01
Identity & MFA gaps
Detect users, service accounts and break-glass admins without enforced MFA, weak conditional access, or stale sign-in risk.
Microsoft 365 Security
Stop Guessing What's Misconfigured in Microsoft 365.
Continuous scanning of identity, mail flow, sharing, and admin roles across your M365 tenant — mapped to compliance controls automatically.
Risk surface
Where M365 tenants break
02
Mail flow & phishing exposure
Surface missing SPF, DKIM and DMARC alignment, permissive transport rules and anti-phishing policy coverage gaps.
03
Over-shared files & sites
Find SharePoint sites and OneDrive files exposed via anonymous links, external guests, or company-wide sharing defaults.
04
Excess admin role assignments
Identify Global Admins, standing privileged roles and Entra ID assignments that violate least-privilege baselines.
Least privilege
Read-only, least-privilege by design
The M365 misconfiguration scanner requests only the Microsoft Graph API permissions required for read-only security assessment — directory, policy, audit and configuration scopes. It never requests access to mail content, calendar bodies, Teams messages or file contents. Every permission granted is auditable in Entra ID and revocable in one click.
Dashboard
M365 compliance dashboard
app.alexocloud.ai / tenants / contoso / m365
Tenant risk score
72
/ 100 · High risk
Open findings · 6
| Severity | Finding | Scope |
|---|---|---|
| CRITICAL | Global Administrator without MFA | Entra ID · 3 users |
| HIGH | SharePoint site shared via anonymous link | SPO · FinanceOps |
| HIGH | DMARC policy set to none | Exchange Online |
| MEDIUM | Legacy authentication protocol enabled | Entra ID |
| MEDIUM | Guest users with directory read access | Entra ID · 47 guests |
| LOW | Audit log retention below 180 days | Purview |
Compliance
M365 findings map directly to these frameworks.
GDPR
SOC2
ISO 27001
MAS TRM
HIPAA