Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencySecurity Services
Security starts with configuration.
Your Microsoft tenant controls identities, email, files, and cloud workloads – which makes it one of the most lucrative targets for attackers. In our Microsoft 365 security assessment, we check Entra ID, Conditional Access, Exchange Online, SharePoint, and Teams – and, in the Azure review, your Azure subscriptions as well – for misconfigurations and show you which measures reduce your risk the most.
Definition
A Microsoft 365 security assessment is a structured review of the security settings of your Microsoft tenant; as an Azure security review, it can also include your Azure environment on request. We analyze how identities, sign-ins, administrator rights, sharing, email protection, logging, and Azure resources are configured – and where this configuration needlessly opens doors for attackers. Our benchmarks are recognized standards such as the CIS Benchmarks for Microsoft 365 and Azure, the Microsoft Cloud Security Benchmark, and the recommendations from Microsoft Secure Score.
Microsoft operates the platform – but under the shared responsibility model, you are responsible for the secure configuration of your tenant. Many default settings are designed for compatibility, not for maximum security. On top of that come the things that accumulate over the years: exceptions in Conditional Access policies, guest accounts from long-finished projects, or administrator roles that are assigned permanently instead of on demand.
Attackers exploit exactly that. Compromised Microsoft 365 accounts are frequently the starting point for business email compromise, invoice fraud, data theft, and ransomware. Modern phishing kits steal session tokens and thereby bypass traditional MFA; password spraying targets every access point where MFA isn’t enforced.
The review also gives you reliable evidence: Art. 32 of the GDPR requires a process for regularly testing the effectiveness of technical and organizational measures, ISO/IEC 27001:2022 addresses information security for the use of cloud services (Annex A, control 5.23), and the EU NIS2 Directive explicitly lists multi-factor authentication as a risk-management measure. The report and test certificate demonstrate to auditors, customers, and insurers that your Microsoft environment has been independently reviewed.
Our approach
We don’t need administrator rights with write access for the review. You set up a dedicated audit account with read-only roles – usually “Global Reader” in Entra ID plus “Reader” and “Security Reader” on the relevant Azure management groups or subscriptions. This lets us view the configuration comprehensively without changing anything.
First, we capture the settings automatically and compare them with the CIS Benchmarks, the Microsoft Cloud Security Benchmark, and other best practices. The real value comes afterward: our assessment team evaluates each finding manually in the context of your environment, weeds out false positives, and analyzes attack paths – for example, which accounts, groups, or applications could obtain global administrator rights in a roundabout way.
We also take your licenses into account. Whether Microsoft 365 Business Premium, E3, or E5, whether Entra ID P1 or P2: our recommendations first make full use of the features you’re already paying for – and show transparently where an upgrade brings a real security gain.
Common vulnerabilities
Exceptions for service accounts, entire user groups, or supposedly trusted locations undermine sign-in policies. As long as phishing-resistant methods such as FIDO2 or passkeys aren’t in use, phishing kits can steal session tokens and bypass MFA.
Where older sign-in methods are still permitted – for example, for old clients, multifunction devices, or line-of-business applications – MFA doesn’t apply. These are exactly the access points attackers use for password spraying.
Global administrators without Privileged Identity Management, admin roles on everyday accounts, or synchronized on-premises accounts with cloud admin rights significantly enlarge the attack surface. Missing or poorly protected emergency access accounts are an additional risk.
If users can grant third-party apps access to mailboxes and files on their own, a single consent phishing attack is enough. Add to that applications with far-reaching Microsoft Graph permissions and long-lived client secrets.
“Anyone with the link” sharing, unrestricted guest access, and external Teams chats with arbitrary domains make data exfiltration and fraud by supposed help desk staff easier. Microsoft 365 Copilot makes the issue more urgent, because Copilot can analyze all content a user has access to.
Automatic forwarding to external addresses, transport rules that bypass the spam filter, missing spoofing protection, and incomplete SPF, DKIM, and DMARC records encourage CEO fraud and business email compromise.
Network security groups that allow RDP or SSH from the internet, publicly accessible storage accounts, long-lived SAS tokens, and key vaults without purge protection put data and workloads at risk. Generously assigned Owner rights on entire subscriptions further increase the potential damage.
If audit logs are incomplete, sign-in and diagnostic logs aren’t collected centrally, or Defender features are only partially enabled, attacks go undetected – and can hardly be reconstructed forensically in an emergency.
Possible focus areas
The following focus areas aren’t rigid packages but guidance. During scoping, we put together the scope to fit your environment – individually or combined.
Modern workplace
For organizations that mainly use Microsoft 365 – email, files, collaboration, and identities.
Cloud infrastructure
For workloads, databases, and applications in Azure – from the landing zone to individual resources.
Assumed breach
For environments with on-premises Active Directory or elevated protection needs – the review is extended with targeted attack scenarios.
Process
From the initial consultation to the test certificate – transparent and predictable like all our security services, and without interfering with your operations.
We clarify tenants, subscriptions, licenses, hybrid components, and your goals – such as preparing for an audit or hardening after a migration.
Within 24 hours of scoping (on business days), you receive a fixed-price quote for the agreed scope – with no hidden costs.
You set up an audit account with read-only roles. We capture the configuration and automatically compare it with the relevant benchmarks.
Our assessment team validates each finding, evaluates it in the context of your environment, and uncovers attack paths via roles, groups, and applications.
You receive a prioritized report with an executive summary and concrete measures. If you wish, we discuss the results together with your team.
After remediation, we retest the fixed findings free of charge and issue a test certificate.
Reporting
Every finding is documented in a traceable way – with the affected setting, a risk rating, and a concrete recommendation, including implementation guidance for the admin center or PowerShell where useful. The executive summary gives executive management a compact overview; the technical section gives your IT team all the details for implementation.
Whether after a migration, before an audit, or because your last review was a long time ago: we show you where your configuration needs tightening.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
No. Read-only roles are sufficient for the configuration review – typically “Global Reader” in Entra ID plus “Reader” and “Security Reader” in Azure. We don’t change any settings. Whether additional read permissions make sense for individual services is something we clarify during scoping.
The review looks at your configuration from the inside and uncovers misconfigurations systematically and comprehensively. A penetration test, by contrast, actively attacks your environment and shows which vulnerabilities are actually exploitable. The two approaches complement each other – it often makes sense to start with the review and then dig deeper into critical areas in a cloud penetration test.
Not for a configuration review with read-only access. Even active penetration tests against your own resources in the Microsoft Cloud don’t require prior approval, but they must comply with Microsoft’s rules of engagement – for example, no denial-of-service testing and no attacks against other tenants. We observe these rules in every assessment.
None in particular. We review what your licenses provide – from the security defaults of small tenants through Microsoft 365 Business Premium to E5 – and take into account whether you have Entra ID P1 or P2. That way, you can see which protective features you’re already paying for but not yet using.
That depends on the size of the tenant and the scope – for example, on whether Azure subscriptions and hybrid components are included. For a compact Microsoft 365 tenant, a few days of testing are often enough. We state the exact effort and schedule in the fixed-price quote.
No. We work exclusively read-only and don’t change any settings; your employees won’t notice the review at all. Only if you additionally commission active attack scenarios do we agree on time windows and approach with you in advance.
Microsoft continuously introduces new features and changed default settings, and your environment changes with every project. We recommend a review at least once a year and after major changes such as migrations, acquisitions, or the rollout of Microsoft 365 Copilot.
Yes, as technical evidence. The report documents the state of your measures for MFA, privileged access, and logging – topics that regularly come up under NIS2, ISO/IEC 27001:2022, and in cyber insurance questionnaires. You can present the test certificate to auditors, customers, and insurers; however, the review does not replace an audit.
Briefly describe your environment – number of users, licenses, Azure usage, and hybrid components. We’ll get back to you with a proposal for the right scope.
Diese Seite gibt es auch auf Deutsch.