Northwind Traders
Northwind Traders' Microsoft 365 has a critical security gap that should be fixed now.
Summary
We ran 61 security checks and 43 need attention (1 critical, 14 high, 16 medium and 12 low priority). The most urgent: 1 admin without MFA, and 1 whose registration isn't known.
On the positive side, 18 checks passed, including “Between 2 and 4 Global Administrators”, “Automatic forwarding to outside addresses is off” and “Shared mailboxes can't be signed in to”.
Since 14 September, Microsoft Secure Score rose from 38.5% to 47.5%, users with MFA rose from 59.7% to 62.2%, 1 issue was fixed and 7 new items came up.
About £123.30 a month (£1,479.60 a year) goes on licences that are unused or assigned to disabled or inactive accounts.
7 checks couldn't run because the data or a licence they need is missing.
Key figures
The last three months
Secure Score rose from 35.5% to 47.5% over the quarter. Found counts new findings and ones that came back; fixed counts findings resolved in the month.
| Month | Secure Score | Found | Fixed |
|---|---|---|---|
| August 2026 | 35.5% | – | – |
| September 2026 | 44.5% | 0 | 0 |
| October 2026 | 47.5% | 7 | 1 |
What was fixed
1 finding fixed between August to October 2026.
- Fixed Every active user has MFA registered · 1 item: megan.lee@northwindtraders.example
Projects
-
Email security Agreed
Email is how most attacks arrive and how fraud gets paid. Locking down the domain stops others pretending to be the business, and closing forwarding and old protocols stops mail leaking out.
-
Identity and Conditional Access Proposed
Most break-ins start with a stolen password, and admin accounts are the biggest prize. Requiring a second factor everywhere, blocking the old sign-in methods that can't ask for one and locking down admin accounts stops nearly all of them.
-
Device management with Intune Suggested
Company data lives on laptops and phones. Managing them means they're encrypted, kept up to date and can be wiped if lost, and unmanaged devices can be kept away from company data.
-
File sharing and guest access Suggested
Files shared with anyone who has the link, guests nobody remembers inviting and sites and teams nobody owns are an easy way for data to end up in the wrong hands.
-
Windows upgrade and hardware refresh Suggested
Computers on a Windows version that no longer gets security updates stay open to every flaw found from now on. Upgrading, or replacing machines that can't upgrade, closes that gap.
12 quick fixes that don't need a project:
- 1 admin without MFA, and 1 whose registration isn't knownGoal: Every admin has MFA registered
- 1 app with access to mail, files or the directoryGoal: Third-party apps hold only the access they need
- 1 domain had sign-in settings changed in the last 30 daysGoal: No unexpected changes to how domains sign in
- 4 accounts inactive for 90+ days or never usedGoal: No inactive accounts
- 3 mailboxes at or over 90% of quotaGoal: No mailbox is nearly full
- …and 7 more
Licence spend
| Licence | Purchased | Assigned | Each / month | Cost / month | Waste / month |
|---|---|---|---|---|---|
| Microsoft 365 Business Premium | 32 | 29 | £18.10 | £579.20 | £108.60 |
| Microsoft 365 Business Basic | 9 | 7 | £4.90 | £44.10 | £14.70 |
| Total | 41 | 36 | £623.30 | £123.30 |
Coming up
| When | What | Detail |
|---|---|---|
| 1 Nov 2026 in 20 days |
Visio Plan 2 (suspended) Subscription | 5 licences. Suspended: people can't use it, though admins can still back up its data. Reactivate it before this date or it's deleted. |
| 5 Nov 2026 in 24 days |
hannah.robinson@northwindtraders.example is nearly full Mailbox quota | 47.2 GB of 49.5 GB (95%). At its current growth it's full around 5 Nov 2026. It stops sending mail when it's full: turn on its archive or clean it up. |
| Now | accounts@northwindtraders.example is nearly full Mailbox quota | 44.8 GB of 49.5 GB (91%). It stops sending mail when it's full: turn on its archive or clean it up. |
| Now | olivia.smith@northwindtraders.example is nearly full Mailbox quota | 45.6 GB of 49.5 GB (92%). It stops sending mail when it's full: turn on its archive or clean it up. |
| 5 Nov 2026 in 24 days |
Board expires Team or group expiry | Team with 2 members. Ann Patel can renew it; otherwise it's deleted, and can be restored for 30 days. |
| 28 Nov 2026 in 47 days |
Project Phoenix expires Team or group expiry | Team with 3 members. No owner can sign in to renew it; otherwise it's deleted, and can be restored for 30 days. |
What we recommend next
-
Have each listed admin register a strong method
1 admin without MFA, and 1 whose registration isn't known.
-
Make sure each admin is included in an enabled Conditional Access policy that requires MFA for all apps, and isn't excluded from it directly or through a group
1 admin not covered by MFA.
-
Remove admin roles from guest accounts
1 guest with admin roles.
-
Review each app with the client
1 app with access to mail, files or the directory.
-
Turn on BitLocker
4 of 36 computers not encrypted.
Questions?
Reply to this report or call us, and we'll take it from there.