Report · 37 pages in the sample
Security and compliance assessment report
Every finding by severity with evidence, verification results after fixes, and remediation guidance.
View the redacted sample (PDF, 37 pages) →Fixed-price security audit · 3 days · $525
How safely is your Microsoft 365 set up?
We review your tenant’s security settings, policies, users and applications, and tell you what to fix first. Read-only, three business days, one fixed price.
Why people usually ask
- A cyber-insurance questionnaire asks whether MFA and conditional access are enforced.
- A phishing scare or a compromised mailbox.
- A customer or auditor wants proof the tenant is configured securely.
- You inherited a tenant nobody has reviewed.
Fixed price, quoted in writing before work begins. You pay only after the audit is complete and you are happy with the reports we delivered; if you are not, you do not pay.
Microsoft partner since 2006Founder-led
Solutions Partner for Security100/100 capability score
1,100+ organizationsUnder management
Pay after the reportsOnly if you are happy
What is reviewed
What a baseline audit looks at
Your tenant’s security settings, configurations, policies, users and the applications in use, checked against external threats.
Identity and MFA
Who can sign in, and how strongly.
Conditional access
The rules that allow or block a sign-in.
Admin roles
Who holds admin rights, and whether they need them.
Mailbox and Exchange
Protections against phishing, spoofing and forwarding.
Sharing and external access
What leaves the company, and to whom.
Applications and consents
Apps that were granted access to your data.
Device and data policies
Rules for laptops, phones and sensitive files.
Logging and alerting
Whether you would know if something went wrong.
Deliverables
Four documents you keep
Shown here as outlines of our redacted samples. Every finding is ranked by severity, with evidence and guidance on fixing it.
Brief · 2 pages
Executive brief for leadership
Posture in one number, the risks that matter, and what to do.
View the redacted sample (PDF, 2 pages) →Presentation · 18 slides
Findings readout presentation
Used in the review meeting where we walk through each item with you.
View the redacted sample (PowerPoint, 18 slides) →Spreadsheet · 7 tabs · 34 findings in the sample
Findings and remediation tracker
One row per finding, so your team or ours can work through the list.
View the redacted sample (Excel, 7 tabs) →For leadership
What the executive brief tells leadership
- Posture in one numberWhere the tenant stands today, in a single score.
- The risks that matterThe findings that carry real exposure, in plain language.
- What to doThe order to fix things in, so decisions can be made quickly.
How it works
Three business days, read-only
Dan Appleby manages the engagement from kickoff to the final review.
- 01
Kickoff meeting
We confirm access, your point of contact and anything you want us to look at closely.
- 02
Tenant security assessment
We review settings, configurations, policies, users and applications.
- 03
Analysis and prioritization
Each vulnerability is ranked, so you know what to fix first.
- 04
Remediation plan review
We walk through the plan with you and advise on addressing each item.
Read-only. No changes are made to your tenant during the audit, so there is no downtime for users.
You provide access to the Microsoft 365 tenant and one point of contact.
Boundaries
What the audit does not cover
So you know exactly what $525 buys.
What is not included
- Hands-on remediation, which is scoped separately after the audit
- Penetration testing or phishing simulations
- Continuous monitoring or incident-response retainers
- On-premises or network audits outside the Microsoft 365 tenant
- Compliance certification or legal attestation
- Microsoft licensing or third-party tools
One more boundary. The audit does not guarantee your tenant is “fully secure.” It identifies and prioritizes what to fix.
What happens after
Option A
We scope the fixes
Hands-on remediation is quoted separately, at a fixed price, once you have seen the findings.
Option B
Your team works the tracker
The spreadsheet lists every finding with guidance, so your own IT staff can work through it.
Choosing an audit
Baseline or Advanced (SCuBA)?
Baseline is the right first step for most organizations.
AuditPriceDurationWho it is for
Security Audit, BaselineThis page
Price$525
Duration3 days
Most organizations. A clear, prioritized view of what to fix first.
Advanced Security Audit (CISA SCuBA)
Price$1,950
Duration10 days
Regulated or government-adjacent tenants that need a framework-mapped compliance report.
People
Who you will work with
DAPortrait
Engagement manager
Dan Appleby
Runs your audit from kickoff to the remediation plan review, and is your contact throughout.
MMPortrait
Founder
Mike Mackey
Takes the first call. Ask him whether this audit is the right fit before you commit.
Book a free 30-minute callClients
Hear it from a client
Video description
A client describes working with IT Partner on the Microsoft 365 Security Audit (69 seconds).
…the ability to deliver services at a reasonable price point for a nonprofit. And if it’s comfortable for a nonprofit, I think it’d be comfortable for anyone.
Unless you try them, you won’t know them. But if you try them, you would be impressed.
What is included?
A review of your tenant’s security settings, configurations, policies, users and the applications in use. We identify vulnerabilities, rank them, and walk you through a remediation plan.
What do we receive?
Four documents: the security and compliance assessment report, a two-page executive brief, the findings readout presentation, and the findings and remediation tracker spreadsheet.
How long does it take?
Three business days, from the kickoff meeting to the remediation plan review.
What does it cost?
$525 per project, fixed. Fixed price, quoted in writing before work begins. You pay only after the audit is complete and you are happy with the reports we delivered; if you are not, you do not pay.
What access do you need?
Access to your Microsoft 365 tenant, and one point of contact on your side.
Will it cause downtime?
No. The audit is read-only and no changes are made to your tenant, so users are not affected.
Does it include fixing what you find?
No. Hands-on remediation is scoped separately after the audit, or your own team can work through the tracker.
How is it different from the SCuBA audit?
The Advanced Security Audit uses the CISA SCuBA framework, takes 10 days and costs $1,950. It suits regulated or government-adjacent tenants that need a framework-mapped compliance report. For most organizations, Baseline is the right first step.
$525 · 3 business days · read-only
Request your Microsoft 365 audit
We reply with a written quote within one business day. You pay only after you are happy with the reports.