Five jobs, one console.

Every tenant checked against 208 checks, worst first. Identity, admin access, devices, email, collaboration, threat protection, data and licensing, read through Microsoft Graph, the Exchange Online and Teams admin interfaces and public DNS. Each finding comes with the evidence and numbered steps to fix it.

20 frameworks, control by control. Each tenant measured against the framework they are audited on, control by control, with a printable report: Cyber Essentials, Cyber Essentials Plus, NCSC Cyber Assessment Framework, Data Security and Protection Toolkit, ISO/IEC 27001:2022, NIS2 Directive and more.

Every open issue at every tenant, worst first. Assign owners, set due dates or accept a risk across many at once, and save the views you use.

The 5 controls, with 8 of the 17 requirements evidenced from the tenant and the rest recorded by you, across every tenant.

14 checks of SPF, DKIM, DMARC, MTA-STS and forwarding on every domain, and 28 of Exchange Online and Defender for Office 365, read setting by setting: Safe Links, Safe Attachments, anti-phishing, mail flow rules and mailbox auditing.

For a policy that is on, a week of real sign-ins: who it applied to, blocked or asked for MFA, with warnings such as a policy with no break-glass exclusion.

Every app that can reach the tenant, rated: what it can reach, who consented, whether the publisher is verified and when it was last used.

A named set of checks, with the values its fixes use, held across the tenants you tag: report only, draft each missing fix for approval, or fix automatically where it is safe, with deviations that run out and daily drift alerts.

Any tenant against one set up the way you want: guest, authentication, sharing and cross-tenant settings, setting by setting; each Conditional Access policy part by part, from who it covers and the groups it names (matched by name) to its grant and session controls; and Intune policies by name. Read only.

23 kinds of detection from each tenant’s sign-in and audit logs, such as impossible travel and MFA prompts declined, plus Microsoft Defender alerts, sent to email, Teams or Slack, and checked every 5 minutes on Automate. Contain the account in one approved step.

Type a tenant’s domain, or load every GDAP customer from Partner Center at once. The first branded report is made by itself when the first assessment finishes.

Every change dry-run against the live tenant, logged and read back; anything that removes or disables is approved first, except taking one person out of a group, a list or a mailbox.

One check fixed at every tenant that fails it. Where the same check fails at several tenants, prepare the fix at up to 100 of them from one screen. Each tenant still gets its own change, dry-run against its own tenant, with its own approval rule and its own way back.

Approve a policy in advance and fixes that are not high-risk, and either can be undone or change nothing in the tenant, run on their own after a clean dry run, within daily limits, each checked again and reported.

Add a user, a licence, a group member or mailbox access straight away; offboard a leaver, reset a password shown once, sign someone out everywhere, retire or wipe a device as an approved change.

SPF and DMARC published at the tenant’s Cloudflare, Azure DNS or Amazon Route 53, DKIM switched on and MTA-STS hosted, with the previous records kept as the way back.

Conditional Access, named locations, sharing, guest, authentication and cross-tenant settings, and Intune compliance policies and configuration profiles, kept after every assessment, the last 30 versions of each. Put any of them back as an approved change, even a deleted Conditional Access policy.

A Conditional Access starter set in report-only mode, an Intune starter set, and runbooks for onboarding, the monthly review, a leaver and a compromised account that tick themselves off.

Executive, technical and board reports, and the tenant review pack. Choose the report and its sections with a live preview, in your logo and colours, signed off with your contact details. Send it to the tenant with a note, or let the monthly email send it for you.

A live page per tenant, where they reply. Each tenant gets a branded, always-current page with their score, trend, verified fixes and next steps. They can reply to each step (go ahead, not now, or a question) and sign off access reviews.

Each assessment is compared with the last. A fix counts only when the live tenant passes again, credited to whoever made it; marked done but still failing is called out.

Every tenant in one report, every console table as CSV or Excel with your filters and every report as JSON, each export recorded in the audit log.

The latest result of each check with its date, and accepted risks with their reasons, per tenant and framework; and time to fix against a target for each severity.

The questions insurers ask, answered yes, partly or no from the assessment with the evidence beside each, printable for the form.

HaloPSA, ConnectWise, Autotask, NinjaOne and Kaseya BMS (beta): one ticket per failing check, closed with a note when it passes.

A REST API for tenants, scores, findings and reports, described in OpenAPI 3.1, with signed webhooks and your own checks as custom rules.

Tenant replies, drift, alerts and reports in the app, by email and in Teams or Slack. Your team signs in with two-step verification, or single sign-on with Microsoft or your own identity provider.

Paid seats nobody uses, costed at your prices. Licences on disabled, dormant and guest accounts, licences a suite the person also holds already includes, unused Microsoft 365 Copilot seats and plans bigger than the tenant uses, costed per year at your prices, with the accounts behind each. Licences you have not priced are left out, never guessed.

Seats of the licence unused for 30 days, who uses it and in which apps, and whether a tenant is ready to switch it on.

Your distributor invoice, as CSV or Excel, matched to every tenant: seats billed that no tenant holds, seats never assigned, and licences you are not billing.

Partner Center subscriptions beside the licences in use. Change a seat count as an approved change that follows Microsoft’s new-commerce rules, never below the seats assigned.

The Intune inventory dated against each operating system’s support window, with replacements at 4 budgets and a forecast, and an asset register for each device’s tag, purchase, warranty, location and disposal.

Open findings estimated in hands-on hours and priced at your rate, as a branded quote tracked to acceptance.

A free Microsoft 365 check on a page in your brand. Prospects get an instant result from public information; you get the lead, and can send their admin a permissions email from you.