Features
A good consultant can produce this assessment by hand. It takes one to two days of senior time per tenant, varies between engineers, and is out of date within weeks. ConfigCheckup turns it into a repeatable service: the first assessment takes minutes, and every one after it shows what changed.
It is built for managed service providers that look after many tenants: priced per tenant, white-labelled, and designed around the conversation with the client. Every feature below is on every paid plan unless it says otherwise.
How it works
Send your client’s Global Administrator a consent link. They see exactly which read-only permissions are requested, and can revoke them at any time.
ConfigCheckup reads identity, access, devices, email, collaboration, threat protection and licensing through Microsoft Graph and public DNS, then evaluates 71 controls.
Generate a branded report, work through the prioritised roadmap, and re-assess on a schedule to prove what changed.
Identity, admin access, devices, email, collaboration, threat protection, data and licensing, read through Microsoft Graph with read-only consent. Each finding comes with the evidence and numbered steps to fix it.
See how each client measures up against the framework they are audited on, control by control, with a printable report. Cyber Essentials Plus, ISO 27001:2022, NCSC CAF, NIS2, DORA, SOC 2, PCI DSS 4.0, NIST 800-171, CMMC and more.
Copilot can find anything a person can already open. See who can see what, which public teams hold files every employee can read, whether content is labelled, and what to fix before rollout. Once it is live, see who uses Copilot and in which apps, and reclaim the seats nobody opens.
Every third-party and in-house app with access to the tenant, with what it can reach, who consented, whether the publisher is verified and when it was last used. Risky apps can be blocked through an approved, reversible change.
The five Cyber Essentials controls, with the Microsoft 365 requirements answered from the assessment and the rest recorded by you, across every client.
Every custom domain checked for spoofing protection, with Defender for Office 365 and Exchange Online settings from Secure Score.
Each assessment is compared with the last. A fix counts only when the live tenant passes the check again, credited to whoever made it, and anything marked done but still failing is called out.
Executive, technical and board reports, and a short client review pack for the quarterly meeting: score movement, what was delivered, what is left and the hardware budget, with your name and logo on them.
Each client gets a branded, always-current page with their score, trend, verified fixes and next steps, and can reply to each step: go ahead, seen it, or ask a question.
A free Microsoft 365 health check on a page with your name, logo and colour. Businesses enter their domain and get an instant result from public information; you get the lead, and can add them as a tenant in one click when they agree to the full check.
The questions insurers ask at proposal and renewal, answered yes, partly or no from the assessment with the evidence beside each, and a printable version for the proposal form.
Open findings, most urgent first, estimated in hours and priced at your rate, as a branded quote. Sent, accepted and declined are tracked.
Licences on disabled and dormant accounts, Copilot seats nobody uses, and plans bigger than the tenant uses, costed per year, with the evidence. Reclaiming them is drafted as an approved change.
Import your Pax8, TD SYNNEX, Giacom or Microsoft invoice as CSV. Each line is matched to its tenant and licence, and compared with the seats the tenant holds and uses.
Every device dated from its model and checked against its operating system’s support window, with replacements at four budgets and a four-year forecast. Inactive end-of-life devices can be removed through an approved change.
Each tenant’s audit log is read every 15 minutes. A new Global Administrator, a risky app consent, an MFA method removed, Conditional Access deleted or a domain federated is sent to email, Teams or Slack straight away.
Conditional Access, named locations, sharing, guest and authentication settings and Intune compliance policies are backed up daily. See exactly what changed and when, and put Conditional Access or sharing back through an approved change.
Define what your service promises once and hold every tenant to it. A daily check alerts you by email, Teams or Slack when a critical control stops passing.
Search and filter findings across the whole portfolio. Assign owners, set due dates or accept a risk across many at once, and save the views you use.
Disable dormant accounts, reclaim licences, remove stale devices and more. Every change is previewed, approved by a second person, recorded with a way back, and audited.
Failing controls become tickets in your PSA with the fix steps in them, and close themselves with a note once a later assessment shows them passing.
A REST API for tenants, scores and findings, and signed webhooks when assessments finish, reports are ready or drift appears.
Load your customers from Partner Center and add them all at once, with a queue to track which are still waiting for consent.
Client replies, drift, finished assessments and reports in the app and by email, with drift alerts to Teams or Slack. Your team signs in with two-step verification or Microsoft single sign-on.
Up close
The dashboard’s own panels: average score, what is open by severity, readiness against the frameworks your clients ask about, and the tenants that need you first.
Average posture
Across 24 tenants
8 since last quarter
Open findings by severity
Framework readiness
Tenants, weakest first
Illustrative figures.
One consent
The dashboard for you, the evidence for your engineers, and a branded portal for the client, all from the same read-only assessment.
Principles
Assessment never needs write access. Automation is a separate consent, off per tenant until an administrator turns it on, and every change is dry-run and approved by a second person.
Missing permissions or licences are reported as coverage gaps and excluded from the score in both directions, and the coverage percentage is printed next to it.
Marking something done is recorded, but only a re-read of the tenant counts it as fixed.
Reports lead with business risk and what changed, with the technical evidence behind them for the engineer who has to act.
Control catalogue
71 controls across 8 areas, generated from the product itself, so it is always current. Filter by framework, search, and open any control to see what it checks and how to fix it.
Measures how many enabled member accounts have registered at least one multi-factor authentication method.
Recommended fix
Drive registration to 100% of enabled member accounts, then enforce it with Conditional Access.
Fourteen days, one tenant, no card.