Why identity first
Most modern intrusions do not break through a firewall; they sign in. Token theft, adversary-in-the-middle phishing, consent abuse and legacy authentication remain the most common ways into Microsoft 365 tenants.
What we assess
- Authentication methods, MFA strength and phishing-resistant coverage
- Conditional Access policies, exclusions and break-glass accounts
- Privileged roles, PIM configuration and standing access
- Enterprise applications, service principals and delegated permissions
- Exchange Online transport rules, forwarding and mailbox auditing
- SharePoint and OneDrive external sharing
- Defender and audit settings: is the telemetry you would need in an incident turned on?
Not only Microsoft
Most environments mix vendors. We assess how your Microsoft tenant works together with the rest of your stack, and whether each layer is configured to cover the others:
| Layer | Microsoft | Common alternatives we also review |
|---|---|---|
| Email security | Exchange Online Protection, Defender for Office 365 | Proofpoint, Mimecast, Cisco Secure Email, Barracuda, Trend Micro |
| Endpoint (EDR) | Defender for Endpoint | CrowdStrike Falcon, SentinelOne, Sophos, Trellix |
| Identity / SSO | Entra ID, Conditional Access | Okta, Ping Identity, Duo, OneLogin |
| SIEM | Microsoft Sentinel | Splunk, Elastic, QRadar, Google SecOps |
Typical gaps: a mail gateway that can be bypassed by sending straight to Exchange Online, two EDR agents fighting each other or one left in passive mode, and SSO policies that do not match Conditional Access.
How it works
- Consent: you grant a time-limited, read-only app registration. We never ask for Global Administrator passwords.
- Collection: configuration is collected with the Kage Security Toolkit, our in-house assessment platform.
- Analysis: our consultants review the results by hand and remove false positives.
- Findings workshop: we walk you through the results and agree priorities.
What you receive
- An executive summary with a Zero Trust maturity score
- A prioritised remediation plan: quick wins, then projects
- Technical findings with the exact setting to change and the impact on users
- An optional follow-up review to measure progress
Next step
Most clients follow the assessment with Entra ID & Conditional Access hardening or a Defender XDR deployment, and we can carry out the fixes with you.