Cloud Security Assessment – Hybrid AD, M365, and Azure

Assessment Scope

Every organization uses a different combination of Microsoft technologies. The assessment focuses on the Microsoft environment currently in use and reviews only relevant components.

Examples include:

• Active Directory & Hybrid Identity
  
• Microsoft 365
  
• Exchange Online
  
• Teams & SharePoint
  
• Microsoft Intune
  
• Microsoft Defender
  
• Copilot & Purview
  
• Azure Services & Resources
  

Identity & Access Assessment

User identities remain one of the most frequently targeted areas in cyberattacks. A review of authentication methods, privileged accounts, and access controls helps identify weaknesses that could allow unauthorized access to company resources. The assessment focuses on reducing identity-related risks while maintaining productivity and usability.

Areas reviewed:

• Multi-Factor Authentication (MFA)
  
• Conditional Access Policies
  
• Passwordless Authentication
  
• Administrative Accounts
  
• Emergency Access Accounts
  
• Least Privilege Configuration
  
• Risk-Based Sign-In Protection
  
• Entra ID Identity Protection
  
• Sign-In Monitoring
  

Email Security Assessment

Email remains a primary entry point for phishing, malware, ransomware, and business email compromise attacks. The assessment reviews security controls in Exchange Online and Microsoft Defender to verify that incoming and outgoing email is adequately protected. Existing configurations are checked against Microsoft security recommendations and operational requirements.

Areas reviewed:

• Microsoft Defender for Office 365
  
• Exchange Online Protection Configuration
  
• Anti-Phishing, Anti-Spam and Anti-Malware Policies
  
• Safe Links and Safe Attachments Policies
  
• Email Sent Security (SPF, DKIM, DMARC)
  
• DNS and Mail Flow Security
  

Teams, SharePoint & OneDrive Assessment

Collaboration platforms often contain large amounts of business-critical and sensitive information. Permissions, sharing settings, and guest access policies are reviewed to ensure that information is accessible only to the appropriate users. The assessment helps reduce the risk of accidental data exposure.

Areas reviewed:

• External Sharing Configuration
  
• Guest Access Controls
  
• Teams Security Settings
  
• SharePoint Security Settings
  
• OneDrive Security Settings
  
• Anonymous Sharing Links
  
• Access Permissions
  
• File and Folder Sharing
  
• Collaboration Controls
  

Endpoint Security Assessment

Modern workplaces depend on laptops, smartphones, tablets, and other connected devices. Devices are often the first target in many attack scenarios and should be managed consistently regardless of location. The assessment reviews endpoint management, compliance policies, and security controls used to protect company devices.

Areas reviewed:

• Microsoft Intune Configuration
  
• Device Compliance Policies
  
• Security Baselines
  
• Microsoft Defender for Endpoint
  
• Application Vulnerabilities and Protection Policies
  
• Update Management
  
• BitLocker Deployment
  

Azure Security Assessment

Azure resources require ongoing review to ensure they remain secure as services and workloads evolve. The assessment examines cloud resources, storage, networking, and application services to identify unnecessary exposure and configuration weaknesses. Particular attention is given to publicly accessible services and privileged access.

Areas reviewed:

• Azure Subscriptions
  
• Virtual Machines
  
• Public IP Exposure
  
• Storage Accounts
  
• App Services
  
• Function Apps
  
• Network Security Groups
  
• Azure Security Recommendations
  
• Privileged Access Configuration
  
• Backup and Restore
  

Copilot Security Assessment

Organizations using Microsoft 365 Copilot should verify that existing permissions, data protection controls, and governance policies prevent unintended disclosure of business information. The assessment identifies areas where Copilot may expose content beyond the intended audience and recommends appropriate security controls.

Areas reviewed:

• Sensitivity Labels
  
• Data Loss Prevention (DLP)
  
• Role-Based Access Control (RBAC)
  
• Oversharing Risks
  
• SharePoint Permissions
  
• OneDrive Permissions
  
• Information Protection Policies
  
• Copilot Security Controls
  

Ransomware Protection Assessment

Ransomware remains one of the most disruptive threats facing organizations today. The assessment evaluates preventative controls, recovery capabilities, and measures that limit the spread of malicious activity.

The goal is to improve resilience and recovery readiness by developing an emergency plan.

Areas reviewed:

• Prepare the recovery plan
  
• Critical Business Applications
  
• Restore Permissions and Recovery Duration
  
• Limiting the Impact of an Attack
  
• Preventing Unauthorized Access
  
• Backup & Recovery Strategy
  
• Business Continuity Measures
  

Security Reporting & Secure Score Review

Microsoft provides a wide range of reporting and assessment tools that can assist in measuring and improving security posture. The assessment reviews current security scores, reporting capabilities, and audit functionality to identify improvement opportunities and prioritize remediation efforts.

Areas reviewed:

• Microsoft Secure Score
  
• Identity Security Score
  
• Microsoft Defender Recommendations
  
• Compliance Recommendations
  
• Audit Logging
  
• Audit Search
  
• Security Reporting
  
• Alert Configuration
  
• Risk Prioritization
  

Microsoft 365 Backup Assessment

Backup and recovery capabilities are reviewed to determine whether business-critical data can be restored when required. The assessment examines backup readiness, retention requirements, and recovery processes across Microsoft 365 workloads. The objective is to support business continuity and reduce the impact of data loss events.

Areas reviewed:

• Microsoft 365 Backup
  
• Recovery Procedures
  
• Retention Requirements
  
• Restore Testing
  
• Business Continuity Planning
  
• Backup Monitoring
  
• Recovery Objectives
  
• Backup Readiness Assessment
  

Assessment Deliverables

Following the assessment, findings are documented and prioritized according to risk and business impact. The final report provides practical recommendations that can be implemented internally or supported by our consultants. The objective is to provide a clear roadmap for improving security within Microsoft 365 and Azure.

Deliverables with instructions for remediation:

Results and Recommendations:


• Executive Summary with Risk Assessment
  
• Detailed Findings Report
  
• Risk Classification (Critical, High, Medium, Low, Informational)
  
• Prioritized Recommendations
  
• Estimated Implementation Effort
  
• Quick Wins
  
• Implementation Roadmap
  
• Optional Remediation Support
  

If critical issues are detected, the IT team is contacted immediately so that they can be resolved promptly.