Harbour ITMenu

Powered by Office Sentry 2.3.0

You're in the demo. Three fictional clients with made-up people. Look around freely: nothing can be changed, and it all resets every night.Get Office Sentry
Month-end · October 2026/Northwind Traders

Northwind Traders · October 2026

Draft Not on a report plan
See the report PDF
Needs your eyes: 1 new critical finding.

Verdict and commentary

Action needed

Northwind Traders' Microsoft 365 has a critical security gap that should be fixed now.

What we recommend next

Kept from month to month

None yet, so the report suggests its own from the failing checks. Add your own to replace them.

Projects to propose · half a day or more of work
  • Project: Email securityAbout 1 dayhigh
  • Project: Identity and Conditional AccessAbout 1 dayhigh
  • Project: Device management with IntuneAbout 7 hourshigh
  • Project: File sharing and guest accessAbout 5 hourshigh
  • Project: Windows upgrade and hardware refreshAbout 2 dayshigh
Quick fixes · smaller jobs to just do
  • Have each listed admin register a strong methodUnder an hour · 1 admin without MFA, and 1 whose registration isn't knowncritical
  • Review each app with the clientUnder an hour · 1 app with access to mail, files or the directoryhigh
  • Confirm with the client that each change was plannedUnder an hour · 1 domain had sign-in settings changed in the last 30 dayshigh
  • Disable accounts that haven't signed in for 90 days, or were created over 30 days ago and never usedAbout 1 hour · 4 accounts inactive for 90+ days or never usedmedium
  • Turn on the online archive for each listed mailboxAbout 2 hours · 3 mailboxes at or over 90% of quotamedium
  • Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflowUnder an hour · Users can consent to any appmedium
  • Remove licences from disabled accounts, or convert leavers' mailboxes to shared mailboxesUnder an hour · 1 disabled account still licensedmedium
  • Add Defender for Office 365 Plan 1 and turn on Safe Links and Safe AttachmentsAbout 2 hours · Links and attachments in email aren't checked when they're openedmedium

And 4 more on Recommended projects.

What's in the report

Northwind Traders, October 2026 only

Untick what Northwind Traders shouldn't get this month. The design, other clients and next month stay as they are. To leave out one check, use Findings below.

Monthly review
Key figures · in every report

Findings

Notes show under the check on the report
critical 1 admin without MFA, and 1 whose registration isn't known Left out
Add a note
high 1 admin not covered by MFA Left out
Add a note
high 1 guest with admin roles Left out
Add a note
high 1 app with access to mail, files or the directory Left out
Add a note
high 4 of 36 computers not encrypted Left out
Add a note
high 5 of 36 Windows computers past end of support Left out
Add a note
high 1 suspicious inbox rule Left out
Add a note
high 1 mail flow rule skips spam filtering Left out
Add a note
high 4 external forwards Left out
Add a note
high 14 users without MFA Left out
Add a note
high Legacy authentication is allowed Left out
Add a note
high 1 domain had sign-in settings changed in the last 30 days Left out
Add a note
high 1 site with no owner, 2 sites with one owner Left out
Add a note
high 1 guest with full control of 1 site Left out
Add a note
medium 4 accounts inactive for 90+ days or never used Left out
Add a note
medium 2 admins without a phishing-resistant method Left out
Add a note
medium 1 app with privileged roles Left out
Add a note
medium No compliance policy for iOS/iPadOS Left out
Add a note
medium 6 of 37 managed devices not compliant Left out
Add a note
medium 5 of 37 joined Windows computers without a saved recovery key Left out
Add a note
medium 1 mail domain without DKIM Left out
Add a note
medium 2 domains without DMARC enforcement Left out
Add a note
medium 1 sender domain skips the spam filter Left out
Add a note
medium 4 teams and groups without an owner Left out
Add a note
medium Enforced by Require MFA for all users, with 1 exclusion to review Left out
Add a note
medium 1 disabled account still licensed Left out
Add a note
medium Anyone, including anonymous links Left out
Add a note
medium 1 file or folder outside people can edit Left out
Add a note
medium 3 mailboxes at or over 90% of quota Left out
Add a note
low 1 account reports to a blocked manager Left out
Add a note
low 1 app registration with expiring or expired credentials Left out
Add a note
low 1 of 37 joined computers not in Intune Left out
Add a note
low 3 devices haven't checked in for 30+ days Left out
Add a note
low 1 of 39 device records unused for 90+ days Left out
Add a note
low 1 domain with SPF problems Left out
Add a note
low 1 of 1 mail domain doesn't fully enforce MTA-STS Left out
Add a note
low SMTP AUTH is on for the organisation Left out
Add a note
low Anyone, including guests, can invite guests Left out
Add a note
low 3 people can only use a text or call as a second factor Left out
Add a note
low 2 subscriptions with spare licences Left out
Add a note
low Any user can register an app Left out
Add a note

Review

New critical or high since the last report: 25

The client's copy

Open full size

As it goes out if you approve now: client-visible notes only, without what's left out.