Be ready when clients and insurers ask about your Microsoft 365 security.
Microsoft 365 Security & Governance Baseline
Get an independent, evidence-based review of your Microsoft 365 security configuration, with a board-ready summary and actionable remediation plan.
Provides evidence to support security assurance discussions. Does not guarantee insurance approval, audit acceptance or certification.
What you receive
Executive Briefing
Board-ready PDF with Red/Amber/Green risk summary across all six domains
Remediation Register
Prioritised Excel task list with severity rankings, effort estimates and Microsoft Learn references
Findings Walkthrough
60-minute handover session with your team or existing IT provider
Are your Microsoft 365 security features working as intended?
Microsoft 365 includes powerful security capabilities. The challenge is knowing whether they are configured appropriately for your organisation.
- ›Has your Microsoft 365 security configuration ever been independently reviewed?
- ›Is multifactor authentication effectively enforced for all relevant accounts?
- ›Who controls administrator access to your environment - and is that access appropriate?
- ›Who can access sensitive client information in SharePoint and OneDrive?
- ›Are your email protection controls configured to reduce phishing exposure?
- ›Do third-party applications connected to your tenant have appropriate permission levels?
- ›Would your team know if a privileged account were compromised?
Common triggers
- Cyber insurance renewal requiring documented security controls or evidence of an independent review
- Tier-1 supply chain or enterprise client security audit requesting proof of Microsoft 365 security posture
- ACSC Essential Eight baseline - establishing a documented starting point before a formal maturity assessment
- After a security incident has been contained, when the business wants to reassess its Microsoft 365 security configuration and prevent similar control weaknesses
- New CISO, IT Manager or MSP engagement requiring a current-state baseline before changes are made
What we assess
- 01. Identity and authentication - MFA registration versus enforcement, authentication methods, Conditional Access policies or Security Defaults, legacy authentication exposure
- 02. Privileged access - global administrators, elevated roles, emergency-access accounts, privileged-role hygiene
- 03. Email security - Exchange Online protection, anti-phishing policies, external forwarding, SPF, DKIM, DMARC
- 04. Information sharing - Tenant-level SharePoint and OneDrive sharing settings, guest access, anonymous links, and a defined sample of sensitive sites. Not a review of every site and permission in the tenant.
- 05. Applications and integrations - enterprise applications, OAuth permissions, consent settings, selected high-risk application identities
- 06. Security monitoring and governance - Configuration review of Secure Score, audit log availability, alert policies and governance controls. This is not an end-to-end validation of detection capability or incident response.
How it works
Discovery
We discuss your Microsoft 365 environment, existing IT arrangements, security concerns and assessment objectives.
Scope and authorisation
We agree on the systems, controls, access permissions and fixed-price engagement before any work begins.
Security assessment
Our practitioners assess the environment using agreed least-privilege, read-only permissions wherever supported. Any additional access or evidence-gathering requirements are agreed in advance. No production configuration changes are included. Analysis is performed by people - not an uncontextualised automated script export.
Findings and recommendations
We produce an evidence-based assessment report with an Executive Summary, Findings Register, Configuration Baseline and prioritised Remediation Roadmap.
Results walkthrough
We present the findings to your team or existing IT provider, explain what to address first, and answer questions on recommended next steps.
What you get
Executive Briefing (PDF)
A Red/Amber/Green status matrix across the six assessment domains, with a plain-English risk narrative written for the Board, CFO, or cyber insurance underwriter. No technical jargon - a document you can table in a meeting or attach to a policy renewal.
Remediation Task Register (Excel)
Every finding translated into a prioritised technical task: severity ranking, estimated effort, Microsoft Learn reference, and recommended owner. Handed directly to your internal team or existing IT provider with no obligation to engage Evoltra for implementation.
Findings walkthrough
A 60-minute session presenting the results to your team or IT provider. We explain what to address first, why it matters, and what a realistic remediation sequence looks like - so findings translate into action rather than sitting in a folder.
Investment
From A$2,950 ex GST
Fixed-scope Microsoft 365 Security & Governance Baseline for organisations with 20–200 users. The starting price covers one Microsoft 365 tenant and our standard six-domain assessment, including an Executive Briefing, prioritised Remediation Task Register and findings walkthrough. Final pricing is confirmed during the scoping call and reflects tenant complexity, the number of configurations and integrations requiring review, and any additional evidence requirements. You receive a fixed-price quotation before work begins. No unexpected charges or ongoing contract.
Not included in this assessment
- · Penetration testing or vulnerability scanning
- · Endpoint forensics or device management implementation
- · DLP policy design or sensitivity label deployment
- · Mailbox content inspection
- · Essential Eight maturity certification
- · Production remediation or configuration changes
- · Ongoing monitoring or managed service
Next steps
Common questions
Need an independent baseline of your Microsoft 365 tenant?
Book a 30-minute scoping call. We will confirm tenant suitability, agree on scope, and outline the onboarding requirements - no obligation to proceed.
Fixed price agreed before any work begins. No ongoing contract.