Check, fix and prove your own Microsoft 365 security
For IT teams that look after their own organisation’s Microsoft 365, from a small office to 2,500 staff: 179 checks, fixes you approve, and reports your board and insurer can read.
No MSP needed, and it works alongside one.
Interactive demo of the ConfigCheckup console, with demo data: People. Loading the interactive demo.
What it checks
179 checks, read with read-only consent from one of your administrators, and the Exchange Online and Defender settings once you also give ConfigCheckup the Exchange role. It reads settings and activity records (such as sign-ins and the audit log), never content. A check that cannot run is shown as not assessed, never as a pass.
Every check, with how to fix it The Microsoft 365 security checklist
| Area | Checks | What it looks at |
|---|---|---|
| Identity & Authentication | 34 | How accounts prove who they are: MFA coverage, passwordless adoption, legacy protocols. |
| Privileged Access | 21 | Who holds administrative power, how it is granted, and whether it is time bound. |
| Data Protection | 14 | Retention, sensitivity labelling, DLP coverage and external sharing of content. |
| Device & Endpoint | 20 | Enrolment, compliance, update rings and endpoint protection posture. |
| Collaboration & Sharing | 36 | Teams, SharePoint, OneDrive and guest access configuration. |
| Threat Protection | 42 | Defender coverage, alerting, risk detections and incident readiness. |
| Licensing & Cost | 5 | Entitlement use, unassigned seats, duplication and downgrade opportunities. |
| Governance & Operations | 7 | Lifecycle, ownership, documentation, audit retention and change control. |
Fixes you approve, with a way back
With Automate111 checks have a fix that is tried as a dry run against your live tenant, approved, then made and read back. The rest come with step-by-step guidance on every plan.
Read-only until you choose otherwise
Changes need a second app, the automation app, which you approve separately and can remove at any time. It also holds the Exchange role that reads Exchange Online and Defender settings.Approved the way you choose
Anything that removes or disables is approved by one or two people, your choice per client; some higher-risk changes always need two. With two, at least one is not the person who raised it. Changes that only add, and taking one person out of a group or a mailbox, run without approval and can be undone.A way back
74 of the 85 kinds of change can be undone, in whole or in part; the dry run says what cannot. Automate includes a free test tenant to try each fix on first.
Interactive demo of the ConfigCheckup console, with demo data: All changes. Loading the interactive demo.
- The dry run: what is set now, and after
- Reversible, with a recorded rollback plan
Frameworks and Cyber Essentials
Measure your tenant against the framework you are asked about, control by control, with what Microsoft 365 cannot show said plainly. 19 frameworks, each with its own page.
- Cyber Essentials
- Cyber Essentials Plus
- NCSC Cyber Assessment Framework
- Data Security and Protection Toolkit
- Digital Operational Resilience Act
- NIS2 Directive
- Microsoft Cloud Security Benchmark
- Zero Trust
- Microsoft Secure Score
- SOC 2
- PCI DSS 4.0.1
- NIST SP 800-171
- CMMC Level 2
- ISO/IEC 27001:2022
- CISA SCuBA Microsoft 365 baselines
- CIS Microsoft 365 Foundations v6.0.0
- CIS Controls v8.1
- NIST CSF 2.0
- NCSC 10 Steps
For Cyber Essentials, 8 of the 17 requirements can be evidenced from the tenant; you record your own answers for the rest, such as boundary firewalls. Readiness is not certification: certification is assessed by an IASME certification body.
Cyber Essentials and Microsoft 365, requirement by requirement Every framework, mapped to Microsoft 365
Reports your board and insurer can read
Board, executive and technical reports
As PDF or HTML, in your own logo and colours, and sent on a schedule if you want them to be.A board summary link
A read-only page with your score, its trend and what is next, with no evidence or user names on it. It is for the board, not for audit.Evidence packs for auditors
Each control with its checks, the latest result and the date it was read, the risks you accepted and why, and the access reviews your managers signed.Cyber insurance answers
The questions insurers ask, answered yes, partly or no from the assessment, with the evidence beside each and printable for the form.
No MSP needed, and it works alongside one
ConfigCheckup is built for MSPs and for teams that run their own Microsoft 365. Your workspace says tenants rather than clients; the checks, the plans and the prices are the same.
Already work with an MSP? A tenant connects to one ConfigCheckup workspace at a time, so agree who holds it: you, inviting your MSP’s engineers as members, or your MSP, sending you reports and a live portal.
Everyday jobs are approved changes too, with Automate: offboard a leaver, set up a starter like a colleague, reset a password with a one-time password shown once, or retire a lost laptop.
Leavers, starters and helpdesk tasksPricing for your organisation
Priced by tenant, never per user: one tenant covers up to 300 staff users, and a larger one counts once for every 300. Students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count.
| Example | Monitor | Automate |
|---|---|---|
| Up to 300 staff users (one tenant), a month | £29 | £59 |
| Up to 300 staff users, a year (the price of ten months) | £290 | £590 |
| 1,000 staff users (counts as 4 tenants), a month | £53 | £95 |
| 2,500 staff users (counts as 9 tenants), a month | £93 | £155 |
- A tenant counts once for every 300 staff users, and students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count; a tenant over 2,500 staff users, or more than 300 tenants, is Enterprise.
- Monitor watches every tenant and guides each fix; Automate makes the fixes you approve, with a free test tenant to try them on first.
- A year costs ten months, paid by card or by invoice with a purchase order.
- Try it free first: 14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.
The full price list and calculator See the guided tour first
Questions IT teams ask
Do we need an MSP to use ConfigCheckup?
No. ConfigCheckup is built for MSPs and for organisations that look after their own Microsoft 365. Connect your tenant with read-only consent from one of your administrators, and the checks, fixes and reports work the same way. Your workspace calls your tenants tenants rather than clients; nothing else changes, not the plans and not the prices.
We already work with an MSP. Can we use both?
Yes. A Microsoft 365 tenant connects to one ConfigCheckup workspace at a time, so agree who holds it. You can hold it in your own workspace and invite your MSP’s engineers as members, or your MSP can connect it in its workspace and send you reports and a live portal. The price list is the same either way.
What would an organisation of 1,000 staff pay?
One tenant of 1,000 staff users counts as 4 tenants, so it costs £53 a month on Monitor or £95 a month on Automate, no VAT charged. Students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count. A year costs ten months.
Can it help with our cyber insurance renewal?
For the parts Microsoft 365 can show, yes. ConfigCheckup answers the questions insurers ask about MFA, legacy sign-in, admin accounts and leavers with yes, partly or no from your tenant, with the evidence beside each, printable for the form. Questions about things outside Microsoft 365, such as backups and endpoint detection, are answered by you. Your insurer’s own form and wording come first.
Can we try a fix without touching our live tenant?
Yes, with Automate: a free test tenant, marked Pilot or Lab with up to 25 licensed users and no domain of its own, is not counted, so you can try each fix there first. Every fix on the live tenant is dry-run first anyway, so you see exactly what would change before anyone approves it.
Check your own tenant today.
Connect with read-only consent from one of your administrators, and see your findings once the first assessment finishes.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.