Security assessment
A Microsoft 365 security assessment for every tenant you manage.
Identity, email, devices, sharing and apps, checked with read-only consent, scored, and mapped to the frameworks your tenants are audited on.
Interactive demo of the ConfigCheckup console, with demo data: Findings. Loading the interactive demo.
- Worst first, with the check’s id
- What was found, read from the tenant
Why this is hard today
Checking tenants by hand happens a few at a time, at a renewal or after an incident. Each engineer checks different things, findings live in spreadsheets, and nobody can say whether last quarter’s fixes are still in place.
How ConfigCheckup solves it
Read-only by default
Admin consent to read settings and activity records, never content. Nothing is changed unless the tenant adds the automation app and you approve the change, one at a time or as a policy in advance.Worst first
Findings across every tenant, by severity, with the evidence and how to fix each.Proof it changed
Each assessment is compared with the last, so a fix counts only once the tenant passes.Frameworks
Readiness for Cyber Essentials, NCSC CAF, ISO 27001, NIS2 and more, control by control.
Connect
One read-only admin consent per tenant, or import every GDAP customer from Partner Center at once (on every plan).
Assess
208 checks across identity, admin access, devices, email, collaboration, threat protection, data and licensing. Anything that could not be read is named, never scored as a pass.
Act and prove
Work the findings worst first, fix with approval, quote the rest, and send the tenant a report in your brand. The next assessment shows what really changed.
Every open issue, at every tenant, worst first
Interactive demo of the ConfigCheckup console, with demo data: Findings. Loading the interactive demo.
The findings list across tenants: critical findings first, each naming the tenant and the area, and marked where there is an approved fix.
Check it yourself.
- All 208 checks are listed in the public control catalogue, with what each checks, how to fix it and the frameworks it maps to. Check it: All 208 checks are listed in the public control catalogue, with what each checks, how to fix it and the frameworks it maps to.
- Every permission and role requested is published, with the reason for each. Check it: Every permission and role requested is published, with the reason for each.
- A check that could not run is named as a coverage gap and left out of the score, never counted as a pass. Check it: A check that could not run is named as a coverage gap and left out of the score, never counted as a pass.
- Readiness for 20 frameworks comes from the same assessment, control by control. Check it: Readiness for 20 frameworks comes from the same assessment, control by control.
What it can’t see
Said plainly, so you know what you are buying.
- It reads Microsoft 365 settings and activity, not mail or file content.
- Areas a tenant is not licensed for (such as Intune or Entra ID P2) are reported as not collected.
- The 32 Exchange Online checks need the automation app and the Exchange Administrator role; until the tenant gives it, they show as not assessed.
It reads settings and activity records, never content, with permissions your tenant’s admin grants. Every permission and role, and why
Questions.
Which permissions does it need?
Read permissions, granted by the tenant’s admin, and optionally the read-only Teams Reader role. Write permissions sit in a separate app the tenant adds for fixes. Microsoft only lets an app read Exchange Online settings with an Exchange admin role, so the 32 Exchange checks run through that app too, once the tenant gives it the role. The full list, and why each is needed, is on the data protection page.
How often does it run?
On demand, or on a schedule at any cadence, on every plan. Very large tenants take longer, because Microsoft Graph limits how quickly data can be read.
Does it use AI to decide what is wrong?
No. Every check is a rule written by people, and the same settings always get the same result.
Plans: Assessments and reports on every plan; approved fixes with Automate.
What each plan includesConfigCheckup
See it on your own tenants.
The findings and figures come from your tenant, not from averages.
14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits.