Reports

Monthly review Security and licensing summary with recommendations, ready to send to the client. All clients

Evidence and certifications Cyber Essentials and CE Plus judged from the data, with what to fix, and answers to paste into cyber insurance and supplier security forms. All clients

What changed Configuration changes, new and fixed findings, and figures that moved. All clients

Findings Every open finding from the checks, worst first, with accepted risks. All clients

All users Every account with its department, job title, manager, licences and last sign-in, its managers and departments, and accounts reporting to a blocked manager. All clients

MFA coverage Who has set up MFA, who is required to use it, and where the two don't match. All clients

Passwords and sign-in methods How people sign in and how strong that is: methods by strength, admins without phishing-resistant MFA, the methods policy, and password age and expiry. All clients

Admins and roles Every admin role holder with MFA, PIM and sign-in status, and a break-glass check. All clients

Administrative units Every administrative unit with its members and the admins scoped to it, restricted units, and units with nobody in them or nobody administering them. All clients

Conditional Access coverage Every policy in plain words, and which accounts each one actually covers. All clients

Inactive accounts Members and guests who haven't signed in for a long time, and old invitations. All clients

Sign-in activity Failed and successful sign-ins over the last week by account, country and app: password guessing, unusual countries, sign-ins without MFA and risky sign-ins. All clients

Risky users Accounts Entra ID Protection rates at risk or confirmed compromised, and the risk resolved recently (needs Entra ID P2). All clients

Guests and sharing Who can invite and share externally, and every guest account. All clients

Deleted users and groups Users, teams and Microsoft 365 groups in the recycle bin, with the licences they held and the days left to restore each before Microsoft deletes it for good after 30 days. All clients

Legacy sign-ins Sign-ins with SMTP AUTH, IMAP, POP and other protocols that can't do MFA, and which mailboxes still allow them. All clients

Hybrid identity Directory sync from on-premises AD, password hash sync, how each domain signs in, and admin accounts synced from AD. All clients

Mail forwarding Every mailbox that sends mail on automatically, and the settings that allow it. All clients

Inbox rules Rules that forward, delete or hide mail, and every rule in every mailbox. All clients

Mailbox permissions Who can open, send as or send on behalf of each mailbox, by person and by mailbox. All clients

Shared mailboxes Shared, room and equipment mailboxes that can be signed in to, and who uses them. All clients

Mailbox size Every mailbox's size against its quota, largest share of quota first. All clients

Mailbox size trend How each mailbox has grown over the last one and three months, which will fill up and when, and the tenant's total mailbox size month by month. All clients

Mail flow by domain How much mail each domain sends and receives, how much was delivered, sent to Junk, quarantined or failed, and who gets the most spam and phishing. All clients

Mailbox holds and archiving Which mailboxes are on litigation hold or have an archive, leavers' mailboxes that aren't held, and large mailboxes that need an archive. All clients

Automatic replies Mailboxes answering mail with an out-of-office reply, who outside hears it, and replies that have been on so long they look forgotten. All clients

Distribution lists Every distribution list with its members and owners, who can mail it, and empty, ownerless or unused lists. All clients

Mobile devices Phones and tablets that sync mail, with which app, when each last synced, and leavers' devices that are still connected. All clients

Email domains SPF, DMARC, DKIM, MTA-STS and TLS-RPT for each of the tenant's domains, from public DNS. All clients

Mail rules and protection Mail flow rules and what each does, connectors, and the anti-spam, anti-phishing and anti-malware policies (Safe Links and Safe Attachments too) with whom each applies to. All clients

SharePoint sites Storage and growth, inactive sites, and which sites are shared outside. All clients

Site access Who owns, administers and can reach each SharePoint site: ownerless sites, guests, and sites open to everyone in the organisation. All clients

Site permissions Who holds which permission level on each SharePoint site, through which SharePoint group, and the lists, libraries and subsites with permissions of their own. All clients

SharePoint storage What fills the tenant's SharePoint storage and what to clean up: sites, folders, large and old files, version history and recycle bins. All clients

OneDrive Each person's OneDrive: storage, activity, sharing, and OneDrives of people who've left. All clients

Shared files Every file and folder shared with anyone, people outside, or the whole organisation. All clients

File and folder permissions Who can open each shared file or folder, how they got access, who shared it and when links expire. All clients

Groups and Teams Who can create teams and groups, which have no owner, and the guests in each. All clients

Teams channels, guests and apps Each team's private and shared channels and who is in them, guests and people from other organisations, the apps added to each team, and teams nobody has used lately. All clients

Group membership Who is in which team and Microsoft 365 group: each person's teams and groups, each group's members, and every membership in one table. All clients

Empty, nested and dynamic groups Groups with no members, groups inside other groups, dynamic groups with their rules and whether they're paused, teams and groups about to expire, role-assignable groups, and blocked accounts still in groups. All clients

Devices Intune compliance, encryption and Windows support, BitLocker recovery keys saved in Entra ID, and every Entra ID device record. All clients

Intune policies Which platforms have a compliance policy, what each compliance policy requires, configuration profiles and Windows update rings, endpoint security policies and app protection for phones, with whom each applies to. All clients

Apps and consents Third-party apps with access to the tenant, and app credential expiry. All clients

Unused apps Every app from outside Microsoft with when it last signed in, and those unused for 90 days that still hold permissions. All clients

Secure Score trend Secure Score over time, which controls changed, and where the points are. All clients

Licences and subscriptions Every subscription with licences bought, assigned and available, its cost and renewal date, trials and lapsing subscriptions, and who has which licence, directly or by group. All clients

Licence changes Who was given or lost a licence and when, who made the change, and licences bought and assigned month by month, from Office Sentry's own history. All clients

Licence waste Paid licences nobody uses, in money, and the accounts holding them. All clients

Licence right-sizing People who could move to a cheaper licence, and services people are licensed for but don't use. All clients

Microsoft 365 usage Who actually uses email, Teams, OneDrive, SharePoint and the Office apps, and when each person was last active. All clients

Tenant settings What users and guests can do by default, and whether users can ask an admin to approve apps. All clients

Admin activity Admin roles, Conditional Access, app credentials, consents, domains and account changes from the directory audit log, and who made them. All clients

Contoso Legal LLPcontoso.onmicrosoft.com

Fabrikam Dental Groupfabrikam.onmicrosoft.com

Northwind Tradersnorthwindtraders.onmicrosoft.com