Self-assessment · 2 minutes

Microsoft 365 access in 12 questions

How well is your tenant protected against stolen passwords and forgotten accounts? A first assessment, instantly.

Your answers stay in your browser and are not transmitted.

Question 1 of 12

Is MFA enforced for all users, not just recommended?

YesPartlyNoNot sure

Keyboard: digits 1 to 4 pick an answer, Enter moves on.

The self-assessment runs in your browser and needs JavaScript for that. Here are the twelve questions to read:

Is MFA enforced for all users, not just recommended?

Are older sign-in protocols (legacy authentication) blocked?

Are there two emergency access accounts that are excluded from Conditional Access and monitored?

Do at most five people hold permanent Global Administrator rights?

Are admin rights granted only when needed and for a limited time (PIM)?

Are the accounts of leavers blocked on their last working day?

Do you review guest accounts regularly and remove inactive ones?

Can only managed or compliant devices access company data?

Are app registrations and enterprise applications documented, including secret expiry dates?

Is user consent to apps restricted?

Are the Conditional Access policies documented, and does someone besides you know why they are set up that way?

Are SPF, DKIM and DMARC set up for your mail domain?

Pick what it is about. The form is short, and I usually reply within one working day.

Want to gauge it yourself first? Self-assessment in 2 minutes →

Remote, German business hours. Available now.