Microsoft 365 security for schools and trusts
Check every school’s Microsoft 365 against 179 security checks, fix what you approve, and give governors and trustees a report they can read.
Each school with its own Microsoft 365 is one tenant on the price list, and pupils never count towards it.
A school, college or trust we have verified gets a 30-day trial instead of 14 days, with no card.
Where schools are exposed in Microsoft 365
Four places to look first. Each comes with the checks that read it, and each check’s page says how to fix it in your own tenant, step by step.
Every Microsoft 365 security checkStaff accounts and admin roles
A stolen password is enough to sign in where MFA is not enforced, or where older sign-in methods that skip MFA are still allowed. An administrator without MFA puts the whole tenant at risk, and a leaver’s account that was disabled but still forwards mail or holds a role is easy to miss at the end of term.
Email that pretends to be the school
Without SPF, DKIM and an enforced DMARC policy, anyone can send mail that appears to come from the school’s own domain, to parents, staff or suppliers. Mail forwarded automatically to a personal address takes school data with it.
Sharing in SharePoint, OneDrive and Teams
“Anyone” links open a file to whoever holds the link, without signing in. Guests who can reshare, and public teams that every member of staff can join, widen the circle further.
Laptops and devices
Staff laptops go home. Where devices are managed in Intune, the checks look for ones without disk encryption, ones on an operating system that no longer gets security updates, and platforms with no compliance policy at all.
How ConfigCheckup helps
Every check, on every school’s tenant
179 checks across accounts, admin roles, devices, email, sharing and more, read with read-only consent from one of your administrators, and the Exchange Online and Defender settings once you also give ConfigCheckup the Exchange role. It reads settings and activity records (such as sign-ins and the audit log), never content. A check that cannot run is shown as not assessed, never as a pass.Fixes you approve
With Automate111 checks have a fix that is tried as a dry run against the live tenant, approved, then made and read back; the rest come with step-by-step guidance. Anything that removes or disables is approved by one or two people, your choice per client; some higher-risk changes always need two. With two, at least one is not the person who raised it. Changes that only add, and taking one person out of a group or a mailbox, run without approval and can be undone.Reports for governors and trustees
Board, executive and technical reports as PDF or HTML, in your school’s or trust’s own logo and colours. For auditors and insurers, an evidence pack: each control’s checks, the latest result and the date it was read.Everyday jobs, approved
With AutomateReset a class’s passwords, up to 30 pupils in one approved change. Offboard a leaver, or retire a lost laptop, the same way.
Interactive demo of the ConfigCheckup console, with demo data: New report. Loading the interactive demo.
- Choose the report, such as the board summary
- A live preview, in your own logo and colours
The DfE digital and technology standards
The Department for Education publishes digital and technology standards for schools and colleges in England, with cyber security standards among them. We link to them rather than restate them, so you always read the department’s own, current wording.
- Meeting digital and technology standards in schools and colleges, on GOV.UK
- The cyber security standards for schools and colleges, on GOV.UK
Microsoft 365 settings can show part of the picture. This is where the line falls for ConfigCheckup.
What Microsoft 365 settings can show
- MFA on staff accounts, and older sign-in methods that skip it blocked
- Who holds administrator roles, and whether each one uses MFA
- SPF, DKIM and DMARC on the school’s email domains
- Sharing and guest access in SharePoint, OneDrive and Teams
- Disk encryption, compliance and operating system support, for devices managed in Intune
- Audit logging, and alerts on suspicious sign-ins
What sits outside Microsoft 365
- Backups of your data, including any offline copies. ConfigCheckup keeps copies of some security settings, never of mail or files.
- Training for staff and governors
- Firewalls, Wi-Fi and the school network
- Web filtering and monitoring
- Devices not managed in Intune, and systems outside Microsoft 365, such as your management information system (MIS)
- Your incident response plan, and the conditions of any cyber cover
If your school or trust has cyber cover, through the Department for Education’s risk protection arrangement (RPA), described on GOV.UK, or through an insurer, read its conditions in your own membership rules or policy. ConfigCheckup does not know them, and any condition about backups, training or planning sits outside Microsoft 365.
ConfigCheckup is not approved or endorsed by the Department for Education, and a good score is not proof that a school meets the standards.
Cyber Essentials for schools
Cyber Essentials is the UK government-backed scheme that covers 5 basic technical controls. 8 of its 17 requirements can be evidenced from a Microsoft 365 tenant: ConfigCheckup reads those, and records your own answers for the rest, such as boundary firewalls.
Readiness is not certification. Certification is assessed by an IASME certification body, and ConfigCheckup is not one.
Cyber Essentials and Microsoft 365, requirement by requirement The free Cyber Essentials checklist
Pricing for schools and trusts
The same price list as everyone else, by tenant. Each school with its own Microsoft 365 is one tenant, covering up to 300 staff users. Students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count.
| Example | Monitor | Automate |
|---|---|---|
| One school (one tenant), a month | £29 | £59 |
| One school, a year (the price of ten months) | £290 | £590 |
| A trust of 12 schools and its central team (13 tenants), a month | £125 | £203 |
- Schools that share one tenant count it once for every 300 staff users: 900 staff users count as 3. A tenant with more than 2,500 staff users is on Enterprise, by quote.
- Monitor watches every tenant and guides each fix; Automate makes the fixes you approve, with a free test tenant to try them on first.
- A year costs ten months, paid by card or by invoice with a purchase order.
- Try it free first: 14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. A school, college or trust we have verified gets a 30-day trial instead of 14 days, with no card.
Questions schools ask
Does ConfigCheckup show that our school meets the DfE standards?
Not on its own. It shows the Microsoft 365 part: whether the settings its checks read are in place, with the evidence and the date each was read. Anything outside Microsoft 365, such as backups, training and your network, is for you to evidence. Check your position against the standards themselves on GOV.UK. ConfigCheckup is not approved or endorsed by the Department for Education.
Our schools share one Microsoft 365 tenant. How is it counted?
As one tenant for every 300 staff users or part of 300, however many schools are in it: 900 staff users count as 3. Students and pupils, guests, unlicensed and disabled accounts, shared mailboxes, and room and equipment accounts never count. A tenant with more than 2,500 staff users is on Enterprise terms, by quote. In the console a shared tenant is one tenant, so its results cover all the schools in it together.
Can a trust see all its schools in one place?
Yes, where each school has its own tenant. Every school’s tenant sits in one workspace, worst first, with its score and trend. A baseline holds every school to the same set of checks, with an alert when a setting drifts, and the portfolio report puts every school in one report.
Can it reset a whole class’s passwords?
Yes, with Automate: up to 30 pupils in one approved change. Only accounts that hold student licences alone, can sign in, were made in Microsoft 365 and hold no admin role are reset; anyone else is left out, to be reset on their own. Each one-time password is shown once, to the person who runs the change, and ConfigCheckup never stores it, emails it or puts it in a log. A reset cannot be undone: pupils choose a new password when they next sign in.
Our IT is run by an outside provider. Can we still use it?
Yes. A Microsoft 365 tenant connects to one ConfigCheckup workspace at a time, so agree who holds it. Your provider can connect it in its own workspace and send you reports and a live portal, or your school or trust can hold it and invite the provider’s engineers as members. The price list is the same either way.
Check your first school’s tenant today.
Connect with read-only consent from one of your administrators, and see the findings once the first assessment finishes.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. A school, college or trust we have verified gets a 30-day trial instead of 14 days, with no card.