Skip to main content

Microsoft 365 Security Assessment

How your Microsoft 365 is configured, and how far an attacker gets starting from one ordinary staff account.

Book a Scoping Call

We check how Entra ID, email, file sharing and device policies are configured, then test what an attacker could actually reach starting from one ordinary staff account. You get a prioritised fix list your IT team or provider can act on, and a summary your customers, insurer or auditor will accept.

Who it is for

  • Organisations asked about Microsoft 365 security in a customer questionnaire, due diligence or insurance application.
  • Businesses that want to know whether their Microsoft 365 is set up securely, not just switched on.
  • IT managers and managed service providers who want an independent check of a tenant they run.

Scope bands

Fixed scope, fixed fee. Answer four questions, receive a fixed-fee quote, and nothing changes once work starts. Larger or more complex requirements are scoped as a Bespoke engagement, still at a fixed fee agreed before work begins.

Staff accounts

Focused
Up to 50
Core
Up to 150
Extended
Up to 300

Microsoft 365 plan

Focused
Business Basic or Standard
Core
Business Premium or E3
Extended
E5 or security add-ons

Synced from on-prem AD

Focused
No
Core
Yes
Extended
Yes

Email domains

Focused
Up to 2
Core
Up to 5
Extended
Up to 10

Your highest answer sets the band. One answer in Extended places the engagement in Extended, whatever the other three are.

Bespoke

More than one tenant, a merger in progress, Power Platform or government cloud.

Included with every Enhanced package

  • Full technical report: every finding with severity, business impact, evidence and remediation guidance.
  • Letter of attestation: a forwardable summary for the customer, insurer, investor or auditor who asked for the test.
  • 60-minute debrief for technical and business stakeholders.
  • One retest within 30 days, with a retest report.
  • Immediate escalation of any critical issue found during testing, not held until the report.
  • Independent quality review of every report by a second senior practitioner before issue.

Also included with this package

  • Attack path walkthroughs from a staff account to sensitive data or admin control, where one exists.
  • Prioritised remediation plan separating quick wins from planned changes.
  • Baseline results against CISA and CIS configuration benchmarks.

How it works

  1. 01Answer the four scoping questions.
  2. 02Receive a fixed-fee quote.
  3. 03Sign authorisation and set up access (some packages include an access guide).
  4. 04We test, issue the report within five business days, run the debrief and complete the retest.

Good to know

Testing is read-only by default. We assess and demonstrate, and never change your configuration. Every finding is manually verified.

Azure and AWS are covered by the Cloud Infrastructure Assessment. View that service

Exploitability, not a scanner dump

  • Every finding is reproduced by hand before it reaches the report. Anything a tester cannot reproduce is discarded rather than passed on with a caveat.
  • Findings are rated by what an attacker could actually do with them in your environment, not by the raw score a tool assigned.
  • Where a route exists from a starting foothold to something that matters, we show the route rather than listing the steps as separate findings.
  • Every report is independently quality reviewed by a second senior practitioner before it is issued.

Who tests

Testing is led by a UK Cyber Security Council Principal practitioner (Security Testing) holding CREST CRT, OSCP, OSEP and CyberScheme Team Leader. Every report is independently quality reviewed by a second senior practitioner before issue. Our founders bring over ten years each in UK defence and critical national infrastructure. Tarian Labs is Cyber Essentials certified and based in South Wales.

Fixed scope, fixed fee, agreed before work starts.

A short call with a practitioner is enough to size this accurately.

Book a Scoping Call