An assessment that starts with the firewall is looking in the wrong place. In cloud environments the perimeter is identity, and the findings that carry real risk are almost always in the account list: who holds administrator rights, who kept access after changing roles, and which accounts nobody can name an owner for.
Count your Global Administrators, check whether legacy authentication is blocked, and review who is excluded from your conditional access policies. If those three answers surprise you, an assessment will find more.
The traditional model assumed a boundary. Inside was trusted, outside was not, and the firewall decided which was which.
A Microsoft 365 tenant has no such boundary. Staff sign in from home, from a client site, from a phone on mobile data. The thing deciding whether a request is legitimate is not its network location but the credential presenting it.
Which means the controls that matter are the ones governing accounts: what they can do, how they prove who they are, and whether anyone reviews them.
How many Global Administrators exist, and can each be named and justified? Two to four is the range most organisations should sit in. We regularly find double figures, often including a former consultant and a service account created during a migration years ago.
Which policies exist, which are actually enabled, and which have been sitting in report-only since a pilot that ended months ago. A tenant can display a respectable list of policies and enforce none of them.
Whether protocols that cannot present a multifactor challenge are blocked tenant-wide. This is the single highest-value identity control available, it is free, and it is frequently still open.
A policy requiring multifactor authentication only protects users who have registered a method. Unregistered users get excluded to unblock them, and the exclusion outlives the reason.
Which applications hold tenant-wide Microsoft Graph permissions. An application with directory write access or mailbox read access holds it permanently, without multifactor authentication, and appears in no user access review. Compromised application credentials are among the hardest intrusions to detect.
What guests can read in your directory, who can invite them, and which service accounts exist with no named owner and no expiry.
Accounts enabled but unused for months. Departed staff and old contractors are a recurring finding, and they are the accounts nobody is watching.
A scanner produces a list ranked by severity score. That score is calculated without knowing anything about your environment.
A finding scored medium may be the first link in a chain leading straight to your tenant administrator. A finding scored high may be irrelevant because the affected service is not reachable and holds nothing.
What makes an assessment useful is the judgement applied afterwards: which of these findings could an attacker realistically use, in what order, and what would they reach? That is the difference between a report you act on and a report you file.
The third point is worth insisting on. If a permission was missing and a check could not run, that must appear as "not assessed" rather than quietly as a pass. A gap reported as clean is worse than no report.
A posture assessment reads configuration and reports what is exposed. A penetration test attempts to exploit it and reports what an attacker achieved.
For most organisations that have never assessed their environment, configuration review finds more real risk, costs considerably less, and produces fixes you can make the same week. Testing is worth commissioning afterwards, once the obvious is closed.
No. It reads configuration through the Microsoft Graph API using read-only permissions. Nothing is changed and no system is taken offline.
Read-only application permissions, granted by an administrator through Microsoft's own consent screen. No password is shared and consent can be withdrawn at any time from your Enterprise applications blade.
Collection takes minutes. The valuable part is the analysis and the conversation about which findings matter in your context, which is usually a week end to end.
Annually as a baseline, and after any significant change: a migration, a merger, a new line-of-business application, or a change of IT provider. Tenants drift, and exclusions accumulate.
It produces evidence of the technical security measures the National Privacy Commission expects to see, particularly around access control. Documented findings with remediation records demonstrate that you assessed your risks and acted; an untested policy document does not.
Onprem2Cloud IT Solutions Co. is a Microsoft Cloud Solution Provider based in Muntinlupa City, serving businesses and government agencies across Metro Manila and beyond. Our cloud security posture assessments cover Microsoft 365 and Azure environments, mapped to the CIS Microsoft 365 Foundations Benchmark and ranked by exploitability.
See our cybersecurity services, or get in touch to discuss an assessment of your tenant.
Our latest news and trending topics