Fixed price · read-only
Identity Check for Microsoft 365
How easily could someone get into your company with a stolen password? I check your Microsoft 365 sign-ins, admin rights and access rules, read-only, at a fixed price.
Scope
What I check
Sign-in & MFA
Who can sign in with a password alone, which methods are registered and whether legacy protocols bypass multi-factor authentication.
Admin rights & break-glass accounts
How many Global Administrators there are, whether admin and daily accounts are separate and whether emergency access exists.
Joiners, movers, leavers
Whether accounts of former employees are still active and whether rights follow people when they change roles.
Guests & applications
Inactive guests, app registrations with long-lived secrets and who may give apps access to company data.
Email security
Forwarding to outside addresses, inbox rules, and SPF, DKIM and DMARC for your mail domain.
Devices & access rules
Which devices are managed in Intune, whether their state feeds into the access decision and which Conditional Access policies apply.
Result
What you get
Report with a traffic-light rating
Findings rated by risk, each with evidence, cause and recommendation. Plus an action plan with order and effort.
Summary for management
The most important risks in plain words, and what they mean for insurance and customers.
Review meeting
We go through the findings together and agree on the next steps.
- View sample report
Packages
Three packages at a fixed price
You know in advance what the check costs, what you get and when.
Quick check
Price: €690
- Scope
- Automated check with a short assessment
- Result
- One-page traffic-light summary, 30-minute call
- Delivery
- 3 working days
- Limits
- up to 150 users, 1 tenant
- Recommended
Identity Check
Price: €1,490
- Scope
- Automated check plus a manual assessment of every finding
- Result
- Report as in the sample, 60-minute call
- Delivery
- 5 working days
- Limits
- up to 150 users, 1 tenant
Identity Check Plus
Price: €2,900
- Scope
- As Identity Check, plus Intune and devices, hybrid AD connection and Okta (if present)
- Result
- Report, workshop (2 hours) and a 12-month roadmap
- Delivery
- 10 working days
- Limits
- up to 300 users, 1 tenant
- Credited in full if you order the implementation within 60 days.
- More users or several tenants: on request.
Process
Five steps to the result
Remote, read-only and without touching day-to-day operations.
- Step 01
Read access
You create a time-limited account with read permissions (Global Reader, Security Reader). Sign-in with a FIDO2 key only. Your effort: about 15 minutes.
- Step 02
Automated check
Test runs with Maester (open source, test suites based on EIDSCA, CISA SCuBA and CIS) and my own Microsoft Graph queries.
- Step 03
Manual assessment
Every deviation in context: is it intentional, is there a justified exception, which accounts are really affected?
- Step 04
Report
Findings with risk, evidence and recommendation, an action plan with effort, a summary for management.
- Step 05
Review
We discuss the results and the next steps. The read access is removed afterwards.
Trust
Trust and data protection
Read permissions only
I don't change a single setting in your environment.
Data processing agreement
Signed before I access anything.
Results stay local
Check data stays with me and is deleted after the project.
No AI with access
No AI tools with access to your systems or data.
FAQ
What people ask before the check
Do we need particular licences?
No. Microsoft 365 Business Premium or Entra ID P1 is recommended, because then Conditional Access can be checked too. But the check also works without.
Do you change anything in our environment?
No. The account has read permissions only, and I don't change any setting. What needs doing is in the action plan.
What happens after the check?
That's your decision. I implement the urgent points and the Conditional Access baseline as a fixed-price package, or your own team works through the action plan. If you order the implementation within 60 days, the check is credited in full.
Do you also work for our IT service provider?
Yes. System integrators and MSPs can offer the check and the implementation under their own name. Offer for system integrators
How well is your Microsoft 365 secured?
Send me a short note with company size and licence. I usually reply within one working day with a proposed date.