Cloud, Kubernetes and Infrastructure Security
Microsoft 365 and SaaS Security
We review the security settings of Microsoft 365 and your other SaaS applications. We identify the riskiest sharing settings and app permissions for your email and documents.
What it is
In SaaS, the provider operates the software, while you control access and sharing settings. A compromised mailbox can remain undetected for a long time through forwarding rules and consented apps. The review compares your tenant settings with the CIS Microsoft 365 Foundations Benchmark. It also covers admin settings of your critical SaaS applications.
Scope
- External forwarding, mail rules, and SPF, DKIM, DMARC settings in Exchange Online
- External sharing and guest access in SharePoint, OneDrive, and Teams
- Third-party apps users have consented to and their permissions
- Admin roles and audit log retention
- Security settings of other critical SaaS applications such as Google Workspace or Salesforce
The need
When organizations need it
- After a business email compromise (BEC) attempt or a phishing incident.
- When document sharing with external parties increases and tracking who shares what is not possible.
- When tenants are merged or separated during a merger or divestiture.
Method
How we work
-
Read access
We export the tenant configuration using read-only roles such as Global Reader.
-
Settings review
We compare the settings with the CIS Microsoft 365 Foundations Benchmark and Microsoft recommendations.
-
App permissions
We map which mailboxes and files each consented app can access.
-
Order of changes
We plan setting changes to minimize user impact.
Outcome
What you have at the end
You know which email and sharing settings expose data to leaks. Changes are planned to minimize user impact.
Frequently asked questions
Our Microsoft Secure Score is high. Do we still need a review?
Secure Score compares your settings with a baseline set by Microsoft. It does not always highlight risks such as broad mailbox permissions granted to an app. The review also uses this score as input.
Should we turn off user consent to apps completely?
For most organizations, an admin consent workflow is a better solution. The user submits a request and an authorized admin reviews the permissions before deciding.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting