Most breaches now start in Microsoft 365: a stolen sign-in, a quiet inbox rule, an over-permissioned app. ThreeShield reviews your whole tenant — identity, email, sharing, logging, and recovery — tells you in plain language what is exposed and what to fix first, and can watch it continuously through Lavawall®. Independent of your MSP and internal IT.
Your tenant holds email, files, identities, and the keys to almost everything else. Attackers know it. A phishing page steals a signed-in session, slips past MFA, hides a forwarding rule, and starts invoicing your customers from your own domain. The defences that stop this are configuration choices — and most tenants were set up for convenience, not for an attacker.
MFA coverage and strength, Conditional Access policies, legacy authentication still left open, and risky or dormant sign-ins in Entra ID.
Who holds Global Admin and other high roles, whether privilege is least-privilege and time-bound, and whether break-glass accounts exist and are protected.
The third-party and internal apps users have granted access to your data — a common and overlooked path to mailbox and file theft.
Your DNS and domain records — SPF, DKIM, and DMARC — set so your legitimate mail reaches inboxes instead of a prospect's or client's junk folder and no one can spoof your domain, plus anti-phishing and safe-links policies and the forwarding and transport rules attackers use to quietly exfiltrate mail.
External and anonymous sharing, guest access, and links that quietly expose sensitive files far beyond who should see them.
Whether the audit log is on and retained long enough to investigate, whether alerts fire on the right events, and whether you can actually recover mail and files.
We comb the sign-in, mailbox, and admin logs for signs of a compromise that already happened. Because Microsoft keeps the Purview audit log only about 90 to 180 days by default, we reach past that window wherever longer history exists — Lavawall® retained logs, message traces, and backups — so an intrusion from months ago does not stay hidden.
Who is downloading, externally sharing, or mass-exporting from SharePoint and OneDrive — the pattern that catches a departing employee taking data, or ransomware encrypting a share.
Whether changes to Conditional Access, admin roles, app registrations, and OAuth grants are captured and reversible, so a risky change is caught and can be rolled back rather than discovered months later.
The unsanctioned apps and AI tools your staff have signed up for, surfaced from Microsoft 365 sign-up and consent signals, so sensitive data is not quietly walking into an unvetted tool.
Whoever set up and runs your tenant cannot objectively grade their own configuration. ThreeShield reviews it at arm's length, so a board, an insurer, an auditor, or a client gets an honest second opinion. We are glad to work with your provider to close the gaps we find.
| Area | What we check against | What you receive |
|---|---|---|
| Identity & access | MFA, Conditional Access, least-privilege admin | Prioritized findings with the exact settings to change |
| Email & data | SPF/DKIM/DMARC, sharing, forwarding rules | A fix-first list your admin or ours can action |
| Benchmark & compliance | CIS Microsoft 365 Foundations Benchmark | A mapping you can hand an auditor or insurer |
| Ongoing | Lavawall® continuous monitoring | Optional watch on the tenant so drift is caught early |
An assessment tells you where you stand today. Because ThreeShield builds and runs Lavawall®, we can keep watching afterward — risky sign-ins, new OAuth grants, MFA method changes, new inbox rules, and tenant configuration drift — so the tenant does not quietly slide back out of shape between reviews.
Also on Google Workspace? See our Google Workspace security assessment, or fold both into a full cybersecurity audit.
Most assessments end with a PDF and a handshake. We can leave you set up in Lavawall® (the same GRC, Microsoft 365 monitoring, and external scanning we build ourselves) so you, or the MSP who referred you, can watch the fixes land and catch the next problem without waiting for the next review.
Track each finding through to closed, with the evidence recorded as you go, instead of taking our word for it.
Risky sign-ins, new app grants, MFA changes, and configuration drift keep surfacing after we leave, not just on assessment day.
Access is tenant-scoped and least-privilege, you decide who has it, and Lavawall® is month-to-month with no lock-in.
The assessment tells you where you stand. The tools tell you whether you are staying there.
If you run an MSP, there are two ways to bring us in, and we are glad to do either.
| Model | How it works | Best when |
|---|---|---|
| Arm's-length | We run the assessment and hand you an independent, ThreeShield-attributed report to give your client. | Your client, their board, or their insurer wants an outside opinion that carries weight. |
| White-label subcontract | We deliver as your Tier 3, under your brand, so you can offer Microsoft 365 assessments without hiring a CISSP/CISA team. | You want to widen your menu and own the client relationship end to end. |
One honest line on independence: where a client needs a genuinely independent opinion of IT that you manage, we keep the attribution clear about who did the work. An assessment cannot be both white-labelled by the team that runs the systems and independent of it. Either way, our rules of engagement are written down, and we never go around a partner to their client.
MSP or agency? See the referral and white-label options for partners, laid out from your side of the table.
It is a structured review of how your Microsoft 365 tenant is configured and defended: identity and Conditional Access, admin roles, the third-party apps users have consented to, email security, how files are shared in SharePoint and OneDrive, what is being logged, and whether you can recover data. You get a prioritized report of what is exposed and exactly what to change first.
The review itself runs on read-only access — a reader or auditor role, or a delegated look at your settings alongside your admin — and we never need to see user passwords. There is one exception at setup: connecting the tenant to Lavawall® for the assessment needs a Global Administrator to approve it once, a standard admin-consent step, after which nothing we do can change your tenant. We tell you exactly what we need and why before you grant anything.
Secure Score is a useful automated number, but it weights every recommendation the same and misses context. A ThreeShield assessment is done by a person who knows how M365 tenants actually get breached — token theft, malicious inbox rules, risky OAuth consents, oversharing — and tells you which few changes remove the most real risk for your organization, not just which toggles raise a score.
No. The review reads configuration and logs; it does not change your tenant or interrupt mail. If you ask us to remediate afterward, every change is planned with you and made in a controlled way, starting with the ones that carry no user impact.
Yes. We map findings to the CIS Microsoft 365 Foundations Benchmark and to the controls behind SOC 2, HIPAA, and cyber-insurance questionnaires — MFA everywhere, least-privilege admin, logging and retention, and email authentication. You get evidence you can hand an auditor or insurer.
Yes. ThreeShield reviews the tenant at arm's length from whoever manages it, so the findings are an honest second opinion. We are glad to work with your MSP to fix what we find, but we report to you.
You get the report and a walkthrough. From there you can fix the findings yourself, have us remediate them, or turn on Lavawall® to watch the tenant continuously — risky sign-ins, new OAuth grants, MFA changes, inbox rules, and configuration drift — so new problems surface as they happen instead of at the next review.
Yes. We can set you or your referring MSP up in Lavawall® (GRC, Microsoft 365 monitoring, and external scanning) so you keep watching progress after we leave. Access is tenant-scoped and least-privilege, you decide who has it, and it is month-to-month with no lock-in. You get continuous visibility and evidence, not a one-time snapshot.
Yes. MSPs can bring us in at arm's length for an independent, ThreeShield-attributed report, or white-label us as Tier 3 to offer Microsoft 365 assessments under your own brand. Where a client needs an independent opinion of IT you manage, we keep the attribution honest about who did the work. Our rules of engagement are public, and we never go around a partner.
Often, yes. Beyond checking configuration, we hunt the logs for the fingerprints of an account takeover: impossible-travel sign-ins, a mailbox rule quietly forwarding invoices, a new OAuth grant, or admin changes no one remembers making. Business email compromise usually leaves exactly these traces, and they are what we look for.
Yes. From Microsoft 365 sign-up and app-consent signals we surface the SaaS and AI tools staff have adopted on their own, so you can sanction, block, or govern them before sensitive data ends up in an unvetted model.
In Canada. The Lavawall® platform we use for the assessment is hosted in Canada, and data is kept against your own tenant rather than comingled with anyone else's. For Canadian organizations with data-residency obligations, that matters.
We will scope a fixed-price Microsoft 365 assessment, run it independently of your IT team, and hand you a prioritized report you can act on and share — with the option to keep the tenant watched by Lavawall®.
Get an Assessment QuoteRead-only · Independent · CIS Benchmark-mapped