Microsoft 365 security review: find the gaps, fix the riskiest first
Start with a read-only review of identity, devices, email and sharing, then separate urgent exposure from clean-up work. £1,500 to £2,500; usually 5 working days. Remediation is scoped separately.
What the work covers
When to use this review
Use it when admin roles, MFA exceptions, external sharing, endpoint policy or alert ownership have accumulated without a current control map or evidence pack.
Scope, output and handover
Review users, groups, roles, MFA, Conditional Access, Intune, Defender, Exchange, SharePoint, break-glass access and audit visibility. Output: risk summary, evidence snapshot and ordered remediation backlog.
What the review hands your IT owner
- Admin accountsFive global admins, two without MFAFix this week
- Email forwardingAuto-forwarding to personal mailboxes allowedFix this week
- File sharing"Anyone" links on three SharePoint sitesOwner decides
- LaptopsFour devices not managed in IntunePlan with your IT
- Emergency accessBreak-glass account documented and excludedNo action
Where the basics stop
Most UK businesses have malware protection, backups and firewalls. Identity controls such as two-factor authentication lag well behind.
- Updated malware protection81%
- Cloud backups74%
- Password policies74%
- Network firewalls74%
- Restricted admin rights73%
- Two-factor authentication47%
- VPN for remote staff36%
- User monitoring30%
Ready before something happens
Only a quarter of businesses have a formal incident response plan. A clean-up leaves owners and a written route for the next incident.
- Named roles for incidents39%
- Guidance on who to notify34%
- Guidance on reporting externally32%
- Formal incident response plan25%
The handover
The work ends with written outputs you keep.
- Risk-ranked findings across identity, devices, email and sharing.
- Evidence snapshot for each material finding.
- Named owners and an ordered remediation backlog.
- Access and change assumptions recorded before remediation.
- Readout and handover notes for internal IT or the existing MSP.
Not ready to book?
Try the free Microsoft 365 self-check first. It starts with 12 questions.
Questions teams ask before the work
Is this a managed IT service?
No. Focused review, remediation and handover — not helpdesk or a retainer.
What does the initial review cost and take?
The independent Microsoft 365 Security Review is £1,500 to £2,500 and usually takes five working days. Access is scoped and time-bound; remediation is agreed separately.
Related work
