BEARCLAVE

Hardening M365 and Azure

A security analysis of the configuration shows where the environment stands, what is exposed to the outside and what is merely unfinished. You get the findings ordered by what to deal with first.

Price

from 60,000 CZK

Output

within 3 weeks of getting access

Impact on operations

none for the analysis, read access only

Book an intro call What the analysis covers

Scope of the analysis

What the analysis covers

Eight areas, always the same. That is exactly why the analysis can be bought at a fixed price without negotiating the scope.

Privileged accounts and rolesWho holds permanent administrator rights, whether roles are time-bound, how break-glass accounts are handled and who approves access.
Conditional AccessPolicy coverage, exceptions that were forgotten, policies left in report-only mode and the routes by which a rule can be bypassed.
User authenticationWhich methods are allowed, what share of users has a phishing-resistant method, whether legacy protocols are blocked and how password recovery works.
Devices and their managementCompliance policies, attack surface reduction rules, disk encryption and devices that check in but nobody manages.
E-mail and collaboration protectionSettings against phishing and malicious attachments, outbound forwarding rules, external sharing in SharePoint and Teams and guest users.
Azure and its configurationWhich protection plans are switched on, publicly reachable endpoints, network rules, resource locks and diagnostic settings.
Applications and granted consentsRegistered applications with excessive permissions, secrets close to expiry and consents users granted themselves.
Logging and visibilityWhat is collected, how long it is kept, whether anyone actually reads it and what would be missing in an incident investigation.
What the analysis does not include

Penetration tests, assessment of your own applications, security outside the Microsoft stack and organisational measures such as policies and roles. Finishing the configuration is separate follow-on work.

Inputs

What we need from you

  • An account in your environment — either a guest invited into your tenant, or one you create in it. One is enough, it has read access only and you remove it at handover.
  • Read access over the tenant including access policies and the security portals.
  • Read access over Azure from the top level, so that everything is covered at once.
  • A note on what must not break — legacy applications, service accounts, shared mailboxes.
  • A contact for whoever may approve changes that restrict users.

How we treat your environment and data →

Deliverables

What you get

  • Findings with a priority and a distinction between what is exposed to the outside and what is merely unfinished.
  • Recommendations tied to a specific setting, not to general principles.
  • A priority and an effort estimate for every finding, so that it is possible to decide what comes first.
  • A score and an assessment in context — a comparable figure for the board and a judgement that takes your environment into account.
  • A PDF report and a simple summary for the board.
  • A handover record with the list of open points.
Download a sample deliverablePDF in Czech, based on an anonymised environment

How it runs

How it runs

Intro call

Thirty minutes. We get to know each other and go through the size of the environment, the licences you have bought and whether you run hybrid identity.

Access

The account and named roles, always read-only. Your administrator arranges it.

Analysis

Configuration is collected with our own tooling and assessed. No impact on operations.

Handover

A presentation of the findings and a decision on which of them will be addressed.

Frequent questions

What people ask most often

Our score is above 80 %. Is this not pointless?
The score on its own is misleading. An environment at eighty per cent can be more exposed than one at sixty, if the missing twenty happens to be the part that matters. The score is also only comparable within the same licence set.
Will it disrupt users' work?
The analysis will not, it works with read access only. Finishing the configuration goes in batches and you approve each of them in advance. Changes that restrict users need your approver.
We have Microsoft 365 Business Premium, not E5. Does it make sense?
Yes, only the range of recommendations differs. Some tooling is not in Business Premium — identity protection at the Entra ID P2 level, for instance, or the advanced Defender features. This is stated on the first call, so that nothing gets recommended that you would have to buy.
Someone has already done a similar analysis for us.
Then we want to see its output. Nobody pays twice for the same thing, and building on existing findings is cheaper than starting again.
Is this the same as the Cybersecurity Act compliance analysis?
No. This one measures against security practice, the other one against regulation. Most companies need both, and the data collection is shared, so they can be combined.

Related

What it leads on to

NIS2 and DORA — compliance of the Microsoft environmentThe same data collection, a different yardstick. Often ordered together. M365 and Azure architectureFor when the analysis shows the problem is not in the configuration but in the foundation.

Half an hour and you know whether it makes sense

Which licences you have bought and a rough size of the environment are enough. The rest comes out of the analysis.

Book an intro call Back to the services