Is your Microsoft 365 as locked down as you think?
We scan your Microsoft 365 tenant and Entra ID for vulnerabilities and misconfigurations, every day. One consent from your admin, and the gaps attackers look for land on your list.
Among what we catch
- MFA not required for everyone
- Admins with no MFA registered
- Legacy authentication that bypasses MFA
- Too many Global Administrators
- Admin accounts synced from on-premises AD
- Guests holding directory roles
- Apps with more access than they need
- Inbox rules forwarding mail outside the company
Most attacks are guessesMFA is the lock
Most attacks on email accounts are simple password guessing, and MFA stops over 99 % of them (Microsoft Digital Defense Report 2025). The question is whether it is really on for every account. That is the question we answer.
- > 99 %of unauthorized access attempts are blocked by MFA.Microsoft Digital Defense Report 2025
- > 97 %of identity attacks are password spray or brute force.Microsoft Digital Defense Report 2025
37 checksin plain words
These aren't guesses. We read the setting in your Microsoft 365 tenant and Entra ID. A check we cannot read shows as not measured, with the reason, and never counts as a pass.
11 can raise a findingposture, shown in the overview
Sign-in and MFA
- MFA is required for every user (can raise a finding)
- MFA is required for admins
- Every admin has MFA registered (can raise a finding)
- Every user has MFA registered
- Admins aren't limited to text or voice codes
- Admins use phishing-resistant MFA
- Legacy authentication is blocked (can raise a finding)
- Device code sign-in is blocked
- Conditional Access acts on sign-in risk
- No user is at high risk (can raise a finding)
- Registering security info is protected
- Phone-based sign-in methods are off
Admins and guests
- Not too many Global Administrators (can raise a finding)
- An emergency access account exists (can raise a finding)
- Admin accounts are cloud-only, not synced from on-premises AD (can raise a finding)
- Admin rights are activated when needed, not standing
- Global Administrator activation needs approval
- No guest holds a directory role (can raise a finding)
- Guests can't browse your directory
- Not everyone can invite guests
- No guest accounts left unused
- No dormant licensed accounts
- Password complexity is required
- Passwords don't expire on a timer
- Not everyone can create Microsoft 365 groups
Apps
- No app has more access than it should (can raise a finding)
- No risky app approved by an ordinary user (can raise a finding)
- Users can't hand apps access on their own
- Users can ask an admin to approve an app
- Organisation-wide app consents are reviewed
- Not everyone can register apps
- App secrets are short-lived and current
- No secrets added to other publishers' apps
Mail and files
- No inbox rule forwards mail outside the company (can raise a finding)needs the optional mail permission
- Microsoft's mail protection recommendations are met
- SharePoint and OneDrive sharing is limited
- Legacy authentication to SharePoint is off
Some checks need Microsoft Entra ID P1 or P2. We tell you which.
One consentChecked every day
Approve in Microsoft's own screen
Your admin signs in with Microsoft and approves once. It takes a Global Administrator or Privileged Role Administrator. No agent, no script, nothing to install.
Synced every 24 hours
Changed something? Start a sync yourself.
Forwarding, when you want it
The inbox-rule check switches on with a permission of its own, when you choose.
Names where they help
An account name appears in the finding that needs it, so you know who has to fix it.
Alerts when the connection breaks
If access is withdrawn, syncs keep failing or the licence stops, your admins get an e-mail at once, and another when it works again.
Disconnect in one click
And if your licence lapses, we disconnect ourselves after 30 days, with a week's warning.
Your mail, from both sidesOutside and in
From outside, nothing to connect
SPF, DKIM, DMARC and MTA-STS on your domains, the records that stop others sending mail as you. And whether your domain gives away your Microsoft 365 tenant and its sign-in.
From inside, once connected
Inbox rules forwarding mail outside the company, and Microsoft's own mail protection recommendations for Exchange Online and Defender.
Same list, same reportssame evidence
Microsoft 365 findings sit next to your outside and inside findings: in the same risk list, the same notification rules, the same reports and the same NIS2 and ISO 27001 evidence. Each check shows what it maps to in NIS2, ISO 27001 and NIST SP 800-53. You also see which on-premises Active Directory domains your users sync from.
The service every customerunderstands at once
Connect each customer's Microsoft 365 with an admin consent link. The customer approves in Microsoft's own consent screen, and the checks run from the next sync.
Become a partnerMicrosoft 365 questions
Do we need a premium licence?
No. Most checks work on any business plan. Conditional Access, the MFA registration report and sign-in activity need Microsoft Entra ID P1, and the risk checks need P2. Without the licence those checks show as not measured, and we tell you why.
What can PollySec see?
The settings behind the 37 checks: sign-in and MFA, admin roles, guest settings, app permissions and file sharing, plus inbox rules if you give the optional mail permission. Every permission we ask for is a read permission. Your email and your sign-in logs are not part of it.
How do we get started?
Your admin signs in with Microsoft and approves PollySec in Microsoft's own consent screen. It takes a Global Administrator or Privileged Role Administrator. The first sync can start straight away, and from then on we check every day. Disconnect whenever you like.
Where is the data stored?
The results are stored with the rest of your PollySec data, on the platform hosted in Sweden. The checks sync every 24 hours, and you can start a sync yourself.
What does “not measured” mean?
That we could not read the setting, for example because the licence it needs is missing or a permission was not given. The reason is shown, and a check that is not measured never counts as a pass. When a check needs a new permission, reconnecting is all it takes.
See how locked down it really is
We'll connect a Microsoft 365 tenant with you in a demo and walk through what the checks find.
Check your Microsoft 365