Microsoft 365 security assessment
Microsoft 365 security assessment in Australia
Know what needs fixing before you change your tenant. Aegentra assesses the agreed Microsoft 365 environment and turns configuration findings into practical decisions. Understand where access, email, collaboration or device controls need attention, which improvements your existing licences support and what should happen next.
Assessment findings first. Implementation only under an approved scope.
Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.
On this page
When an assessment is useful
Your business may have grown faster than its security configuration. New administrators, third-party applications, shared sites and changes in working patterns can make yesterday's settings unsuitable. An assessment establishes a documented starting point before a wider uplift, a new AI rollout or a customer assurance request.
What the assessment can cover
| Area | Questions we examine |
|---|---|
| Identity and administration | How are sign-ins protected, who holds privileged roles, and how is access removed? |
| Email and domains | Which protections are enabled, how is legitimate sending authenticated, and who handles suspicious messages? |
| Collaboration | Which sites, links and guest permissions could expose information beyond its intended audience? |
| Devices | Which devices are managed and supported, and which policies can reasonably apply? |
| Data and operations | Where are agreed protection policies applied, and who owns alerts, exceptions and follow-up? |
The written scope identifies the tenants, users, workloads and evidence available for review. Areas outside that boundary are recorded rather than silently treated as assessed.
Preparing for an assessment? Use our Microsoft 365 security hardening checklist to review the areas worth discussing before scope is agreed.
What you receive
A prioritised findings register
Each agreed finding explains the observed condition, its business significance and the recommended next action. Evidence distinguishes an actual configuration issue from an assumption requiring further investigation.
A practical remediation plan
Recommendations identify dependencies, potential licence changes and the team responsible. This helps separate urgent access or exposure issues from improvements that can be scheduled around normal operations.
A decision-focused readout
Review the important findings with Aegentra and decide which work to approve, defer or assign to your existing provider. Implementation is not assumed to be included in the assessment fee.
A useful finding explains the decision
Illustrative example, not a client assessment: A SharePoint site permits unauthenticated sharing links. Before changing the setting, establish whether a legitimate external workflow relies on those links, identify the affected information and agree a more appropriate access method. The recommendation should include the owner, test and transition steps, not simply say “disable sharing”.
| Decision field | Illustrative finding |
|---|---|
| Observed condition | A SharePoint site permits unauthenticated sharing links. |
| Before changing the setting | Establish whether a legitimate external workflow relies on those links. |
| Recommended next step | Identify the affected information and agree a more appropriate access method. |
| Transition | Include the owner, test and transition steps. |
Clear access and engagement boundaries
We agree an authorised access method and use only the permissions required for the approved assessment. Any change-making access requires separate agreement. Do not send passwords or sensitive tenant exports through the website enquiry form.
This is a configuration and evidence assessment, not penetration testing, incident containment, certification or continuous monitoring. Findings reflect the agreed scope and evidence available at the time of review.
From findings to implemented controls
Where you want Aegentra to perform the remediation, the next scope identifies the approved changes, pilot, verification and handover. If the assessment supports an ISMS project, findings can inform the organisation's risk treatment and control planning.
Explore Microsoft 365 security uplift
See how ISO 27001 implementation connects governance and controls
Assessment questions
What access is needed for a Microsoft 365 security assessment?
Agree the permissions and evidence method before granting access. The scope should identify the tenant, workloads, information reviewed, evidence destination and access removal arrangements. Do not assume that every assessment requires permanent Global Administrator access or inspection of mailbox contents. Configuration review, content access and writing a report to your repository are different permissions and actions that must be explained separately.
Will the assessment tell us whether every Microsoft 365 account and device is secure?
No. Its conclusions are bounded by the agreed workloads, available evidence, permissions, licences and review period. Missing logs or unmanaged devices should be recorded as limitations, not silently treated as compliant. The useful output is a prioritised explanation of supported findings and next actions, not a guarantee that every account, device or future event is safe.
What determines the price of a Microsoft 365 security assessment?
The quote depends on the tenant and workload scope, identity and device environment, available access, evidence needs and reporting depth. Confirm whether remediation planning, implementation and follow-up verification are included or separate. Comparing only user counts or a Secure Score screenshot can conceal different levels of work. Existing subscriptions and any additional licensing needs should be identified before purchases are agreed.
Is this just a Microsoft Secure Score review?
No. Available product recommendations may inform the assessment, but the deliverable explains the agreed findings in the context of your business, access model and operational dependencies. A score alone is not proof that the tenant is secure.
Do we need to change provider or buy new licences first?
Not simply to enquire. We first establish the review scope and what your existing subscriptions support. Any proposed purchase, provider involvement or additional access is discussed explicitly.
Can you assess our whole technology environment?
This service concerns the Microsoft 365 scope agreed in the proposal. Networks, other cloud platforms, applications and wider infrastructure are not automatically included.
Discuss the assessment you need
Tell us your approximate user count, main concern and current Microsoft 365 plan if you know it. We will confirm the scope, access requirements, deliverables and fee before the engagement starts.
Enquire about a Microsoft 365 assessmentRelated help: Email security · Data protection · Aegentra delivery team