Contoso Legal LLP
contoso.onmicrosoft.com
Each row is an account or setting a check flagged. Findings close on their own once the next collection no longer sees the problem. If something is intentional, accept the risk so it moves out of the totals.
Open findings
74
from 39 checks
Critical or high
19
fix these first
New in 30 days
5
first seen since 12 Sep
Open over 90 days
0
Accepted risks
0
left out of the totals
| Severity | Account or item | Detail | Category | Action |
|---|---|---|---|---|
| critical | breakglass@contoso.example | Global Administrator with no MFA method registered | Admins |
Accept risk |
| low | g#EXT#@contoso.example | Exchange Administrator: MFA registration unknown | Admins |
Accept risk |
| high | breakglass@contoso.example | Global Administrator: excluded from Require MFA for all users | Admins |
Accept risk |
| high | Campaign video.mp4 (Marketing / Documents) | Anyone can edit | Sharing |
Accept risk |
| medium | Brand assets (Marketing / Documents) | Anyone can view, link never expires | Sharing |
Accept risk |
| medium | holiday.jpg (OneDrive of annabel.fraser@contoso.example) | Anyone can view | Sharing |
Accept risk |
| high | LAPTOP-HILL07 (oliver.hill@contoso.example) | Windows disk isn't encrypted | Devices |
Accept risk |
| high | LAPTOP-MARSH (bobby.marsh@contoso.example) | Windows disk isn't encrypted | Devices |
Accept risk |
| high | contoso.example | Set domain authentication by mallory.hart@contoso.example on 9 Oct 2026 | Identity |
Accept risk |
| high | annabel.fraser@contoso.example | Mailbox forwarding to annabel.fraser@homemail.example (keeps a copy) |
Accept risk |
|
| high | annabel.fraser@contoso.example | Inbox rule "Copy to home" forwards to annabel.fraser.home@homemail.example |
Accept risk |
|
| high | oliver.hill@contoso.example | Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example |
Accept risk |
|
| high | g#EXT#@contoso.example | Guest holding Exchange Administrator | Admins |
Accept risk |
| high | Tenant | No enabled policy blocks legacy authentication for all users | Identity |
Accept risk |
| high | Mail Sync Pro | Mail.Read (application permission; unverified publisher) | Apps |
Accept risk |
| high | accounts@hollis-partners.example on Finance | Full Control, given Full Control directly | Sharing |
Accept risk |
| high | Marketing | No enabled owner (Microsoft 365 group) | Sharing |
Accept risk |
| low | Operations | One owner (Microsoft 365 group) | Sharing |
Accept risk |
| low | Staff Intranet | One owner (site administrators) | Sharing |
Accept risk |
| high | LAPTOP-CLARK13 (william.clark@contoso.example) | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-JOHNSON04 (jacob.johnson@contoso.example) | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| high | LAPTOP-MARSH (bobby.marsh@contoso.example) | Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. | Devices |
Accept risk |
| low | DESK-SMITH03 (megan.smith@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | DESK-WILSON12 (olivia.wilson@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-DAVIS01 (evie.davis@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-EVANS02 (rhys.evans@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-HILL07 (oliver.hill@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-TAYLOR08 (owen.taylor@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-THOMAS10 (ella.thomas@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| low | LAPTOP-WARD11 (olivia.ward@contoso.example) | Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. | Devices |
Accept risk |
| high | annabel.fraser@contoso.example | ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank |
Accept risk |
|
| high | breakglass@contoso.example | No MFA method registered | Identity |
Accept risk |
| medium | carl.ashworth@contoso.example | No MFA method registered | Identity |
Accept risk |
| medium | joseph.morris@contoso.example | No MFA method registered | Identity |
Accept risk |
| medium | lily.harrison@contoso.example | No MFA method registered | Identity |
Accept risk |
| medium | annabel.fraser@contoso.example | Global Administrator; signs in with Authenticator app | Admins |
Accept risk |
| medium | breakglass@contoso.example | Global Administrator; signs in with no MFA method at all | Admins |
Accept risk |
| medium | DESK-WILSON12 (olivia.wilson@contoso.example) | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-HILL07 (oliver.hill@contoso.example) | Not compliant | Devices |
Accept risk |
| medium | LAPTOP-MARSH (bobby.marsh@contoso.example) | Not compliant | Devices |
Accept risk |
| medium | contoso.example | Microsoft 365 DKIM isn't set up (selector2 CNAME missing) |
Accept risk |
|
| medium | contoso.example | DMARC is monitor-only (p=none); spoofed mail is still delivered |
Accept risk |
|
| low | parked.example | Doesn't receive mail but has no DMARC p=reject record |
Accept risk |
|
| medium | bobby.marsh@contoso.example | Disabled, holding 1 licence | Licences |
Accept risk |
| medium | accounts@contoso.example | 44.8 GB of 49.5 GB (91%), no archive | Storage |
Accept risk |
| medium | evie.davis@contoso.example | 47.2 GB of 49.5 GB (95%), no archive | Storage |
Accept risk |
| medium | oliver.hill@contoso.example | 45.6 GB of 49.5 GB (92%), no archive | Storage |
Accept risk |
| medium | breakglass@contoso.example | Excluded from "Require MFA for all users" | Identity |
Accept risk |
| medium | Year end/Draft accounts FY26.xlsx (Clients / Documents) | Can be edited by partner@mason-legal.example | Sharing |
Accept risk |
| medium | Project Phoenix | Team, only owner is disabled (Bobby Marsh) | Groups |
Accept risk |
| low | Marketing | Microsoft 365 group, only owner is disabled (Bobby Marsh) | Groups |
Accept risk |
| low | Marketing | Microsoft 365 group, no owner | Groups |
Accept risk |
| low | Provisioned | Microsoft 365 group, owned only by an app (Provisioning app) | Groups |
Accept risk |
| medium | Some app | App holding Exchange Administrator | Admins |
Accept risk |
| medium | SharePoint and OneDrive | Anyone links are allowed | Sharing |
Accept risk |
| medium | joseph.morris@contoso.example | Licensed member, last signed in 11 Jun 2026 | Accounts |
Accept risk |
| low | g#EXT#@contoso.example | Guest, never signed in, created ? | Accounts |
Accept risk |
| medium | Tenant | Any user can grant any app access to their mail and files | Apps |
Accept risk |
| low | Old connector | The 1 credential expired, last on 1 Jan 2025 | Apps |
Accept risk |
| low | Tenant | Users can register apps that nobody reviews | Tenant settings |
Accept risk |
| low | annabel.fraser@contoso.example | Reports to Bobby Marsh, whose sign-in is blocked | Accounts |
Accept risk |
| low | DESK-WILSON12 (olivia.wilson@contoso.example) | Last check-in 38 days ago | Devices |
Accept risk |
| low | LAPTOP-MARSH (bobby.marsh@contoso.example) | Last check-in 45 days ago | Devices |
Accept risk |
| low | Tenant | Guests can invite other guests | Guests |
Accept risk |
| low | DESK-RECEPTION | Hybrid joined, not managed by Intune | Devices |
Accept risk |
| low | contoso.example | No MTA-STS policy, so mail sent to this domain can be forced onto an unencrypted connection |
Accept risk |
|
| low | rhys.evans@contoso.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | sophie.taylor@contoso.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | william.allen@contoso.example | Second factor is only Mobile phone (SMS or call) | Identity |
Accept risk |
| low | Organisation | SMTP AUTH is allowed |
Accept risk |
|
| low | parked.example | Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing |
Accept risk |
|
| low | OLD-PC | Windows, last seen 200 days ago | Devices |
Accept risk |
| low | Microsoft 365 Business Basic | 2 of 6 unassigned | Licences |
Accept risk |
| low | Microsoft 365 Business Premium | 3 of 18 unassigned | Licences |
Accept risk |
Accepted risks 0
No accepted risks. When something is intentional, accept the risk from its row above and it moves here with the reason.
Latest collection 11 Oct 2026, 20:32 UTC. Severity, check and first-seen filters, sorting and hidden columns stay in the address, so a saved view or a download shows the same rows.