Contoso Legal LLP
Contoso Legal LLP's Microsoft 365 has a critical security gap that should be fixed now.
Summary
We ran 54 security checks and 39 need attention (1 critical, 13 high, 13 medium and 12 low priority). The most urgent: 1 admin without MFA, and 1 whose registration isn't known.
On the positive side, 15 checks passed, including “Between 2 and 4 Global Administrators”, “Automatic forwarding to outside addresses is off” and “Shared mailboxes can't be signed in to”.
Since 14 September, Microsoft Secure Score rose from 63% to 68%, users with MFA rose from 72.3% to 80%, 1 issue was fixed and 5 new items came up.
About £87.10 a month (£1,045.20 a year) goes on licences that are unused or assigned to disabled or inactive accounts.
7 checks couldn't run because the data or a licence they need is missing.
Key figures
The last three months
Secure Score rose from 62% to 68% over the quarter. Found counts new findings and ones that came back; fixed counts findings resolved in the month.
| Month | Secure Score | Found | Fixed |
|---|---|---|---|
| August 2026 | 62% | – | – |
| September 2026 | 65% | 0 | 0 |
| October 2026 | 68% | 5 | 1 |
What was fixed
1 finding fixed between August to October 2026.
- Fixed Every active user has MFA registered · 1 item: ella.thomas@contoso.example
Projects
-
Identity and Conditional Access Suggested
Most break-ins start with a stolen password, and admin accounts are the biggest prize. Requiring a second factor everywhere, blocking the old sign-in methods that can't ask for one and locking down admin accounts stops nearly all of them.
-
Email security Suggested
Email is how most attacks arrive and how fraud gets paid. Locking down the domain stops others pretending to be the business, and closing forwarding and old protocols stops mail leaking out.
-
Device management with Intune Suggested
Company data lives on laptops and phones. Managing them means they're encrypted, kept up to date and can be wiped if lost, and unmanaged devices can be kept away from company data.
-
Windows upgrade and hardware refresh Suggested
Computers on a Windows version that no longer gets security updates stay open to every flaw found from now on. Upgrading, or replacing machines that can't upgrade, closes that gap.
19 quick fixes that don't need a project:
- 1 admin without MFA, and 1 whose registration isn't known
- 3 files and folders shared with anyone
- 1 site with no owner, 2 sites with one owner
- 1 app with access to mail, files or the directory
- 1 domain had sign-in settings changed in the last 30 days
- …and 14 more
Licence spend
| Licence | Purchased | Assigned | Each / month | Cost / month | Waste / month |
|---|---|---|---|---|---|
| Microsoft 365 Business Premium | 18 | 15 | £18.10 | £325.80 | £72.40 |
| Microsoft 365 Business Basic | 6 | 4 | £4.90 | £29.40 | £14.70 |
| Total | 24 | 19 | £355.20 | £87.10 |
Coming up
| When | What | Detail |
|---|---|---|
| 31 Oct 2026 in 19 days |
Visio Plan 2 (suspended) Subscription | 5 licences. Suspended: people can't use it, though admins can still back up its data. Reactivate it before this date or it's deleted. |
| 5 Nov 2026 in 24 days |
evie.davis@contoso.example is nearly full Mailbox quota | 47.2 GB of 49.5 GB (95%). At its current growth it's full around 5 Nov 2026. It stops sending mail when it's full: turn on its archive or clean it up. |
| Now | accounts@contoso.example is nearly full Mailbox quota | 44.8 GB of 49.5 GB (91%). It stops sending mail when it's full: turn on its archive or clean it up. |
| Now | oliver.hill@contoso.example is nearly full Mailbox quota | 45.6 GB of 49.5 GB (92%). It stops sending mail when it's full: turn on its archive or clean it up. |
| 4 Nov 2026 in 23 days |
Board expires Team or group expiry | Team with 2 members. Annabel Fraser can renew it; otherwise it's deleted, and can be restored for 30 days. |
| 27 Nov 2026 in 46 days |
Project Phoenix expires Team or group expiry | Team with 3 members. No owner can sign in to renew it; otherwise it's deleted, and can be restored for 30 days. |
What we recommend next
-
Have each listed admin register a strong method
1 admin without MFA, and 1 whose registration isn't known.
-
Make sure each admin is included in an enabled Conditional Access policy that requires MFA for all apps, and isn't excluded from it directly or through a group
1 admin not covered by MFA.
-
Remove admin roles from guest accounts
1 guest with admin roles.
-
Review each app with the client
1 app with access to mail, files or the directory.
-
Turn on BitLocker
2 of 19 computers not encrypted.
Questions?
Reply to this report or call us, and we'll take it from there.