Almost every tenant I audit is secure in the places the last engineer looked and wide open in the places nobody thought to check. MFA is on for the office staff but not the service account. Defender is licensed but the anti-phishing policy is still at default. The backup exists but has never been restored.
A health check is not a scan. It is a structured pass over the whole tenant against a known baseline, producing a list of findings a business owner can act on and price. This is what I cover, in the order I cover it, and the free tooling that does most of the heavy lifting.
Three things have changed in the last twelve months that make an old tenant configuration a genuine liability rather than just untidy.
First, the government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026 by DSIT and the Home Office, found 43 per cent of UK businesses identified a breach or attack in the previous twelve months, around 612,000 organisations. Phishing was reported by 38 per cent of businesses and named the most disruptive attack type by 69 per cent of those affected. Among businesses that were breached, 51 per cent experienced phishing and nothing else, up from 45 per cent the year before. The threat is concentrated in one place, and that place is email and identity.
Second, Cyber Essentials tightened. Version 3.3 of the Requirements for IT Infrastructure and the new Danzell question set went live in late April 2026. Two automatic failure conditions now exist: no MFA on a cloud service that offers it, and high-risk security updates not applied within 14 days. Cloud services also got a formal definition and can no longer be excluded from scope. If Microsoft 365 is in your business, it is in your assessment.
Third, Microsoft removed the option to defer. Mandatory MFA for the Microsoft 365 admin centre took full effect on 9 February 2026, with sign-in blocked without it. The Azure portal has required MFA since March 2025.
This is where most real risk sits, so it goes first.
Only available with Entra ID P1, which comes with Business Premium. If the tenant has the licence and no policies, that is unused spend as well as unused protection.
Given phishing is the dominant attack route, default settings here are not good enough.
Not strictly security, but it belongs in the same report because it usually pays for the remediation.
| Tool | What it gives you | Cost |
|---|---|---|
| Microsoft Secure Score | Directional baseline and a prioritised improvement list inside the tenant | Free |
| ScubaGear (CISA) | Automated assessment against a published secure configuration baseline, with an HTML report | Free |
| Maester | Pester-based test framework for Entra ID and M365 config, good for repeat checks | Free |
| Microsoft Graph PowerShell SDK | Everything the portals will not export cleanly, especially dormant accounts and role assignments | Free |
| MXToolbox | External view of MX, SPF, DKIM, DMARC and blacklist status | Free tier |
| Have I Been Pwned | Domain search for staff addresses in known breaches | Free for domain owners |
Do not hand a client a raw ScubaGear output and call it a report. The tools find the facts. The value is in deciding which findings matter for that business and what the fix costs.
A traffic-light report per area works better than a score, because a business owner can look at a page of red, amber and green and immediately know where the conversation needs to go.
| Status | Meaning | Expected action |
|---|---|---|
| Red | Control missing or ineffective, with a realistic route to compromise | Fix within days |
| Amber | Control present but partial, misconfigured or unmonitored | Fix within the next month |
| Green | Control in place and verified working | Review at next audit |
For each red and amber finding, state three things: what is wrong, what an attacker could do with it, and what fixing it requires in terms of licence, effort and disruption. That last part is what turns a report into a decision.
Annually as a floor. Also run one after any of these:
Related reading: how to audit your Microsoft 365 tenant security, Cyber Essentials vs Cyber Essentials Plus, and auditing sign-in logs in Entra ID.
A structured audit of a tenant against a known baseline. It covers identity, admin roles, email protection, device management, data protection, sharing, logging, licence use and backup. The output is a list of findings ranked by risk, with the effort and licence requirement for each fix.
Annually as a baseline, and after any of these events: a change of IT provider, a staff departure with admin access, a Cyber Essentials renewal, a cyber insurance application, or a suspected account compromise.
No. Secure Score is a useful directional indicator and it is free, but it weights recommendations by Microsoft's model rather than your risk, and it ignores things it cannot see such as whether your break-glass account credentials are stored safely or whether your backup has ever been restored.
Microsoft Secure Score, ScubaGear from CISA, Maester, the Microsoft Graph PowerShell SDK, MXToolbox for mail flow and DNS records, and Have I Been Pwned for exposed credentials. All are free and between them cover most of a technical audit.
We run this audit as a fixed price piece of work and hand you a written plain English report.
See the Security Health CheckMore in this series: all Klariq guides.