What's New in Posturis: Email Security and a Monthly Review

Posturis now checks the email security settings in your Microsoft 365 tenant, marks controls you are not licensed for as Not applicable instead of failing them, and adds a monthly review by an Onprem2Cloud analyst. It still changes nothing in your tenant.

Posturis is the Microsoft 365 security posture assessment we built ourselves. It reads how a tenant is configured, evaluates it against 46 controls and delivers an evidence report into the customer's own SharePoint. This update widens what it looks at, makes its scores fairer to smaller tenants, and puts a person in the loop every month.

The short answer

Three things are new. Email security is now covered, from Safe Links and Safe Attachments to mailbox auditing. A control that needs a licence you do not hold is reported as Not applicable, with a note on what that licence would add. And an optional monthly service turns a one-off report into a routine: an analyst reviews your controls by hand and sends a Monthly Service Summary, with an automatic re-assessment each month if you want it. The checks on Conditional Access, Intune devices and Identity Protection have also gone deeper.

What Posturis does, and what stays the same

Posturis is read-only. It reads names, counts and settings from your tenant, evaluates them and discards them. It does not keep message, mailbox or file content. Its 46 controls cover six areas:

• Identity and access: multi-factor authentication, legacy authentication, Conditional Access and privileged accounts in Microsoft Entra ID.
• Identity Protection: accounts flagged at risk and whether risky sign-ins are reviewed.
• Device management: Intune compliance policies and device encryption state.
• Email and collaboration: the email security settings described below.
• Data sharing: SharePoint and OneDrive external sharing, anonymous links and guest controls.
• App and tenant governance: app registration and consent, guest invitations, stale accounts, and SPF, DKIM and DMARC records for your domains.

Every run leaves three files side by side in your SharePoint: an HTML report to read, a Word evidence pack an assessor can comment on, and an Excel workbook with one row per control. Each finding is mapped to the criteria it bears on in frameworks including ISO/IEC 27001, NIST CSF, the CIS Microsoft 365 Foundations Benchmark, SOC 2 and the Philippine Data Privacy Act. That mapping is evidence for an audit. It is not an audit report or a certification, and the documents say so.

Some things have not changed with this update:

• Nothing is changed in your tenant. Posturis holds no permission that can create, change, disable or delete anything there. Its only write is the report files, to the one SharePoint site you nominate.
• Your reports stay with you. They live in your storage, under your own retention and access rules.
• You make the changes. Every finding comes with plain remediation guidance. Suggested Conditional Access changes are written as report-only policies with an emergency access exclusion, and you or your reseller decide when to apply them.

New: email security coverage

Email is one of the most common ways into a Microsoft 365 organisation, so this was the gap we most wanted to close. Posturis now reads the configuration of:

• Safe Attachments and Safe Links
• anti-phishing policies, covering both spoofing and impersonation
• the common attachment filter in the anti-malware policy
• organisation-wide mailbox auditing
• tagging of messages from external senders

It reads settings only. No email is opened and no mailbox content is collected.

Not every tenant has all of these features. According to Microsoft, every Microsoft 365 subscription with cloud mailboxes includes built-in anti-malware and anti-spoofing protection, while Safe Attachments, Safe Links and impersonation protection belong to Microsoft Defender for Office 365 Plan 1, which is included in Microsoft 365 Business Premium. That difference is exactly why the next feature matters.

New: licence-aware results

An assessment that fails a tenant for not using a feature it has never paid for is not much use. It inflates the list of findings and hides the ones you can act on today.

Posturis now checks what the tenant is licensed for. When a control depends on a licence you do not hold, it is marked Not applicable instead of failed, with a short note on what the licence would add. Risk-based Conditional Access is a common example: Microsoft states that full access to Microsoft Entra ID Protection features requires Microsoft Entra ID P2 or Microsoft Entra Suite. A Business Standard tenant without that licence sees the control set aside with an explanation, not counted against it.

The result is a score that reflects what you can actually configure, and a short list of licence decisions you can make on their merits.

New: a monthly review by a person

Settings drift. An administrator adds a Conditional Access exclusion to fix a sign-in problem and forgets it, or a new site is opened to everyone because it was quicker at the time. A report produced once a year will not show you that.

The monthly managed service adds two things:

• An analyst review. Each month an Onprem2Cloud analyst validates your controls by hand and produces a Monthly Service Summary: the controls reviewed, gaps found against gaps closed, the time spent, and how your posture is trending.
• An automatic re-assessment. Optionally, Posturis runs again on a monthly schedule, so each summary is backed by a fresh set of reports.

This reduces your attack surface over time and catches risky changes between reviews. It is not real-time detection or monitoring, and it does not stop attacks on its own. For the thinking behind baselines and drift, see our article on Microsoft 365 security baseline monitoring.

Deeper identity and device checks

The existing areas have also grown. Conditional Access checks now look at named locations, compliant or managed device requirements, phishing-resistant authentication strength, and sign-in risk and user risk policies. Intune checks confirm that compliance policies exist and are assigned, and flag devices out of compliance. Encryption is reported as a state only; Posturis never reads a BitLocker or FileVault recovery key. There is also a structured view of coverage against the CIS Microsoft 365 benchmark.

Frequently asked questions

Does Posturis change anything in our Microsoft 365 tenant?

No. It is read-only. The only thing it writes is its own report files, to the SharePoint site you choose.

Does Posturis read our email?

No. The email checks read configuration such as Safe Links and anti-phishing policies. No message or mailbox content is opened or kept.

What does Not applicable mean in a Posturis report?

The control depends on a licence your tenant does not have, so it is set aside rather than failed. The note beside it explains what that licence would add.

Is the monthly review real-time monitoring?

No. It is a monthly review by an analyst, with an optional scheduled re-assessment. It catches risky changes between reviews and shows the trend, but it does not watch your tenant continuously.

Does a Posturis report make us ISO 27001 or SOC 2 certified?

No. It gives you control evidence for an audit. Certification is decided by an accredited body, and a SOC 2 report can only be issued by a licensed CPA firm.

Where to start

If your organisation runs on Microsoft 365 and needs evidence for an audit, a client questionnaire or a board report, this is a sensible order to work in:

1. Run a baseline. Start with one full assessment and file the three reports as produced.
2. Read the Not applicable items. Decide, licence by licence, whether what it would add is worth the cost.
3. Fix the email findings first. They are usually quick to change and close a common way in.
4. Give each finding an owner. The person who runs email reads the email findings, and so on.
5. Record what you accept. Where you choose not to act, note why and who approved it.
6. Turn on the monthly cycle. Keep each Monthly Service Summary in your audit file, so the trend is there when the auditor asks.

Posturis is available by arrangement.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. See Posturis alongside our other in-house software on the software page, read how an evidence report supports ISO work, or contact us to arrange a run.