Microsoft 365 Security Assessment

Reduce Your Microsoft 365 Attack Surface

More than a million organizations around the world rely on Microsoft 365 for enhanced productivity and collaboration via the cloud. However, this popularity has resulted in a sharp rise in business email compromise (BEC) attacks on M365 estates, alongside other associated security threats. Ineffective implementation and management of M365 could put your organization at significant risk. Fortify your defenses with a Microsoft 365 security assessment delivered by Kroll experts.

Whether it is strengthening your M365 email or configuration, our assessments uncover weaknesses and identify proactive steps your organization can take to get the best from Microsoft 365 without compromising your security. Kroll specialists work extensively within the M365 environment every day and are cross-trained in incident response, penetration testing and risk assessments. Our Microsoft 365 security assessments are directly informed by insights gained through our status as the world’s No. 1 incident response provider and our experience of investigating Microsoft 365 security incidents of all sizes, types and complexities. Kroll’s continuously updated M365 security knowledge ensures that your assessment is closely aligned with the dynamic Microsoft environment and the constantly evolving threat landscape.

Our security assessments are carefully scoped and structured to secure the entire M365 suite, including Entra ID, Teams, SharePoint, OneDrive and Intune. The assessments will cover key elements of your M365 estate, including access control, identity management, and encryption, as well as third-party IAM solutions, such as Okta, Duo, OneLogin and email security gateways, such as Mimecast and Proofpoint.

Microsoft 365 Security Assessment Features

Proactively strengthen your organization’s M365 email and collaboration security defenses with Kroll’s unique frontline insight. The Kroll methodology focuses on M365 security hardening aimed at improving your organization’s resilience against the cyber kill chain, including identity and access management practices, messaging and collaboration advance threat protection, workstation defenses and conditional access policies.

Kroll experts deliver a prioritized set of specific remediation recommendations to establish a secure email and cloud configuration baseline for your organization. This involves remotely reviewing your M365 configuration and security defenses to identify proactive measures and controls that will reduce the likelihood of cloud- and email-based attacks. The assessment includes a review of one M365 asset and focuses on the baseline configuration and security hardening for each service, including:

• Entra ID security settings to restrict unauthorized access
• Exchange Online (Messaging) secure configurations
• SharePoint and OneDrive secure configurations
• Microsoft Teams
• Endpoint Manager/Intune secure configurations
• M365, Azure Active Directory, and Security License review and assignments
• Activity logging, alerting and auditing configurations

When Implemented: Third-party integrated IAM and Email Security Service hardening best practices, Email Security Services (e.g., Proofpoint, Mimecast, etc.) and IAM services (e.g., Okta, Duo Security)

Kroll will also conduct interviews to assess your cloud environment’s use-case and secondary defensive measures and practices to protect your organization against cloud- and email-based threats, including but not limited to:

• Endpoint security
• User security awareness and training
• Incident response
• Backup and recovery
• Business processes related to email authorization of payments

Kroll experts will deliver actionable insights and next steps through two reports:

Executive Summary Report – A summary report outlining the project's scope, any critical risks identified, and insight into how your configuration aligns with benchmarks and best practices from Microsoft and the Center for Internet Security

Technical Details Report – A prioritized set of specific remediation recommendations to advance how you manage your email security program. This includes a detailed technical report to support technology teams with tactical remediation recommendations, covering identified weaknesses, implementation priority and implementation guidance.