Help and FAQ

One place to manage the Microsoft 365 tenants you look after: your tenants’, or your own organisation’s. It connects to each tenant with read-only consent and runs 195 checks across identity, access, devices, email, collaboration, threat protection, licensing and governance. What can be fixed automatically is drafted as a change you approve; everything else comes with a step-by-step guide. Progress, drift and reports are tracked per tenant and across all of them.

No. No AI or large language model reads, stores or processes your tenants’ data. Every check is a rule written by people that reads configuration and compares it with a stated standard, so the same tenant always gives the same result, and the rule is shown on each finding. Fixes are pre-written changes, and reports are built from the assessment with fixed templates. The Copilot pages report on a tenant’s own Microsoft 365 Copilot licences; they do not use AI either.

Each automated fix is a pre-written change: a fixed set of Microsoft Graph or Exchange Online calls for one setting or list of objects. When you propose one, ConfigCheckup first reads the live tenant and lists exactly what would change and what would be skipped (the dry run). Nothing changes until it is approved. Approved by one or two people, your choice per tenant; some higher-risk changes always need two. With two, at least one is not the person who raised it. The previous state is recorded, so most changes can be rolled back, and the tenant is read again afterwards to confirm the finding is fixed.

From the assessment itself. ConfigCheckup fills a fixed report template with the tenant’s results, scores, findings and their guides, then renders it to PDF on its own servers. No text is written by AI, and the numbers in a report are the ones on screen.

Anyone who looks after Microsoft 365, primarily in the UK: managed service providers and IT consultancies for their tenants, and organisations, schools and academy trusts for their own. Everyone has the same plans at the same prices, priced by tenant, from £35 a month for your first tenant on Monitor. The only difference is the words: the console says tenants for an MSP, and tenants for an organisation. See the price list

Type the tenant’s domain in ConfigCheckup (no tenant ID to look up), then grant consent yourself if you are their Global Administrator, or send the consent link to one (or a Privileged Role Administrator). Microsoft shows them exactly which read-only permissions are requested. Once they approve, the first assessment starts automatically, and the first report is made from it for you to send to the tenant.

Most finish while you wait. Very large tenants take longer because Microsoft Graph limits how quickly data can be read. Assessments run in the background, a progress page shows what is being read, and you can be emailed when one finishes.

Yes. The 2-minute tour on the demo page walks through the console’s screens one step at a time on a demo workspace, with no sign-up and nothing to connect. To try it hands-on, the self-contained Windows demo runs the whole product on one PC with synthetic tenants and never connects to Microsoft 365; ask us for the download link. Take the 2-minute tour

They do different jobs, and you can use both. Lighthouse and CIPP are for running tenants day to day. ConfigCheckup does the everyday admin that needs a safety net (new starters and leavers, password and MFA resets, groups, shared mailboxes and mailbox access, guests, licences, and retiring or wiping a device), each change dry-run first and with a person’s name against it. It assesses every tenant against 195 checks mapped to 19 frameworks, fixes what you approve with a dry run and a way back, and turns the result into reports and a tenant portal in your brand. Moving from a tool you pay for under contract? Your plan is free until that contract ends, for up to 2 months. How ConfigCheckup compares

Read-only Microsoft Graph application permissions: organisation, users, groups, policies, directory roles, applications, audit logs, reports and security events. Optional read permissions (Intune, Identity Protection, SharePoint settings, mailbox rules) widen coverage; without them the related controls are reported as not assessed, never as passed. Two settings areas have no Graph permission: Teams policies need the read-only Teams Reader role (or Global Reader, also read-only) on the read-only app, and Exchange Online settings are read through the automation app, with the Exchange Administrator role the tenant gives. Without them the related checks are reported as not assessed. The full list, roles included, is on the data protection page.

Not unless you set it up to. Assessment uses a read-only app, and Monitor watches and makes no changes. Fixes need Automate, a second app (ConfigCheckup Automation) that the tenant approves with its own consent and can delete at any time to remove all write access, automation switched on for that specific tenant, and a successful dry run. Approved by one or two people, your choice per tenant; some higher-risk changes always need two. With two, at least one is not the person who raised it. Every change records how to undo it, is audited, and the tenant is read again afterwards to confirm the fix.

No. It reads settings, directory information and activity records (accounts, groups, policies, devices, subscriptions, sign-ins and the audit log), never content. It asks for no permission to read mail, chats or calendars, and never opens a file: its one file permission, held by the separate automation app, lets an approved offboarding give a leaver’s manager access to their OneDrive. The forwarding check reads inbox rule definitions only.

The tenant’s administrator can delete the ConfigCheckup and ConfigCheckup Automation enterprise applications in the Entra admin centre (Enterprise applications) at any time. Access stops immediately. Removing a tenant in ConfigCheckup also deletes its assessments, findings and reports.

No. ConfigCheckup signs in as its own multi-tenant application, which your administrator consents to.

Yes, two ways. Sign in with Microsoft uses your own work account, so your organisation’s Conditional Access and MFA apply. Password accounts can add two-step verification with any authenticator app, with single-use recovery codes, and a workspace owner can require it for everyone. Passwords are at least 12 characters and stored as salted scrypt hashes, sign-in attempts are rate limited, and you can see and end your active sessions under Settings → Security.

Yes, as a readiness check. Each tenant has a Cyber Essentials view that maps the scheme’s five controls to the checks ConfigCheckup runs: MFA, admin rights, leavers, device configuration and unsupported operating systems are evidenced straight from the tenant. Firewalls, anti-malware and patching timelines cannot be seen from Microsoft 365, so your consultants record those with a note, and the technical report includes the result. It prepares a tenant for assessment; certification itself is awarded by an IASME certification body.

195 checks: MFA and authentication methods, Conditional Access, legacy authentication, privileged roles, app registrations and consent grants, Intune compliance and device health, SPF, DKIM, DMARC and MTA-STS, mail forwarding, guest and sharing settings, Secure Score, risky users and alerts, licence waste and governance hygiene. Each finding includes the evidence, the business impact and step-by-step remediation.

It compares each assessment with the previous one. A fix only counts when the re-read tenant passes the check. It is credited to an approved automated change or to the consultant who marked it done, with their note; otherwise it is shown as a change made directly in the tenant. Anything marked done that still fails is reported as such.

A set of controls every tenant should meet, for example the standard your managed service promises, with the values its fixes use. Apply it to all tenants or to tenants with a given tag, and ConfigCheckup shows who meets it, the controls hardest to meet, drift since the last assessment and a trend. It can report only, draft each missing fix for approval, or fix automatically where the safeguards allow, and an admin can accept a deviation for a tenant for up to 12 months.

They are indicative UK business prices excluding VAT, meant for budgeting rather than quoting. Each tier states a minimum specification to hold resellers to, with current example models.

Yes. Your logo, brand colour and footer go on every report. There are executive, technical and board reports, plus the tenant review pack for quarterly meetings, as PDF or Word, with optional expiring share links. Each tenant’s report can be sent monthly, quarterly or after every assessment, by email or as a ticket in your PSA.

Your board sees the board report and the board summary link: a read-only page with your score, its trend and what is next. The link is one secret address with no evidence or user names on it, so it is for the board, not for audit. Auditors and insurers get an evidence pack: each control with its checks, the latest result and the date it was read, the risks you accepted and why, and the access reviews your managers signed.

Yes. Email authentication (SPF, DKIM, DMARC, MTA-STS) for every custom domain, and inbox rules that forward mail outside the organisation, on every tenant. Once the tenant’s administrator gives ConfigCheckup the Exchange role, it also reads Exchange Online and Defender settings (anti-phishing, anti-spam, Safe Links, Safe Attachments, transport rules, auditing and mailbox access) through Exchange’s admin commands, and can fix them as approved changes.

One price list for everyone, by tenant, never per user: an MSP, an organisation, a school or a trust pays the same way. Monitor is £35 a month for your first tenant, then £6 a tenant to the 50th, and £4 from the 51st; Automate is £69 a month for your first tenant, then £9 a tenant to the 50th, and £5 from the 51st. A tenant covers up to 150 staff users, and a larger one counts once for every 150; students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count. You choose how many tenants to pay for, at least as many as you have counted, and seats for your team come with the plan. Every plan has every check, unlimited assessments and unlimited reports. Prices have no VAT added, and a year costs ten months. See the price list

Credits pay for optional extras. Everything else is included. Extras are documents, workbooks and checks that a person asks for and confirms, each listed under Extras with its cost, such as a proposal document (3 credits a lead) or a bulk prospect scan (1 credit for each 10 domains). Nothing is used until you confirm. These never use credits: assessments, findings, scores, Cyber Essentials readiness and insurance answers, every report and evidence pack, changes and automation, rollback, everyday admin, the views extras build on (such as connected apps and licence renewals), alerts, support, the tenant portal, every table’s export and the as-built handover document, the free lead health check, integrations and the API and every schedule and background job. Monitor includes 10 credits a month, plus 2 for each tenant after the first; Automate 25, plus 4; a trial 10, once; and your first plan payment brings 100. Monthly credits refresh on the 1st of each month (UTC) and do not carry over. You can buy more, in pounds: 100 for £15, 500 for £60 or 2,000 for £200, each lasting 12 months, or 100 more each month for £10. How credits work

No. Credits are used only when a person asks for an extra and confirms it, with the cost on the button first. Reports never use them: every report you make in Reports, every evidence pack, a lead’s report and the portfolio report, whether a person, a schedule, the API or Power Automate asks for it. Exports never use them: every table downloads as CSV or Excel, free. Extras are separate documents and checks, each with its own name under Extras. Automation, alerts and every background job never use credits either.

Yes. Owners and Admins of a workspace on a paid plan have a link in Extras › Credits. A workspace that signs up from it gets a 30-day trial instead of 14 once its owner confirms their email address, for up to 10 workspaces a year from one link. When it has paid for two months and assessed a tenant, both workspaces get 300 credits for optional extras, as long as the recommending workspace is still on a paid plan. Up to 10 rewards a year for each workspace. Not for the same person or company, your own other workspaces, or a tenant you both look after. We never tell either workspace which the other is.

No. There is a 14-day trial of daily monitoring and alerts, every finding with its fix guide, and reports, with no card, and then plans start with Monitor at £35 a month for your first tenant: daily monitoring, unlimited reports in your brand and the live portal. Approved fixes come with Automate. The public email security check stays free for anyone.

Pounds sterling. Prices have no VAT added.

Not yet. ConfigCheckup is not registered for VAT, so no VAT is charged on any price or invoice. Once we are registered, VAT will be added at the standard rate, and we will say so here and on your invoices. Schools and most businesses can reclaim it.

No. Sign up and you get 14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants. You only enter a card when you choose a plan.

Yes. Choose “Buy Monitor” or “Buy Automate” on the pricing page, or a plan in the price calculator, which carries the tenants you counted and monthly or yearly billing. Sign-up shows the price, and once your workspace exists you go straight to paying by card; a yearly plan can be paid by invoice with a purchase order instead. There is no trial first: the plan starts as soon as it is paid for or invoiced. The plans, prices and offers are the same as after a trial, for every buyer. If you leave checkout without paying, pay later from Settings → Plan and billing, or start the free trial instead if your email address has not had one in the last 60 days. See the plans

The trial is daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, with 3 seats and no card, the same for everyone. It includes 5 assessments you start and 3 reports for each tenant a month, up to 3 leads at once and 3 lead health checks a month; scheduled runs and fix checks don’t count. The read API comes with Monitor, and approved fixes, webhooks and custom rules with Automate; you can still see every fix guide. The 14 days count from when your first tenant connects, and you have 30 days from sign-up to connect one, so time waiting for consent is not lost. A school, college or public body we have verified gets 30 days, to fit a purchase-order cycle, and so does a workspace that signs up from a customer’s recommendation link once its owner confirms their email address (up to 10 a year from one link). The trial comes with 10 credits, once, to try an optional extra. Need longer? Add 7 days once, from Settings → Plan and billing. When it ends without a plan chosen, the workspace turns read-only; it does not close. Your tenants, findings and history stay. You can still sign in, read every finding and its fix guide, and download every report and export; new assessments, reports and changes wait until you choose a plan. Choose a plan at any time to pick up where you left off. A trial is available once per email address, and once per Microsoft 365 tenant, in any 60 days.

The trial is for proving it works on 3 real tenants before you pay. When you choose a plan, you pay for as many tenants as you look after, up to 300, and every one is available straight away; add more one at a time without changing plan. If you are under contract with another tool, the switch offer means you don’t pay until that contract ends, for up to 2 months.

One Microsoft 365 organisation with up to 150 staff users: a tenant, your own organisation, or a school. A larger one counts once for every 150 staff users or part of 150: 300 counts as 2 and 450 as 3. A tenant with more than 500 staff users, or more than 300 tenants in all, is on Enterprise terms. Staff users are enabled members with a Microsoft licence that is not a student one, counted at each assessment; students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts don’t count. Automate’s free test tenant, marked Pilot or Lab, with up to 25 licensed users and no domain of its own (only onmicrosoft.com, or a subdomain of another of your tenants), is not counted at all. If your tenants come to count as more than you pay for, for any reason, your workspace’s Owners are told and have 14 days to add tenants or remove some before the workspace turns read-only. See how tenants are counted

For more than 300 tenants, or a tenant with more than 500 staff users, we quote a price for your estate, always above the list, never a discount on it. Enterprise costs more than the list, never less: at least Automate’s list price for the same tenants, a tenant over 500 staff users counting once, plus one staff band for each 150 staff users above 500 in a tenant, priced like tax bands: £50 a month each for the 1st to the 5th and £400 from the 6th, and a platform fee of £500 a month, billed yearly (£6,000 a year). So past 500 staff users a tenant’s price grows with its staff users, one more staff band for each further 150: a single organisation of 2,000 staff users is one tenant with 10 staff bands. From £2,819 a month: Automate’s list price for 1 tenant (£69), 10 staff bands, 5 at £50 and 5 at £400 (£2,250), and the £500 platform fee. Add-ons, priced at quote: an uptime service level, with part of the fee taken off the next invoice when it is missed; named support with a 4-hour response; longer data retention: up to 7 years of history, where Automate keeps 3; procurement: purchase orders, invoicing, your own contract and DPA terms, and security questionnaires. Quotes made before 6 November 2026 keep their terms. See Enterprise

You can connect it: a tenant’s staff users are only known once its first assessment has read them. If it has more than 150, it counts as more than one (400 count as 3), so your tenants may come to more than your plan covers. Then your workspace’s Owners and Admins see a banner, and the Owners get one email, naming the tenant, its staff users, what it counts as, what your plan covers and the day the workspace would turn read-only. For 14 days everything works as before: add the tenants it needs (one button fills in the number, charged for the rest of the period, prorated) or remove a tenant. After that the workspace is read-only until your plan covers your tenants: everything stays visible and downloadable, but new assessments, reports, tenants and changes wait, and adding tenants or removing one ends it straight away. A tenant with more than 500 staff users is on Enterprise terms, so contact us. On the trial each tenant counts once, and Settings → Plan and billing shows what it would count as on a paid plan. See how tenants are counted

Like anyone else, on the same price list. Each school with its own Microsoft 365 is a tenant, and pupils and students never count, so a school of up to 150 staff counts once; a trust whose schools share one tenant counts it once for every 150 staff users. A trust of 12 schools and its central team, 13 tenants, pays £107 a month on Monitor or £177 a month on Automate. A school, college or public body we have verified gets a 30-day trial, and any yearly plan can be paid by invoice with a purchase order. Work out your price

Not while a tenant stays within 150 staff users, which covers most businesses and most primary schools; past that, it counts once for every 150. Seats for your own team come with the plan: 10 on Monitor and 25 on Automate, or one for each tenant you pay for when that is more, so 40 on Automate for 40 tenants.

Change the tenants you pay for in Settings → Plan and billing whenever you like. More tenants are charged at once, prorated. A change to fewer is made at once too, and the lower price is charged from your next renewal, with nothing back for the time already paid; you can’t pay for fewer tenants than you have counted, so remove some first. Connecting a tenant beyond the ones you pay for waits until you add one, and if your tenants come to count as more than you pay for (a tenant grows past 150 staff users, say), your workspace’s Owners are told and have 14 days to add tenants or remove some before the workspace turns read-only.

Choose “Moving from another tool” in Settings → Plan and billing. Your plan is then free until that contract ends, for up to 2 months. It applies to your first subscription, billed monthly, and the contract must end at least two days from now. Your card is taken at checkout, and the first payment is on the day your contract ends, or 2 months after checkout if that comes first.

No plan holds you to a term: pay monthly, or yearly for two months free, and cancel whenever you like; cancelling is never refused. The one minimum: Automate has a 3-month minimum before it can move to Monitor, counted from when your workspace came on to Automate, whether you change plan or cancel and then buy Monitor; until then you can choose Automate again. A move down changes your plan at once, and the lower price is charged from your next renewal. Moving to Monitor cancels changes still waiting for approval or waiting to run; the plan page tells you how many first, and nothing more is changed in your tenants. If you stop paying for a plan, it runs to the end of the period you have paid for, then the workspace turns read-only, keeping 12 months of history with your findings and reports, and you can choose a plan again whenever you like. Removing a tenant deletes its data, and an Owner can close the workspace and delete everything in it from Settings → Workspace.

Yes, on any yearly plan, when you start it: choose to pay by invoice when you buy a plan on the website, or in Settings → Plan and billing, and give your purchase-order number. The plan starts at once, and the invoice, with your purchase order on it, is due in 30 days. Already paying by card? Write to us to move to invoices.

Because Monitor watches: it assesses, alerts and reports, and never changes a tenant. Fixes need Automate, a separate app the tenant consents to, automation switched on for that tenant, a dry run and an approval. Approved by one or two people, your choice per tenant; some higher-risk changes always need two. With two, at least one is not the person who raised it. Each change records how to undo it, and the tenant is read again afterwards to confirm the fix. On Monitor and in the trial you can still run a fix’s dry run to see exactly what it would change, for fixes made through Microsoft Graph (Exchange Online and Purview settings are read through the automation app, so theirs come with Automate), and a Simulate policy tells you each week what Automate would have fixed.

Changes, made safely. Monitor watches, alerts and reports. Automate adds approved changes in the tenant: fixes, the common admin jobs, containing a taken-over account, licence reclaim and seat changes, each dry-run first, approved and logged, and able to be rolled back wherever Microsoft allows. It includes a free test tenant to try each fix on first, marked Pilot or Lab, with up to 25 licensed users and no domain of its own, not counted. It also adds hands-off work: policies you approve once, after which covered fixes run on their own when an assessment or the drift check finds a setting has slipped (only fixes that are not high-risk and either can be undone or change nothing in the tenant, after a clean dry run, each reported), and containing a taken-over account automatically when ConfigCheckup is sure. It fixes one failing check across every tenant from one screen, with a change for each, and checks each tenant’s logs for security events every 5 minutes rather than 15. And custom rules for checks and alerts, webhooks, API keys that can queue assessments and draft changes for people to approve (Monitor includes the read API), and 36 months of history.

In the region shown on the data protection page. Assessment history is kept for your plan’s period (24 months on Monitor, 36 on Automate), and each tenant’s latest assessments are always kept, so trends and change tracking work. Removing a tenant deletes its data, and an Owner can close the workspace and delete everything in it from Settings → Workspace.

ConfigCheckup is built to data-minimise: collectors keep only the fields the checks need. For the tenant data you process through it, you are the controller and we act as your processor under a data processing agreement. The data protection and privacy pages set out the detail.