Skip to content

Free check · about two minutes

How secure is your Microsoft 365?

Twelve questions about how your Microsoft 365 is set up. Answer yes, no or not sure. You get a score straight away and a list of what to fix first. Nothing is sent anywhere: the check runs in your browser and we don't ask for your email.

Question 1

1 of 12 · Sign-in

Does every account, including admins and shared mailboxes people sign in to, need multi-factor authentication (MFA)?

Question 2

2 of 12 · Sign-in

Have you blocked legacy authentication, the older sign-in methods some email apps use that skip MFA?

Question 3

3 of 12 · Admin accounts

Are admin accounts separate from the accounts people use for everyday email and browsing?

Question 4

4 of 12 · Admin accounts

Do your admins sign in with a passkey or hardware security key rather than a code or app prompt?

Question 5

5 of 12 · Email

Is DMARC for your email domain set to quarantine or reject, with SPF and DKIM in place?

Question 6

6 of 12 · Email

Is automatic forwarding of email to outside addresses blocked?

Question 7

7 of 12 · Email

Are Safe Links and Safe Attachments switched on, if your licence includes them?

Question 8

8 of 12 · Devices

Can only company-managed laptops and phones open company email and files?

Question 9

9 of 12 · Devices

Are critical security updates installed on every device within 14 days?

Question 10

10 of 12 · Accounts

Are leavers' accounts blocked on their last day, and old accounts nobody uses removed?

Question 11

11 of 12 · Monitoring

Does someone review risky sign-ins and changes to your Microsoft 365 settings, at least weekly?

Question 12

12 of 12 · Monitoring

Do you know your Microsoft Secure Score, and has it gone up in the last six months?

Questions about the check

How do I check if my Microsoft 365 is secure?

Start with the basics: MFA on every account, legacy authentication blocked, separate admin accounts, DMARC enforced, external forwarding blocked and only managed devices allowed. This check walks through twelve of them. For a definitive answer, someone needs to look at your actual settings, which is what the Microsoft 365 MOT does.

Is this check free?

Yes. It runs in your browser, nothing you answer is sent to us, and there's no sign-up.

What's the difference between this check and the Microsoft 365 MOT?

This check relies on your answers. The MOT tests the settings in your tenant directly, grades every finding dangerous, major, minor or advisory, and fixes what fails, for £1,800 for a typical 10-user organisation.