M365 Security Health Check
Most Microsoft 365 tenants were set up once and never revisited. We look at how yours is actually configured today, then send you a written findings report — what is exposed, what it would take to close, and what you already pay for but do not use.
Request your health check
No obligation, no pricing conversation until you have the report.
This opens a draft to sales@itnextdoor.com in your mail app with your answers filled in. Send it from your work account and we reply within one business day.
Why now
Microsoft is changing how people prove who they are. Two dates are already fixed, and both land in tenants automatically whether or not anyone is watching.
Dates as published by Microsoft on 13 July 2026. A temporary opt-out exists for the period between the two dates; it delays the nudge, not the retirement.
What we look at
Who can sign in, and how
Which authentication methods are enabled, who is still on SMS or voice, whether legacy per-user MFA is still in play, and which accounts have no second factor at all.
The policies you think you have
Every policy read in full: what it targets, what it excludes, and where the gaps are. Report-only policies that were never switched on are a common find.
Standing admin rights
How many Global Administrators exist, whether any are shared or unlicensed leftovers, whether there is a break-glass account, and what happens if one is phished.
Phishing and mail flow
SPF, DKIM and DMARC alignment, anti-phishing and impersonation protection, external forwarding rules nobody remembers creating, and how much of Defender for Office 365 your license already includes.
What is allowed to hold your data
Enrollment and compliance state in Intune, patch levels, disk encryption, and whether unmanaged personal devices can sync company files.
Sharing, retention and backup
Anonymous sharing links in SharePoint and OneDrive, guest access that outlived the project, audit retention, and whether anything independent is backing up your Microsoft 365 data.
See it first
Read a real one before you ask for yours
Below is a worked example for a fictitious 62-user freight company. The figures are illustrative; the format, the wording and the level of detail are exactly what you receive.
All 28 checks, the ranked action plan in three date buckets, and each finding written as what we saw, what it exposes, what fixing it involves.
Open sample →The same review on a single A4 page: the bottom line in two sentences, the most urgent action, and the counts at a glance.
Open sample →Both open in a new tab and print to PDF. No form, no email address required.
What you get
A written findings report
Plain English, sent as a PDF. Every finding states what we saw, what it exposes, and what fixing it involves. No scores out of ten, no dashboard you have to interpret.
A prioritized list
Split into what to do before 1 September, what to do before 1 February, and what can wait. Each item marked as configuration you already own or something that needs a license change.
A walkthrough call
Forty-five minutes with the engineer who did the review, so your team can ask why. The report is yours either way — you can hand it to whoever runs your IT.
How it runs
Five working days, and roughly ninety minutes of your time in total.
Questions we get
Why is this free?
Because it is the honest way to start a conversation. Some organizations read the report, fix things themselves and we never hear from them again. That is a fair outcome. Others ask us to do the work, and by then we both know what the work is.
We already have an IT provider.
Then bring them in. The report is written to be handed over, and a good provider will welcome a second pair of eyes on a tenant they inherited. We are not asking you to switch anything.
Do we need to buy more licenses?
Usually not for the identity work. Passkeys are included in every Entra plan at no extra cost. Where a finding genuinely needs a higher license tier, the report says so and separates it from everything you can fix with configuration you already own.
We are too small to be a target.
Nobody is targeting you specifically. Credential attacks are run at scale against whatever answers, and a tenant with one unprotected admin account is the same opportunity whether it has twelve users or twelve hundred.
What access do you actually need?
A read-only role in Entra ID and the relevant admin centers, scoped to your tenant and time-limited. We install nothing, we change nothing, and we will walk your team through exactly what is granted before you grant it.
Is our data safe with you?
We read configuration, not content. No mailbox or file contents are exported. Findings are held in Singapore, shared only with the people you name, and access is revoked on completion.
Find out where your tenant actually stands.
Five days, read-only access, a written report you keep. Booking now puts you comfortably ahead of 1 September.