Free tool · Works with Microsoft 365

Tenant Security Scorecard

Find the Microsoft 365 settings that put your tenant at risk, ranked by what to fix first. Connect read-only for a verified result, or answer the questions yourself. Every check links to the public page it comes from.

48 checks in six areas.
CommittedReads up to 12 settings from Microsoft Graph and 3 from public DNS, and writes nothing. What is read.
CommittedAnswers stay in this browser. A tenant scan is held encrypted on this site's server for up to 10 minutes, and nothing else is kept unless you tick Remember this result or leave your email with it. Terms, section 14.

Connect read-only Answer the questions

Before you start

You give: 48 questions in six areas, or one read-only connection to your Microsoft 365 tenant.
It reads: Your answers. Connected, up to 12 settings through Microsoft Graph and 3 records from public DNS; it changes nothing. The exact permissions.
It keeps: Answers stay in this browser. A tenant scan is held encrypted for up to 10 minutes. Scores are kept for 180 days only if you tick Remember this result.
Who sees the result: Only you, unless you leave your email.
Why it is free: Free because these checks show how I work. If a result needs fixing, I scope that as a fixed-scope job.

What you get back

Sample, not from a real tenant

The report this tool builds when every control is in place except three common gaps. The score, the band and the fixes are the tool's own output for those answers.

Score 89%, Exposed. Fix first:

1.ID-002Not in placecritical
Is MFA enforced for all end-user accounts (not just admins)?
A password alone is the only barrier on every ordinary account, and one phished staff password is enough to start an attack.
Fix: Create a require-MFA policy for all users and all resources, exclude only your emergency access accounts, and roll it out from report-only mode.
How to check: Entra admin center > Conditional Access > Policies: a policy that is On, targets All users and All resources, and requires MFA or the Multifactor authentication strength.
Microsoft Learn: Require MFA for all users with Conditional Access
2.ID-003Partlycritical
Is Basic and other legacy authentication blocked tenant-wide?
Legacy protocols cannot ask for MFA, and Microsoft reports that more than 99 percent of password spray attacks use them.
Fix: Block legacy authentication with a Conditional Access policy (or Security defaults if you have no Conditional Access), then disable unused POP and IMAP per mailbox as a separate hygiene step.
How to check: Entra admin center > Conditional Access > Policies: a policy that is On, targets All users and All resources, client apps Exchange ActiveSync clients and Other clients, grant Block access. Without Conditional Access: Security defaults block legacy authentication.
Microsoft Learn: Block legacy authentication with Conditional Access
3.EM-001Not in placehigh
Is DMARC enforcing (p=quarantine or p=reject) on your primary domain, with reporting (rua) switched on?
With p=none, DMARC only observes: forged mail that claims to come from your domain is still delivered.
Fix: Move DMARC to p=quarantine, then p=reject once the rua reports show your legitimate mail passing, and keep a rua address so you see failures.
How to check: Resolve-DnsName -Type TXT _dmarc.yourdomain.com: the record needs p=quarantine or p=reject and a rua=mailto: address.
Microsoft Learn: Set up DMARC to validate email in Microsoft 365

Verified scan

Connect read-only and the scan reads Conditional Access, Security Defaults, who holds Global Administrator, PIM eligibility, the user consent setting, licences and SharePoint sharing. The connect control loads with the page script.

Identity & Access

Do all administrator accounts have to complete MFA to sign in?
Is MFA enforced for all end-user accounts (not just admins)?
Is Basic and other legacy authentication blocked tenant-wide?
Have privileged roles been reviewed and minimised in the last 90 days?
Are Global Admin accounts cloud-only (not synced from on-prem Active Directory)?
Does your tenant have fewer than 5 permanent Global Administrators?
Is guest (external) user access reviewed and time-bound?
Do privileged roles have to sign in with phishing-resistant MFA?
Do guests and external users have to complete MFA?
Is device code flow blocked, or limited to named scenarios?
Do administrators and guests have an MFA method other than SMS or voice?

Email Security

Is DMARC enforcing (p=quarantine or p=reject) on your primary domain, with reporting (rua) switched on?
Is DKIM signing on for every domain that sends mail?
Is SPF a single record that ends in -all or ~all and stays within 10 DNS lookups?
Are the Standard or Strict preset security policies (or custom equivalents) applied to all users?
Are Safe Links, Safe Attachments and Safe Attachments for SharePoint, OneDrive and Teams on for every user?
Do external emails display a warning indicator to recipients?
Is SMTP AUTH switched off organisation-wide, with named exceptions only?
Is automatic external forwarding set to Off in every outbound spam policy?

Endpoint & Device

Are end-user devices enrolled in Microsoft Intune for device management?
Is Microsoft Defender for Endpoint deployed on all managed devices?
Are Windows Update policies enforced via Intune (not left to users)?
Is BitLocker / device encryption enforced by Intune policy?
Does Conditional Access require a compliant or hybrid-joined device for Microsoft 365 (at least for administrators)?
Is mobile device management enforced for all mobile access to email or Teams?
Is Windows LAPS managing the local administrator password on every managed Windows device?
Does every managed platform have a compliance policy, with devices that have no policy marked as not compliant?

Data Protection

Are Microsoft Purview sensitivity labels configured and published to users?
Is a Data Loss Prevention policy active for outbound email?
Is DLP active for SharePoint and OneDrive (not just email)?
Are retention policies configured for Teams and SharePoint content?
Is external sharing in SharePoint/OneDrive restricted (not "Anyone with a link")?
Has a data classification policy been formally communicated to staff?
Before or during a Microsoft 365 Copilot rollout, have you reviewed oversharing in SharePoint and OneDrive?

Admin & Audit

Is unified audit logging enabled in Microsoft Purview?
Is mailbox audit logging enabled for all user accounts?
Is there a documented process for reviewing audit logs at least monthly?
Are admin accounts cloud-only, non-federated and separate from daily-use accounts?
Is Privileged Identity Management used for just-in-time role elevation?
Is user app consent disabled or limited to verified publishers and low-risk permissions?
Are there at least two cloud-only emergency accounts that use a passkey (FIDO2) or certificate sign-in, hold permanent Global Administrator, are excluded from blocking Conditional Access policies, alert on use and are tested every 90 days?
Is Secure Score tracked, with a named owner for open high-impact actions?
Have you reviewed Baseline security mode in the Microsoft 365 admin center and turned on every setting that shows no impact?

Backup & Resilience

Do Microsoft 365 mailboxes have a protected copy beyond operational retention?
Do SharePoint and OneDrive have a protected copy with a defined failure boundary and retention period?
Has a backup restoration test been completed in the last 6 months?
Is there a documented incident-response runbook for a Microsoft 365 security event?
Are Entra ID tenant settings and configuration externally backed up?

Method and limitsShow

Baseline: ITSailor Tenant Security Baseline, version 2026.10, reviewed 18 October 2026. 48 controls, each linked to the Microsoft, NIST or ENISA page it comes from.

This is a posture review against the ITSailor Tenant Security Baseline. It is not an audit, a certification or legal advice.

A verified result reads Microsoft Graph with read-only permissions and public DNS. Everything else is the answer the person filling it in gave.

Not sure, Not applicable and Not licensed controls are left out of the score. A band appears once 80% of the Essential weight is assessed and is marked Provisional until all of it is.

The verified scan reads the tenant name, licence subscriptions, Conditional Access policies, Security Defaults, the user consent setting, Microsoft Secure Score, who holds Global Administrator (including through a group), PIM eligibility and SharePoint sharing. It reads no mail, files or sign-in logs.

This is a directional mapping and not a compliance audit: DORA applies to financial entities listed in its Article 2, and NIS2 to entities in the sectors of its Annexes I and II that are medium-sized or larger under its Article 2, plus the cases it names regardless of size, so a reference here does not mean either framework applies to you.

The NIS2 references point to Article 21(2) of Directive (EU) 2022/2555. A directive binds an organisation only through its own country's law; in Malta that is S.L. 460.41 (Legal Notice 71 of 2025, as amended), whose article 19 carries the same list. A reference here is context for your reviewer, not a compliance check.

Gaps to fix? I scope tenant hardening as a fixed engagement (passkeys are part of it), or we go through the result together in the architecture workshop.

Scope tenant hardening Book the architecture workshop