The assessment covers your Entra ID configuration including conditional access policies, authentication methods, guest access, and privileged identity management. Exchange Online is reviewed for anti-phishing, anti-spoofing, and mail flow security. SharePoint and OneDrive sharing configurations are assessed for excessive external exposure. Teams security settings, Intune device compliance and configuration policies, and Microsoft Secure Score gaps are all included within scope.

We look at how your environment is configured in practice, not just against a checklist. Misconfigurations that enable lateral movement, privilege escalation, or data access are assessed in the context of how an attacker would use them.