InfoSight's Microsoft 365 Security Assessment is a professional service that combines automated scanning with expert-led review to identify misconfigurations, over-privileged access, and security gaps across an organization's M365 tenant. The assessment follows a three-phase process: 1. Recon & Inventory – Discovers all users, mailboxes, applications, and guest relationships within the tenant. 2. Configuration & Permission Audit – Reviews Conditional Access policies, MFA enforcement, Exchange Online settings, Teams/SharePoint configurations, and API permissions. 3. Threat Simulation & Reporting – Validates exploitable findings, maps them to MITRE ATT&CK and NIST frameworks, and produces a remediation roadmap. Security modules covered include: - Azure AD & Identity: Role validation, Conditional Access, Privileged Identity Management, and MFA policies. - Exchange Online & Email: Anti-phishing hardening, DKIM/SPF/DMARC configuration, mailbox permissions, and ATP rules. - Teams & SharePoint: Sharing settings, site permissions, DLP policies, and external access controls. - OneDrive & Data Protection: Sensitive data scanning, sensitivity label enforcement, and external sync security. - Conditional Access & MFA: Policy gap testing, legacy authentication review, and risky sign-in analysis. - Secure Score Optimization: Identification of improvements to reach Microsoft best-practice levels. Deliverables include a prioritized risk report with business-impact scoring, an audit trail and change log, a Secure Score improvement plan, and compliance mapping to NIST 800-53, ISO 27001, HIPAA, and PCI DSS. Optional continuous monitoring with monthly health checks is also available.