Microsoft 365 Risk Audit

Your tenant is misconfigured. Find out exactly where—before attackers do.

TeckPath Audit pulls read-only data from your Microsoft 365 tenant and turns it into a prioritized risk report: MFA gaps, Conditional Access holes, sharing exposure, and device posture—in plain English.

No agents Read-only access Revoke anytime Report in 48 hours
teckpath/audit — contoso-ltd · scan #04
52/100
Posture Score
CRITICALGlobal Administrator without MFA registered
CRITICALLegacy authentication not blocked by Conditional Access
HIGHAnonymous SharePoint sharing links permitted
HIGH5 excessive permanent Global Administrators
MEDIUMExternal mailbox forwarding rule detected
~10 min
From admin consent to scan kickoff—no endpoint agents
6
M365 domains assessed in a single read-only pass
48 hrs
To a board-ready report with expert validation
0
Changes made to your tenant during assessment
Why now

The attacks aren’t theoretical. They’re operational.

Microsoft 365 is secure-by-default, but tenants are rarely secure-by-configuration. The gaps attackers use most are the ones you already pay to prevent.

// identity

AiTM phishing

Adversary-in-the-middle kits steal session tokens and sail past MFA that isn’t properly enforced.

// oauth

Token & app abuse

Malicious or over-permissioned OAuth apps and service principals create persistent backdoors.

// email

Business email compromise

Hidden forwarding rules and legacy auth turn one inbox into financial fraud at scale.

// data

Sharing exposure

Anonymous links and ownerless sites quietly leak sensitive files outside the organization.

Scope

Six domains. One verdict.

A read-only configuration review across identity, access, collaboration, devices, and mail—mapped to CIS-aligned controls and real-world attack patterns.

01

Entra ID & identity

Privileged roles, MFA registration, guest accounts, and risky service principals.

02

Conditional Access

Legacy auth, admin MFA enforcement, and policy hygiene including report-only drift.

03

SharePoint & OneDrive

External sharing settings, anonymous links, and ownerless or broadly shared sites.

04

Intune & devices

Compliance gaps, stale endpoints, and elevated risk on administrator devices.

05

Exchange Online

External forwarding rules and mail-path risks that enable quiet data exfiltration.

06

Posture & reporting

Composite score, prioritized findings, PDF reports, and a full assessment audit trail.

Process

From consent to boardroom-ready report.

01
~5 min

Request or onboard

Submit the form or invite a tenant. Microsoft admin grants read-only consent.

02
~30 min

Automated scan

The platform collects configuration across six domains and runs the rule engine.

03
~24 hrs

Expert review

A TeckPath engineer validates findings and prioritizes by real exploitability.TeckPath services

04
48 hrs total

Walkthrough & roadmap

Receive the PDF report and remediation plan—with optional TeckPath implementation.

Why TeckPath Audit

Built for risk you can prove and act on.

// read-only

No production risk

Read-only Graph access with no write scopes. We never change policies, users, or data.

// deterministic

Explainable findings

Snapshot plus rules means reproducible, testable results—not an opaque proprietary score.

// msp-native

Whole book of business

A cross-tenant dashboard surfaces critical findings first across every customer you manage.

// narrative

Remediation in plain English

Every finding explains what’s wrong, why it matters, and what to do next.

// isolation

Tenant-level data isolation

Row-level security in Azure SQL—consultants only see the tenants they manage.

// services

Platform + people

Software plus expert review and a 48-hour walkthrough, not a DIY-only scanner.

Who it’s for

For the people accountable for the tenant.

MSPs & consultancies

Scale assessments across 10–500 tenants with the same deliverable, every time, and an upsell path to managed remediation.

IT & security leaders

Cut through Secure Score noise with severity-ranked findings you can take straight to leadership.

Compliance & risk owners

Documented scan history and reports as evidence for insurance questionnaires, audits, and boards.

Get started

Find out what your tenant is actually exposing.

Request a read-only Microsoft 365 audit. Prioritized findings and a board-ready report in 48 hours—no agents, revoke access anytime.

FAQ

The questions admins ask first.

Does this change our Microsoft 365 settings?+
No. Access is read-only. We do not modify policies, users, or data—the assessment collects configuration metadata only.
What permissions do you need?+
Application permissions via Microsoft admin consent, scoped to directory, policy, and read-only audit needs. Exact scopes are documented in the technical appendix you receive before consent.
How is our data isolated?+
Per-tenant row-level security in Azure SQL. Consultants can only see the tenants they manage—never another organization’s data.
Can we run this ourselves?+
Consultants sign in to the workspace; end-customer admins only grant consent. A self-serve tenant experience is on the roadmap.
How often should we rescan?+
Quarterly for a compliance baseline, monthly for higher-risk tenants. Continuous monitoring supplements scheduled scans by reacting to Entra identity changes between them.
top
Industry Focus