How much does a Microsoft 365 security review cost in the UK?
What a Microsoft 365 security review costs a UK small business, what drives the price, the difference between a report and a fix, and what to check in a quote.
The cost of a Microsoft 365 security review for a UK small business comes down to one thing: whether you’re buying a report or the work. A report-only review is usually a day or two of consultant time; a review that also fixes what it finds takes longer, because the changes have to be rolled out carefully. Our own fixed-price Microsoft 365 MOT, which tests and fixes your tenant, is £1,800 for a typical 10-user organisation.
Few UK providers publish a price for this, which makes it hard to know whether a quote is fair. So here’s how the cost breaks down and what to check before you pay for one.
A report, or the fixes as well
Most of the difference in price comes down to one question: does the review stop at telling you what’s wrong?
| Report only | Review and fix | |
|---|---|---|
| What you get | A list of findings and recommendations | The findings, plus the settings changed and tested |
| Who does the work | You, or your IT provider, afterwards | The reviewer |
| Typical effort for 10 to 25 users | A day or two | One to two weeks, mostly careful rollout |
| Risk | Findings sit in a PDF and never get done | Changes need managing so nobody is locked out |
A report on its own is cheaper, but only useful if someone in the business has the time and knowledge to act on it. For most small businesses, that’s the part that never happens.
What drives the price
- Number of users and devices. More accounts means more MFA registrations to chase and more laptops to enrol.
- Your licence. Business Basic and Standard have fewer security settings to configure than Business Premium, so there’s less to do, but also less protection to switch on.
- How old the setup is. Tenants created before late 2019 often have Security Defaults off and legacy sign-in still allowed. Older scanners and apps that rely on it need sorting out first.
- Email set-up. If SPF, DKIM and DMARC aren’t in place, every service that sends email for you needs identifying and adding.
- Regulation. Law firms, IFAs and mortgage brokers usually need a written record they can show the SRA, FCA or ICO, which adds documentation time.
What a review should cover
Whatever you pay, a Microsoft 365 security review should look at these. If a quote doesn’t mention them, ask why.
- MFA on every account, not just admins
- Admin accounts: how many, who has them, and whether they’re separate from day-to-day accounts
- Legacy sign-in methods that bypass MFA
- Email authentication: SPF, DKIM and DMARC
- Anti-phishing, Safe Links and Safe Attachments settings
- External sharing in SharePoint and OneDrive, and automatic mail forwarding
- Which devices can reach company data
- Third-party apps users have granted access to
- Backup of mail, OneDrive and SharePoint
- Microsoft Secure Score, before and after
Our Microsoft 365 security checklist explains each of these in plain English if you want to check your own tenant first.
What to check in a quote
- Is the price fixed, or a day rate with an estimate? A day rate can grow once the reviewer finds legacy problems.
- Does it include the fixes, or only the report?
- Will you get a written record of what was found and changed? You’ll want it for insurers, customers and Cyber Essentials.
- How will changes be rolled out? “We’ll turn on MFA on Friday afternoon” is a warning sign.
- What happens afterwards? Settings drift as people join and leave. Ask what ongoing support costs, if any.
Hiring someone instead
The median UK salary for a security administrator was £50,000 in the six months to October 2026, according to IT Jobs Watch, before National Insurance, pension and recruitment costs. For a business of ten to fifty people, that’s hard to justify for a job that, once the setup is right, needs a few hours a month.
What we charge
We publish our prices because we think you should be able to compare:
| What’s included | Price | |
|---|---|---|
| The MOT | Full test of your Microsoft 365, protections set up ready to switch on, email authentication fixed, written report | £1,800 one-off |
| MOT and service plan | Everything in the MOT switched on and enforced, continuous checks, drift fixed by us, devices and security keys set up, two support cases a month, monthly reports | £1,800 + £200 a month |
| MOT and full cover | Everything in the service plan, plus 24/7 monitoring, unlimited incident response, staff phishing training and audit-ready reports | £1,800 + £750 a month |
Prices are for a typical 10-user organisation; monthly tiers are on a 12-month term. Larger organisations get a fixed quote after a 30-minute call.
Frequently asked questions
How much does a Microsoft 365 security review cost for a small business?
It depends mostly on whether you want a report or the fixes as well. A review that only reports findings is usually a day or two of consultant time. A review that also puts the controls in place takes longer, because the work is in rolling changes out without locking people out. &DEV's fixed-price Microsoft 365 MOT, which tests and fixes your tenant, is £1,800 for a typical 10-user organisation.
What should a Microsoft 365 security review cover?
At minimum: multi-factor authentication for every account, admin accounts, legacy sign-in, email authentication (SPF, DKIM and DMARC), anti-phishing settings, external sharing and forwarding, device management, and Microsoft Secure Score. You should get a written record of what was found and what was changed.
Is it cheaper to hire someone to look after Microsoft 365 security?
Rarely, for a small business. The median UK security administrator salary was £50,000 in the six months to October 2026, according to IT Jobs Watch, before employer costs. A fixed-price review plus a monthly managed service usually costs a fraction of that, and doesn't leave you dependent on one person.
Do I need Microsoft 365 Business Premium for a security review?
No, a review works on any plan and will tell you what your plan can and can't do. But most of the stronger protections, such as Conditional Access, Intune device management and Defender, come with Business Premium, so a review often recommends the upgrade for firms handling sensitive data.
How long does a Microsoft 365 security review take?
For a small business, the assessment itself takes a day or two. Putting the fixes in place usually takes one to two weeks, because changes like MFA and blocking old sign-in methods are rolled out gradually so nobody is locked out.
Related posts
How do I make sure Microsoft 365 is secure?
A plain-English Microsoft 365 security checklist for UK small businesses: the ten settings that stop most attacks, which licence you need, and how to check you've got them right.
What is cyber assurance, and does a small business need it?
Cyber Essentials, Cyber Essentials Plus, IASME Cyber Assurance and ISO 27001 compared for UK small businesses: what each one proves, what it costs, and which one your customer is actually asking for.
Nobody runs a business to think about cyber security
A small-business view of Cyber Essentials - what it actually costs, why a customer is probably about to ask you for it, and how to get certified without losing your weekends.