Grade
Contoso Legal LLP is a D because of Admin accounts, Sign-in and accounts, Mail, Devices and Sharing and apps: 1 admin not covered by MFA. Fix 13 checks in Admin accounts, Sign-in and accounts, Mail, Devices and Sharing and apps and Contoso Legal LLP is a C.
| Part | Today | What moves it | Part grade |
|---|---|---|---|
| Admin accounts 8 of 8 checks ran |
high 1 admin not covered by MFA. high 1 guest with admin roles. high 1 domain had sign-in settings changed in the last 30 days. and 2 more checks
|
Fix 3 checks at high and it's a C: Every admin is covered by an MFA policy; No guests hold admin roles; No unexpected changes to how domains sign in. | Grade D |
| Sign-in and accounts 8 of 9 checks ran |
high 2 accounts at risk in Entra ID Protection, 1 high or confirmed compromised. high 2 high or medium severity alerts open in Defender, 1 not picked up. medium 5 accounts inactive for 90+ days or never used. and 4 more checks
|
Fix 2 checks at high and it's a C: No accounts are at risk in Entra ID Protection; No high or medium severity Defender alerts are left open. | Grade D |
| Mail 16 of 17 checks ran |
high 3 external forwards. high 1 suspicious inbox rule. medium 2 domains without DMARC enforcement. and 5 more checks
|
Fix 2 checks at high and it's a C: No mail is forwarded outside the organisation; No inbox rules hide mail. | Grade D |
| Devices 9 of 9 checks ran |
high 11 of 19 Windows computers past end of support. high 2 of 19 computers not encrypted. medium 3 of 20 managed devices not compliant. and 6 more checks
|
Fix 2 checks at high and it's a C: Windows computers still get security updates; Company computers are encrypted. | Grade D |
| Sharing and apps 17 of 19 checks ran |
high 1 site with no owner, 2 sites with one owner. high 3 files and folders shared with anyone. high 1 guest with full control of 1 site. and 9 more checks
|
Fix 4 checks at high and it's a C: Every site has at least two owners; No files are shared with anyone links; Guests don't have full control of sites; Third-party apps hold only the access they need. | Grade D |
| Grade | The worst part: Admin accounts and Sign-in and accounts and Mail and Devices and Sharing and apps. | Fix 13 checks in Admin accounts, Sign-in and accounts, Mail, Devices and Sharing and apps and Contoso Legal LLP is a C. | Grade D |
A critical finding makes a part an E, a high finding a D, a medium a C, only low findings a B, and no open finding an A. Accepted risks and info findings don't count.
Twelve months of grades
The grade on each month-end, from the findings open then, with this month so far at the end. Unchanged since September. Months before the first collection aren't graded.
Compared with your other clients
| Figure | This client | Median | Standing |
|---|---|---|---|
| Grade | Grade D | Grade E | Better |
| Secure Score | 68% | 40.2% | Better |
| Users with MFA | 82.6% | 55.2% | Better |
| Open critical and high findings | 18 | 29 | Better |
| Licence waste per user, a month | £5.75 | £3.20 | Worse |
A better grade than 2 of the 2 with one. Only the clients you can see, as last worked out; none of them is named.
The rules
- Five parts. The checks are grouped into Admin accounts, Sign-in and accounts, Mail, Devices, and Sharing and apps. Checks about cost, capacity and housekeeping don't count.
- A part is its worst open finding. A critical finding makes it an E, a high finding a D, a medium a C, only low findings a B, and a part whose every check passed is an A. Accepted risks are set aside first, and info findings are notes, not problems.
- A part needs half its checks. It's only graded when at least half its checks could run (no Intune, no Entra ID P1, nothing collected yet); otherwise it says why, and the grade comes from the parts that were.
- The grade is the worst part. One critical gap keeps a client out of A and B. Fix the checks at a part's worst level and it takes its next grade.
- History is the grade on each month-end for the last twelve months, from the findings open then (first seen by then, not fixed, not an accepted risk), with each finding's current level and the parts graded today.
- The comparison sets a client beside the others of about the same size by licensed users, or every other client when fewer than 2 are that size: the median grade and figures, and how many it is better than. No client is named, and nothing leaves this install.
What each part checks
Admin accounts 8 checks
Who holds admin roles: whether every admin has MFA registered, uses a phishing-resistant method and is covered by a policy that requires MFA, how many Global Administrators there are, guests and apps with admin roles, whether admins are cloud-only, and changes to how domains sign in.
- Every admin has MFA registered
- Every admin is covered by an MFA policy
- Admins use phishing-resistant sign-in methods
- Between 2 and 4 Global Administrators
- No guests hold admin roles
- Apps with admin roles are reviewed
- Admin accounts are cloud-only
- No unexpected changes to how domains sign in
Sign-in and accounts 9 checks
Everyone else's sign-in: whether MFA is enforced and registered, legacy sign-in methods, text or call as the only second factor, risky sign-ins and at-risk accounts, inactive accounts, password hash sync, and open Defender alerts.
- MFA is enforced for all users
- Every active user has MFA registered
- Legacy authentication is blocked
- Nobody relies on a text or call as their only second factor
- No risky sign-ins succeeded
- No accounts are at risk in Entra ID Protection
- No inactive accounts
- Password hash sync is on
- No high or medium severity Defender alerts are left open
Mail 17 checks
Forwarding outside the organisation and inbox rules that hide mail, mail flow rules, spam, spoof and malware filtering, the audit log and mailbox auditing, SMTP AUTH, shared mailbox sign-in, and each domain's SPF, DKIM, DMARC, MTA-STS and TLS-RPT.
- No mail is forwarded outside the organisation
- No inbox rules hide mail
- Automatic forwarding to outside addresses is off
- Shared mailboxes can't be signed in to
- The Microsoft 365 audit log is on
- Mailbox auditing is on
- SMTP AUTH is turned off
- No mail flow rule lets mail skip spam filtering
- No mail flow rule sends mail outside the organisation
- No sender domains are allowed past the spam filter
- Spoof protection is on
- Risky attachment types are blocked
- Every domain has a working SPF record
- DKIM signing is on for every mail domain
- Every domain enforces DMARC
- Mail domains require encrypted delivery (MTA-STS)
- Encrypted delivery failures are reported (TLS-RPT)
Devices 9 checks
Intune enrolment, compliance policies and whether devices meet them, encryption and saved BitLocker keys, Windows versions still getting updates, devices checking in, old devices left in Entra ID, and LAPS.
- Managed devices meet compliance policies
- Company computers are encrypted
- Windows computers still get security updates
- Joined computers are managed by Intune
- Managed devices check in with Intune
- No old devices left in Entra ID
- Windows computers have their BitLocker recovery key saved
- Windows computers back up their local admin password with LAPS
- Every platform in use has a compliance policy
Sharing and apps 19 checks
Anyone links and sharing outside the organisation, site owners and guests with full control, who can invite guests and create groups, ownerless groups and group expiry, what users may do with apps and registrations, and third-party apps' permissions and credentials.
- No files are shared with anyone links
- Every site has at least two owners
- Guests don't have full control of sites
- People outside can only view shared files
- Files can't be shared with anonymous links
- Only admins and members can invite guests
- No old, unaccepted guest invitations
- No guest owns a team or group
- Every team and Microsoft 365 group has an owner
- Only chosen people can create teams and groups
- Unused groups and teams expire
- Guests have limited directory access
- People can't join the tenant just by verifying an email address
- Users can't create new tenants
- Users can't register apps
- Users have a way to get apps approved
- Users can't consent to apps on their own
- Third-party apps hold only the access they need
- App secrets and certificates are current
Doesn't count 9 checks
Cost, capacity and housekeeping say nothing about how exposed a client is. These stay on the Findings tab and in the monthly review.
- No account reports to a blocked manager
- Directory sync is running
- Every licence assignment works
- No licences on disabled accounts
- No mailbox is nearly full
- No OneDrive is nearly full
- SharePoint storage isn't nearly full
- No subscriptions are about to lapse
- No paid licences sit unassigned