We review the security settings of your Microsoft 365 tenant: Secure Score, MFA coverage, legacy authentication, risky sign-ins, mailbox forwarding rules, admin roles and external sharing. It needs temporary read-only consent from your administrator, which we remove when we finish. You get reviewed findings in plain terms, not a raw export.
Tell us your company domain and roughly how many users you have. We'll reply to arrange the read-only access.
We won't sell your data or send you marketing you didn't ask for.
Most requests come with a deadline: a cyber insurance renewal asking about MFA, a client security questionnaire, or a manager who has inherited a tenant nobody has looked at in years. The check gives you a straight answer about where Microsoft 365 stands today.
It suits organizations already on Microsoft 365 that want an outside look before someone else asks. If you need evidence for an auditor, or your real concern is laptops, servers or the wider network, ask for more than the free check. We will tell you plainly if it is the wrong tool.
Microsoft ships a tenant open enough to work on day one, not locked down enough to resist a credential attack. Most of what we find is not exotic: settings that were never changed from their defaults, and accounts that collected permissions over time.
Related: Microsoft 365 optimization, free email security check, cyber insurance IT requirements and free external vulnerability scan.
Microsoft 365 OptimizationA free check is a narrow instrument. Knowing where it stops is the only honest way to judge what the results mean.
Nothing in the results is a certificate you can hand to an auditor or insurer. If you want changes made or evidence produced, that is paid work, scoped and agreed with you before anything starts.
We read your tenant's configuration with read-only access and compare it against the settings that matter most when a mailbox is attacked.
Your current score and the recommendations behind it, sorted into the ones that reduce real risk and the ones that mostly move the number.
Which accounts can sign in without a second factor, including administrators, shared mailboxes and service accounts that are easy to miss.
Whether older sign-in protocols that skip MFA are still allowed. Leaving them open is one of the most common routes into a mailbox.
Sign-ins Microsoft has flagged as unusual, where your licence reports them, and whether anyone has looked at them.
Rules that forward or redirect mail outside the organization. Attackers use them to keep reading a mailbox after the password has been changed.
Who holds Global Administrator and other privileged roles, and whether admin work is done from separate accounts rather than everyday mailboxes.
How SharePoint, OneDrive and Teams share with people outside the company, and whether anyone-links are switched on.
The read-only consent we use, what it can and cannot see, and confirmation in writing that it has been removed when the check is finished.
There is nothing to install and we never ask for a password. The only access is the read-only consent your administrator approves.
Company domain, approximate number of users and a contact. We reply to confirm the scope and who will approve access.
Your Microsoft 365 administrator approves temporary read-only access. It can read configuration. It cannot change settings.
A person at NetFusion Designs reads the results before you do. Findings come back in a few business days, ranked by risk.
We remove our access and show you where to confirm it is gone. A call to go through the findings is offered, never required.
A check that finds nothing serious is a legitimate result. If your tenant is in good shape, we will tell you so.
The items worth acting on sit at the top, not buried among low-risk observations.
What is exposed, why it matters and the specific change that would close it, in terms you can take to an owner.
Where you are now, which recommendations would actually reduce risk, and which ones mostly move the number.
Whether each fix is a setting your own team can change today or something that needs planning first.
Where a finding affects how you can honestly answer an MFA or email security question on an insurance renewal or client questionnaire.
Written confirmation that our read-only access has been revoked, and where your administrator can check it.
We are not going to manufacture a crisis to start a sales conversation. If your own team or current provider can close the gaps, that is a good outcome, and we will say so.
Most of the settings we review, such as sign-in policy, admin roles and forwarding rules, are only visible to an administrator. We ask your administrator to approve temporary read-only access. It can read configuration, it cannot change anything, and we remove it when the check is finished.
No. The check looks at how the tenant is configured, not at the contents of mailboxes, chats or documents. If a finding needs a closer look at a specific mailbox, we will ask you first and explain why.
We remove it when the review is done, confirm that to you in writing, and show you where in Microsoft 365 your administrator can see that it is gone.
Findings usually come back within a few business days of the access being approved. If you have a renewal or questionnaire deadline, tell us the date when you ask.
No. The free check is read-only. If you want changes made afterwards, that is separate work, scoped and agreed with you before anything starts.
Yes. There is no charge for the check or for the conversation about the findings, and no card details are collected. It gives us a genuine reason to introduce ourselves, and gives you something useful whether or not you become a client.
We tell you promptly rather than saving it for a scheduled call, and explain what we would do about it. Our helpdesk and Security Operations Centre are staffed 24/7, so there is always someone to talk to.
Send your company domain and roughly how many users you have, and we will take it from there. NetFusion Designs is SOC 2 Type 2 audited, with offices in Markham, Toronto, Kitchener, Mississauga, Pickering and Montreal.
%20(1).avif){kind=logo}
%201.avif)
