a Run assessment button, instead of still being listed under “Not fully collected”.

• FixedA permission the tenant has granted is no longer reported as missing when Microsoft turns the request away for another reason, such as Security alerts in a tenant without Microsoft Defender. Every connection check also uses a fresh access token, so newly granted permissions show straight away.

• ImprovedPages use the full width of wide screens, and sections sit side by side where there is room (Copilot readiness, Cyber Essentials, cyber insurance, device budgets).
• ImprovedFindings and the device list show 25 at a time with page numbers, in the same order as before, so long lists no longer run on for dozens of screens. A linked finding opens on its own page.
• ImprovedBilling check groups tenants that are not on the invoice into one list you can open one at a time, and device replacement reasons fold behind “Why”.

• NewAn Automation page brings together changes waiting for approval, every finding that can be fixed for you across your tenants (propose one fix or all of them at once), each tenant’s automation set-up, and recently applied changes with rollback.
• NewDraft fixes automatically: switch it on for a tenant and, after each assessment, every fixable finding gets a dry-run fix sent for approval. Nothing changes until someone approves it.
• NewWhen a lead asks for the full health check, send their administrator a professional, branded permissions email with the consent link in one click, preview it first, and add a personal line. Replies come straight to you.
• ImprovedReports can be filtered by tenant, type and status, and created from the same page by choosing a tenant and a report type.
• ImprovedDevice lifecycle shows memory, storage and free space, encryption, compliance and Autopilot for each device, labels every price as an estimated cost, and has a Refresh device data button.
• ImprovedFrameworks updated to current editions (PCI DSS 4.0.1, CIS Controls v8.1, ISO/IEC 27001:2022 with Amendment 1), with the review date shown on every framework view.
• ImprovedSimpler navigation: the menu is grouped into Work, Monitor, Compliance, Grow and Workspace; tenant pages have grouped tabs including Findings, Reports and Cyber Essentials; and messages that mention another page now link to it.

• FixedPermissions granted since the last assessment are picked up straight away on the next one.
• FixedWhen Microsoft refuses a request even though the permission is granted, the gap now says so and no longer asks you to grant consent again.

• NewInbox rules forwarding mail outside the organisation can be turned off through an approved fix, and switched back on by rollback. Needs the MailboxSettings.ReadWrite permission.
• NewAccounts without a usage location can be given the organisation’s country through an approved fix.
• ImprovedDormant licensed accounts and stale devices now offer an automated fix (removing paid licences; disabling the device in Entra ID). Dormant guests and licences left on disabled accounts offer one whenever they are found, not only when the problem is widespread.
• ImprovedStudent accounts in education tenants are left out of MFA coverage and its findings. The finding says how many were left out.
• ImprovedFree and trial licences are no longer reported: licence findings, their cost figures and the automated reclaims they offer cover paid licences only.

• ImprovedThe tenant Overview starts with a plain summary of the score and open findings by severity, jump links to each section, and "What to fix first": the top findings open in place with the evidence, fix steps and how to confirm them.
• ImprovedEach area under "Posture by area" opens that tenant’s findings for the area.
• ImprovedConfigCheckup’s own app is left out of findings and security events: its permissions, consent and the changes it makes through approved fixes are not reported as risks.

• ImprovedRequiring single sign-on with Microsoft Entra ID is now included in every plan, including the free trial.
• FixedAn uploaded logo now shows on every page after saving, whatever address the app is opened at, and is embedded directly in PDF reports.

• ImprovedUpload your logo in Settings as a PNG, JPEG, WebP or SVG file, with a preview before you save. Linking to an image hosted elsewhere still works.

• NewAutomated, approved fixes for: MFA for all users, blocking legacy authentication, requiring compliant devices, the Conditional Access baseline and blocking high-risk sign-ins (all created report-only, with break-glass accounts left out).
• NewAutomated fixes for tenant settings: limit user consent to apps, stop users registering apps or creating tenants, restrict who can invite guests, and stop guests resharing. Each can be rolled back.
• NewHigh-risk users can be signed out everywhere in one approved change.
• FixedThe automated fix for admin roles held by disabled or dormant accounts now works; it removes one role per change, Global Administrator first.
• FixedSecurity alerts now ask for the permission Microsoft actually requires (SecurityAlert.Read.All) instead of reporting SecurityEvents.Read.All as missing, and a refused Purview retention label read shows as a permission problem rather than a raw error.

• ImprovedFindings open as four steps: what was found, why it matters, how to fix it, and how to confirm and close it.
• ImprovedEvidence is shown as figures, tables and checklists instead of raw data, with the raw data a click away.
• NewEvery check now has a fuller fix guide: what to have in place before you start, what users will notice, and how to confirm the change worked.
• ImprovedSeverity totals at the top of Findings filter the list in one click, with a count of findings that can be fixed for you.

• NewData source test: from a tenant’s Settings tab, read every source ConfigCheckup uses from the live tenant and see what Microsoft answered, with a report you can copy.
• NewThe dashboard lists tenants that need to grant consent again, with the permissions missing and a consent link for each.
• ImprovedOn a tenant’s Overview, data that needs a licence the tenant does not have (such as Entra ID P1 or P2) is listed separately from real problems.
• ImprovedMailbox forwarding rules are checked for every mailbox, up to 5,000, instead of the first 500.
• FixedClearing the hourly rate or hours on a quote no longer leaves a 0 in the box.

• NewThe workspace owner can choose whether changes to a tenant need one person or two different people to approve them, on the tenant’s Settings tab. Changes already waiting follow the new setting.
• ImprovedA change that was approved before automation was switched on, or before consent was granted, now goes ahead once they are, without approving it again.
• ImprovedSecurity events about ConfigCheckup’s own connection are labelled as such, with the name the tenant shows for it, instead of looking like an unknown app.
• FixedConditional Access policies and Purview retention labels are read again; both failed with a Microsoft Graph error.

• ImprovedThe side menu is grouped by job: Monitor, Compliance, Tenant work, Business and Workspace, with Frameworks in the menu. Approvals is now called Changes.
• ImprovedEach tenant has a Settings tab for its tenant portal, monthly report, schedule, tags, owner, GDAP dates and automation, so the Overview shows only its security posture.
• ImprovedWorkspace settings are in five groups, and the public health check settings are on the Leads page.

• NewCopilot usage: who uses Microsoft 365 Copilot and in which apps, the seats nobody has opened in 30 days, and seats bought but never assigned, with one-click reclaim. Features
• NewBilling check: import your distributor invoice as CSV and see, for every tenant, seats you pay for that it does not hold, seats nobody is assigned, and licences you are not billing on. Features
• NewSettings backups: a daily copy of Conditional Access, named locations, sharing, guest and authentication settings and Intune compliance policies, with every change shown. Conditional Access and sharing can be restored through an approved change. Features
• ImprovedLicences now show when a trial ends or converts.

• NewYour own licence prices: name your reseller, take a percentage off list price, and set a price per licence by hand or by importing a CSV built from a downloadable template. Licence savings and reports use them, education plans included.
• NewSecurity event alerts: each tenant’s audit log is read every 15 minutes, and a new admin, a risky app consent, an MFA method removed, a Conditional Access change or a domain federation change is sent to email, Teams or Slack straight away. Features
• NewProspect health check: your own branded public check. Businesses enter their domain for an instant result from public information, and you get the lead. Features
• ImprovedThe dashboard and report summaries now name any data an assessment could not read, not only the tenant page.

• NewCopilot readiness: whether a tenant is ready for Microsoft 365 Copilot, area by area, with the public, unlabelled teams to fix first and what to do before rollout. Features
• NewApp access review: every app that can reach a tenant’s data, rated by what it was granted, whether its publisher is verified and when it was last used. Block risky apps through an approved, reversible change. Features
• NewNew checks: risky apps with access to company data, apps users consented to that read mail or files, unused apps still holding permissions, public groups and Teams, and sensitivity labels on Teams, groups and sites.
• ImprovedApplication permissions are now read from Exchange Online and SharePoint as well as Microsoft Graph, so apps with full mailbox access are no longer missed.

• NewFramework readiness reports: for each framework, every control Microsoft 365 can evidence and whether the tenant meets it, with a printable version for the tenant.
• NewNew frameworks: Cyber Essentials Plus, the NCSC Cyber Assessment Framework, DSPT, DORA, NIS2, the Microsoft Cloud Security Benchmark, Zero Trust, SOC 2, PCI DSS 4.0, NIST SP 800-171 and CMMC Level 2.
• ImprovedISO 27001 mapped to 2022 Annex A control level (for example A.8.5 Secure authentication), and each check mapped to the Secure Score action it corresponds to.
• NewNew checks: BitLocker, firewall and antivirus in Windows compliance, Windows LAPS, Conditional Access for workload identities, cross-tenant access defaults for Teams, sensitivity labels, DLP, Purview retention labels, the unified audit log, audit log retention and mailbox auditing.
• ImprovedThe home page tour now shows each feature in use, and the dashboard’s panels are live on the page.

• ImprovedSingle sign-on with Microsoft Entra ID is now included in every paid plan, not just Scale.
• ImprovedA clearer plan line-up: scheduled assessments, drift alerts, tenant portals and Partner Center import are part of Growth and Scale. Pricing
• FixedThe “Most popular” label on the pricing cards is no longer crossed by the card outline.

• NewSearch tenants, findings and reports from anywhere with Ctrl+K or ⌘K.
• NewNotifications in the app: tenant replies, drift, finished assessments and reports ready, behind a bell in the top bar.
• NewBulk actions on findings: assign an owner, set a due date or accept the risk across many findings and tenants at once, and save the views you use.
• NewOne-click licence reclaim: the licence savings page drafts the removal as an approved change.
• NewDevice refresh settings per workspace: your own lifespans per device type, and Windows Enterprise instead of Pro in replacement prices.
• ImprovedSettings grouped into tabs, so the sidebar holds only the pages you use every day.
• NewHelp guides for connecting a tenant, connecting a PSA and turning on automation. Help guides
• NewA feature comparison table under the pricing plans. Pricing

• NewCyber insurance answers: the questions insurers ask most often, answered from the tenant with the evidence, and a printable version for the proposal form.
• NewRemediation quotes: open findings priced in hours at your rate, printed with your branding, with sent, accepted and declined tracked.
• NewPSA tickets in HaloPSA, ConnectWise Manage and Autotask, closed automatically when the control passes. Connect your PSA
• NewTenants can reply to each next step in their portal: go ahead, not now, or a question.
• NewMonthly tenant report emails: the latest review pack sent to the tenant’s contacts on the first of each month, as a link that expires.
• NewA leavers check for dormant accounts that still hold licences or admin roles.
• NewA Defender for Office 365 check covering Safe Links, Safe Attachments, anti-phishing and zero-hour auto purge.
• NewInactive end-of-life devices show when they were last seen, and can be disabled or deleted through an approved change.
• NewA minimum-budget tier in device refresh plans, for certified refurbished hardware.

• NewA REST API and signed webhooks for assessments, drift and reports (Growth and Scale). Developers
• NewSingle sign-on with Microsoft Entra ID, with the option to require it for everyone (Scale).
• NewCustom rules: your own checks against the collected data, reported separately so they never move the score (Growth and Scale).
• NewEvery control is now mapped to CIS Controls v8 and the NCSC 10 Steps too.
• ImprovedGrant admin consent again from the tenant page when a tenant is degraded.

• NewA live, branded tenant portal for every tenant: score, trend, verified fixes and next steps.
• NewLicence savings: paid licences on disabled and dormant accounts, and plans larger than the tenant uses, costed per year.
• NewDaily drift alerts to email, Microsoft Teams or Slack when a critical control stops passing.
• NewImport tenants in bulk from Partner Center (GDAP).
• NewAn onboarding checklist, active session management and email address changes.
• NewAnnual plans with two months free, and plan changes that take effect straight away.
• ImprovedA redesigned tenant page, with the tenant’s tools as tabs.

• FixedChecks whose data could not be read are reported as not assessed, and never scored or raised as findings.
• FixedMissing licences are no longer reported as missing permissions.
• ImprovedData retention is enforced every night, in line with your plan.

• NewCyber Essentials readiness per tenant and across every tenant, with answers you record yourself.
• NewA free email security check for any domain: SPF, DKIM, DMARC and MTA-STS. Email security check
• NewSign in with Microsoft, two-step verification and session management.
• NewBaselines: one target configuration held across every tenant, with drift shown.
• NewExchange Online email security checks.