# M365 Security Assessment > Find out how securely Microsoft 365 is configured across identity, email, devices and data, and get a prioritised plan to close the gaps. Page: https://itechnologyaustralia.com.au/assessments/m365-security-assessment Microsoft 365 holds most of your email, files and conversations, yet its default settings rarely match the protection a business needs. We review your tenant against Microsoft's security recommendations and your own risk, then show you what to fix first. ## What it looks at - **Identity & access**: Microsoft Entra ID multi-factor authentication, Conditional Access, administrator roles, legacy sign-in methods and how guest users are handled. - **Email & collaboration**: Anti-phishing and anti-malware policies, mail flow rules, and how files are shared externally across Teams, SharePoint and OneDrive. - **Devices & apps**: Microsoft Intune device compliance, Microsoft Defender endpoint protection and app policies, so company data stays protected on laptops and phones. - **Data protection & licensing**: Sensitivity labels, data loss prevention and retention, plus whether your licences match what your team actually uses. ## What we commonly find - **Multi-factor authentication isn't enforced for everyone**: A password alone is the easiest way into an account. The gaps usually sit with administrators, shared mailboxes and older sign-in methods that skip MFA entirely. - **Too many people have administrator rights**: When everyday accounts hold admin roles, one successful phishing email can hand an attacker control of your whole Microsoft 365 tenant. - **Email protection is still on default settings**: Without tuned anti-phishing policies, protection from lookalike domains and a check on automatic forwarding rules, fraudulent emails and quiet data leaks slip through. - **Files and devices are loosely controlled**: Open sharing links and unrestricted guests can expose client files, and unmanaged personal devices leave company data with no way to be wiped if they are lost. ## What you get - Microsoft Secure Score review with findings ranked by risk - A plain-English report your leadership team can act on - Prioritised remediation plan with effort estimates - Licensing review showing unused or missing licences - A walkthrough session with our engineers to answer questions ## Ideal if - Businesses on Microsoft 365 that haven't reviewed their settings since setup - Organisations answering cyber insurance or customer security questionnaires - Teams that have had a phishing attempt or a compromised account - Companies preparing to roll out Microsoft Copilot safely ## Frequently asked questions ### What is a Microsoft 365 security assessment? It is a structured review of how your Microsoft 365 tenant is configured, covering sign-in security, email protection, file sharing, devices and data protection. You receive a report that ranks what we find by risk and a plan for fixing it. ### Do you need administrator access to our Microsoft 365 tenant? We ask for read-only access so we can review your configuration. We don't change any of your settings during the assessment, and we agree access with you before we begin. ### Do we need Microsoft 365 E5 licences to benefit? No. We work with the licences you already have, show you what is achievable with them, and are clear about where an upgrade would genuinely help and where it would not. ### How long does the assessment take? It depends on the size and complexity of your tenant. We confirm the timeline when we scope the work, so you know what to expect before we start. --- iTechnology Australia: call 1300 803 757, email info@itechnologyaustralia.com.au, or send an enquiry or book a discovery call at https://itechnologyaustralia.com.au/contact-us. All pages for agents: https://itechnologyaustralia.com.au/llms.txt (index) and https://itechnologyaustralia.com.au/llms-full.txt (full text).