Free tools
Free Microsoft 365 security tools. No sign-up.
Quick checks you can run today, for your own organisation, a school, a tenant or a prospect, with no account and nothing to connect.
Each one answers a narrower question than a full assessment, and says plainly what it cannot see.
Email security check
Enter any domain to see its SPF, DKIM, DMARC and MTA-STS, how well it is protected against spoofing, and how to fix what is missing.
Seconds · reads public DNS only
Open the tool: Email security checkAnswer a few questions about your Microsoft 365 sign-in settings: enforcement, legacy authentication, admins, SMS, guests and break-glass accounts.
Two minutes · nothing connected
Open the tool: MFA readiness checkEvery requirement across the five controls, where to check it in Entra, Intune and Defender, and what to confirm outside the tenant.
Tick as you go · print it for the file
Open the tool: Cyber Essentials checklist
When to use each one.
The free tools look from the outside, or ask what you know. A full assessment reads the tenant itself, so it sees what they cannot: 208 checks, each with how to fix it.
Email security check
Use it: When you set up or move a domain’s mail, when someone reports mail that looked as if it came from you, or before you meet a tenant or a prospect. It reads public DNS only, so it works on any domain without asking anyone, and grades it A to F.
What it cannot tell you: It cannot see inside Microsoft 365: forwarding rules, Safe Links, Direct Send and the other Exchange Online settings need the tenant itself. DKIM keys can only be confirmed on common selectors.
Check a domain’s SPF, DKIM and DMARCRelated checks, with how to fix them
MFA readiness check
Use it: When you are about to enforce MFA, or when you take on a tenant and want a quick view of how sign-in is set up. 9 questions, each with what to do when the answer is not yes.
What it cannot tell you: Nothing is connected, so the answer is only as good as what you know about the tenant. To see who has not registered for MFA, the tenant has to be read.
Take the MFA readiness checkRelated checks, with how to fix them
Cyber Essentials checklist
Use it: Before you apply for Cyber Essentials, or each year before you renew. All 17 requirements across the 5 controls, with where to check the 8 that Microsoft 365 can show in Entra, Intune and Defender. Your ticks stay in this browser.
What it cannot tell you: The rest, such as boundary firewalls, are for you to confirm outside the tenant. Readiness is not certification: certification is assessed by an IASME certification body.
Open the Cyber Essentials checklistRelated checks, with how to fix them
Go further, still free.
Reference pages built from the same catalogue the product runs on, open to read and with no sign-up.
- All 208 checks, by area: what each setting is, why it matters and how to fix it, step by step.
- The same checks as one list, worst first, to print or download.
- 20 frameworks, from Cyber Essentials to ISO 27001, with the checks behind each control and what sits outside Microsoft 365.
- What a Microsoft 365 tenant can show for Cyber Essentials, and what only you can confirm.
See this for every tenant
These tools check what can be seen from outside, or what you tell them. ConfigCheckup reads each tenant itself, with read-only consent, runs 208 checks and tells you what changed since last time.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.
Put a health check like these on your own site to win leads Microsoft 365 security for schools and trusts Checking your own organisation’s tenant