Findings and sequenced plan

Microsoft 365 and Entra ID as running today. Ranked by how easily an unused admin or a skipped MFA exception becomes an incident.

Scope we used

Entra ID, MFA registration, privileged roles, guest and stale accounts, Conditional Access, legacy authentication. No pentest. No full M365 backup review.

Priority findings (illustrative)

#	Finding	Why it matters	Fix this month
1	4 Global Administrators with standing access; 2 unused 90+ days	Blast radius if any credential is phished	Remove unused. Move the rest to PIM eligible
2	MFA not required for a named break-glass and 11 synced service accounts	Policy looks complete in the portal; it is not	Named exceptions list; CA for all users except documented break-glass
3	Legacy auth still permitted for IMAP	Bypasses MFA	Block legacy auth; migrate the two mailboxes that still need it
4	214 guest accounts; 61 with no sign-in in 180 days	Forgotten access into Teams and SharePoint	Disable stale guests; 90-day review
5	Conditional Access “report-only” on three high-risk policies	You think they are on. They are not enforcing	Enable after a 7-day report-only check

30-day remediation order

Standing Global Admin and PIM
MFA exceptions and legacy auth
Guest hygiene
Turn on the report-only CA policies that survive the week

Real reports use the customer’s tenant evidence. This page shows length and tone — not a score you can copy. Price: $1,500–$3,000. 50% to start.