Features — Kyvoi M365 Security Assessment | 93 Controls, 17 Frameworks

Security controls

93 controls. Every category of M365 security.

Every control is severity-weighted, mapped to specific framework clauses, and includes the exact remediation path in the Microsoft admin portal.

🔐

Identity & Access

25 controls

→ MFA per-user adoption % CRITICAL

→ Conditional Access policy count CRITICAL

→ Global Admin account count CRITICAL

→ PIM — Just-In-Time activation HIGH

→ Legacy authentication block HIGH

→ Password protection policy MED

6 of 25 shown · the full list is in your report

Every finding carries its ATT&CK technique · billed per user for this service

📧

Email Security

18 controls

→ DKIM — per-domain signing key CRITICAL

→ DMARC — p=quarantine/reject CRITICAL

→ SPF record validation HIGH

→ Anti-phishing — impersonation HIGH

→ Safe Links — URL detonation HIGH

→ Mailbox auditing enabled MED

6 of 18 shown · the full list is in your report

Every finding carries its ATT&CK technique · billed per user for this service

📊

Data Protection & Governance

9 controls

→ DLP policies — enforcing vs test mode HIGH

→ Sensitivity labels — published HIGH

→ Retention policies configured MED

→ Insider risk policies MED

→ Communication compliance MED

→ eDiscovery configuration MED

6 of 9 shown · the full list is in your report

Every finding carries its ATT&CK technique · billed per user for this service

💻

Device Security

8 controls

→ Device Compliance Policies HIGH

→ Attack Surface Reduction Rules HIGH

→ Defender for Endpoint Integration HIGH

→ Local Administrator Password Solution HIGH

→ Intune Device Enrollment MED

→ BitLocker Encryption MED

→ Mobile Application Management MED

→ Windows Autopilot MED

Every finding carries its ATT&CK technique · billed per user for this service

☁️

Governance & Audit

12 controls

→ Audit Log Retention Policy HIGH

→ Entra Diagnostic Settings HIGH

→ Unified Audit Log MED

→ User Sign-in Audit Retention MED

→ Privileged Access Management MED

→ Secure Score MED

→ Group Creation Restrictions MED

→ License Optimization MED

8 of 12 shown · the full list is in your report

Every finding carries its ATT&CK technique · billed per user for this service

🛡️

Threat Detection

6 controls

→ Security Alerts HIGH

→ Defender XDR Incident Management HIGH

→ Defender High-Severity Alerts HIGH

→ Defender for Identity Alerts HIGH

→ Microsoft Defender for Endpoint MED

→ Attack Simulation Training MED

Every finding carries its ATT&CK technique · billed per user for this service

🤖

Workload Identities

8 controls

→ High-impact application permissions HIGH

→ Service principals in privileged roles HIGH

→ User consent to applications HIGH

→ Orphaned app registrations MED

→ Long-lived client secrets MED

→ Unused app credentials MED

→ Dormant apps with standing access MED

→ Credentials on service principals MED

Every finding carries its ATT&CK technique · billed per user for this service

These seven services cover 86 of the 93 controls. The rest — SharePoint & OneDrive admin settings, Defender for Cloud Apps policies and the tenant-wide security contact setting — are assessed in a full scan and are not sold separately.

Every control, named

All 93 controls Kyvoi checks

Not a selection. Every control, grouped by the area of Microsoft 365 it covers, with what each one looks for. Each maps to the compliance clauses it affects across 17 frameworks.

Identity & Access

22 controls

Who can sign in, with what, and from where — the controls an attacker meets first.

MFA for All Users
Whether multi-factor authentication is enforced for everyone, not just admins.

Block Legacy Authentication
Whether older protocols that bypass MFA entirely are still permitted.

Conditional Access Policies
Whether access rules exist, and whether they leave gaps an attacker could use.

Self-Service Password Reset
Whether users can reset their own passwords securely, with verification.

Privileged Role Assignments
How many people hold Global Administrator permanently, rather than on request.

Guest User Restrictions
What people outside your organisation can see once invited in.

Password Protection
Whether Entra blocks weak and commonly guessed passwords.

User Risk Policy
Whether accounts showing signs of compromise are challenged automatically.

Sign-in Risk Policy
Whether unusual sign-ins — impossible travel, anonymous IPs — are blocked or challenged.

Authentication Methods Policy
Whether modern authentication methods are in use, or legacy per-user MFA lingers.

PIM Activation Policy
Whether activating a privileged role requires MFA and approval.

PIM Security Alerts
Open alerts for roles assigned outside PIM, or eligible assignments nobody uses.

Named Location Policies
Whether trusted locations are defined so access rules can use them.

B2B Collaboration Settings
Which external organisations can be invited to collaborate.

Break Glass Accounts
Whether emergency access accounts exist for a lockout, and are excluded correctly.

Hybrid Identity (Entra Connect)
Whether directory sync from on-premises is running and healthy.

Windows Hello for Business
Whether phishing-resistant sign-in is enforced through Intune.

App Registration Restrictions
Whether any user can register an application in your tenant.

Access Reviews
Whether privileged roles and groups are reviewed on a recurring schedule.

Authentication Session Controls
How long a session stays valid, and whether browsers stay signed in.

Cross-Tenant Access Settings
Which other Microsoft tenants your users and theirs can reach.

Entitlement Management
Whether access is granted through reviewable packages rather than ad hoc.

Email Security

18 controls

Where most intrusions begin, and where data most often leaves.

DKIM Signing
Whether outbound mail is signed so recipients can verify it came from you.

DMARC Policy
Whether a DMARC record exists, and whether it actually rejects spoofed mail.

SPF Record
Whether your domain publishes which servers may send on its behalf.

Anti-Phishing Policy
Whether impersonation protection is on for your users and domains.

Anti-Malware Policy
Whether risky attachment types are filtered before delivery.

Anti-Spam Policy
Whether inbound spam thresholds are tuned or left at permissive defaults.

Safe Links Policy
Whether links are checked at the moment someone clicks them, including in Office apps.

Safe Attachments Policy
Whether attachments are detonated in a sandbox before reaching the mailbox.

Mailbox Auditing
Whether mailbox actions are logged, including the ones not audited by default.

External Email Forwarding
Whether a compromised account can quietly forward mail outside the organisation.

Quarantine Policies
Whether users are told when their mail is quarantined, and can request release.

External Recipient MailTips
Whether users are warned before emailing someone outside the organisation.

Mail Flow Rules
Whether external mail is marked so recipients can see it came from outside.

SMTP Auth
Whether legacy SMTP authentication is still enabled tenant-wide.

Anti-Spoofing
Whether spoof intelligence is enabled and its allowed senders reviewed.

Tenant Allow/Block List
Whether allow entries have been left in place past their purpose.

External Forwarding Policy
Whether the tenant-level outbound policy blocks automatic forwarding outright.

Connector Security Policy
Whether inbound mail connectors require TLS and restrict sender domains.

Data Protection

14 controls

Where your information sits, who can reach it, and what is kept.

Data Loss Prevention Policies
Whether DLP policies exist, and whether they cover every workload or only some.

Sensitivity Labels
Whether labels are published to users so content can be classified.

Retention Policies
Whether content is kept for as long as your obligations require, across workloads.

Unified Audit Log
Whether tenant activity is being recorded at all — the basis of any investigation.

SharePoint External Sharing
Whether SharePoint content can be shared with anyone, including anonymously.

SharePoint Default Link Type
What kind of link users get by default when they press Share.

OneDrive External Sharing
Whether personal OneDrive content can be shared outside the organisation.

Teams External Access
Which external domains your users can chat and meet with.

Teams Guest Access
Whether guests can join Teams, and whether MFA is required of them.

eDiscovery Configuration
Whether you can place content on hold and search it when asked to.

Information Barriers
Whether groups that must not communicate are kept separate.

Communication Compliance
Whether policies exist to detect inappropriate or risky messages.

Insider Risk Management
Whether risky behaviour by people inside the organisation is monitored.

Audit Log Retention Policy
Whether audit records are kept beyond the default 90 days.

Devices & Endpoints

9 controls

The machines your data actually sits on.

Intune Device Enrolment
What proportion of devices are managed, and therefore governable at all.

Device Compliance Policies
Whether rules define what a healthy device looks like before it gets access.

BitLocker Encryption
Whether Windows disks are encrypted, so a lost laptop is not a breach.

Defender for Endpoint Integration
Whether endpoint risk signals reach Intune and influence access decisions.

Windows Autopilot
Whether new devices arrive configured and compliant without manual setup.

Microsoft Defender for Endpoint
Whether devices are actually onboarded, not merely licensed.

Mobile Application Management
Whether company data is protected on phones you do not manage.

Attack Surface Reduction Rules
Whether the rules that block common ransomware delivery routes are deployed.

Local Administrator Password Solution
Whether local admin passwords are unique per machine and rotated.

Threat Detection & Cloud Apps

16 controls

Whether you would notice an attack, and whether anyone is acting on what you see.

Secure Score
Microsoft’s own posture score for your tenant, and where it sits.

Security Alerts
Whether high-severity alerts are being resolved or quietly accumulating.

User Sign-in Audit Retention
How far back your sign-in logs reach when you need to investigate.

Admin MFA via Conditional Access
Whether a policy specifically enforces MFA on administrator sign-ins.

Privileged Identity Management
Whether privileged roles are activated on request rather than held permanently.

Privileged Access Management
Whether administration happens from hardened workstations.

Defender for Cloud Apps
Whether the licence you hold has policies configured behind it.

OAuth App Governance
Whether apps granted access to your data are monitored for risky behaviour.

Defender XDR Incident Management
Whether high-severity incidents are assigned to someone, or sitting open.

Defender for Identity Alerts
Signals of lateral movement between on-premises and cloud identity.

Secure Score Improvement Actions
How many of Microsoft’s own high-impact recommendations you have completed.

Attack Simulation Training
Whether phishing simulations have been run, and how recently.

Defender High-Severity Alerts
Unresolved high-severity detections across Microsoft Defender.

Compliance Manager Score
Microsoft’s own compliance score for the framework you selected.

Cloud App Discovery
Whether shadow IT — apps nobody approved — is being discovered at all.

Anomaly Detection Policies
Whether the default detections have been tuned, or left generating noise.

Workload Identities

8 controls

The non-human accounts nobody offboards. Service principals, app registrations and automation accounts hold standing permissions, and most organisations cannot say how many they have.

Orphaned App Registrations
Applications whose owner has left, and which still hold working credentials.

Long-Lived Client Secrets
Secrets valid for years, which a 99-year expiry quietly makes permanent.

Unused App Credentials
Credentials that still work but have not been used to sign in for a month or more.

Dormant Apps With Standing Access
Applications holding permissions that have not signed in for 90 days.

Service Principals in Privileged Roles
Non-Microsoft applications holding a role that can reach Global Administrator.

High-Impact Application Permissions
Grants broad enough to take over the tenant, held by applications.

User Consent to Applications
Whether ordinary users can approve an app’s access to your data themselves.

Credentials on Service Principals
Credentials added directly to a principal, where the App registrations blade does not show them. A documented persistence technique.

Tenant Configuration

6 controls

Tenant-wide settings that quietly shape everything else.

Licence Optimisation
Security features you are paying for but not using.

Security Contact Information
Whether Microsoft knows who to notify when something happens.

Group Creation Restrictions
Whether any user can create a Microsoft 365 group or a Team.

Teams App Permission Policies
Whether third-party Teams apps are permitted by default.

Password Expiration Policy
Whether forced expiry is still in place, against current guidance.

Entra Diagnostic Settings
Whether sign-in and audit logs are exported for long-term retention.

A control we could not check is never reported as one that passed. Coverage depends on your licensing and configuration — where a licence is missing, or Microsoft exposes no API for a setting, the report names the control and the reason.

Compliance frameworks

17 frameworks to choose from. Every finding mapped to a clause.

Pick the frameworks relevant to your business — every finding still includes the specific control ID, clause number, or article your auditor will reference.

SOC 2

AICPA Trust Services Criteria

→CC6 — Logical & Physical Access
→CC7 — System Operations
→CC8 — Change Management

ISO 27001

2022 Edition · Annex A

→A.5 — Organisational Controls
→A.8 — Technological Controls
→A.6 — People Controls

NIST 800-53

Rev 5 · Control Families

→AC — Access Control
→IA — Identification & Auth
→AU — Audit & Accountability

GDPR

EU · General Data Protection Reg

→Art 25 — Data Protection by Design
→Art 32 — Security of Processing
→Art 33 — Breach Notification

PCI DSS v4.0

Payment Card Industry Standard

→Req 7 — Restrict Access
→Req 8 — User Authentication
→Req 10 — Logging & Monitoring

HIPAA

Security Rule · HHS

→164.308 — Admin Safeguards
→164.312 — Technical Safeguards
→164.306 — Security Standards

NIST CSF 2.0

Cybersecurity Framework

→GV — Govern
→ID — Identify
→PR — Protect

CMMC 2.0

Level 2 · 110 Practices

→AC — Access Control
→IA — Identification & Auth
→SC — System & Comms Protection

MITRE ATT&CK

Enterprise Matrix

→Initial Access & Persistence
→Privilege Escalation
→Defense Evasion

DPDP Act 🇮🇳

Digital Personal Data Protection Act

→Section 8 — Fiduciary Obligations
→Section 11 — Grievance Redressal
→Section 12 — Data Localisation

CERT-In 🇮🇳

MeitY · 2022 Directions

→Dir (ii) — Report incidents in 6h
→Dir (iii) — Point of Contact
→Dir (iv) — 180-day log retention

APRA CPS 234 🇦🇺

Prudential Standard · Information Security

→¶21 — Access control
→¶22 — Third-party controls
→¶23 — Detection & response

NZISM v3.9 🇳🇿

NZ Information Security Manual

→16 — Access control & passwords
→15 — Email security
→23 — Monitoring & audit

CISA SCuBA 🇺🇸

CISA M365 secure configuration baselines

→MS.AAD — Entra ID
→MS.EXO — Exchange Online
→MS.DEFENDER — Defender for Office 365
→MS.SHAREPOINT & MS.TEAMS

🇮🇳 India frameworks included in all paid plans — one of the only automated M365 tools with DPDP, CERT-In, RBI, and SEBI compliance built in.

Feature	⚡ Kyvoi	GRC platforms	Manual assessment
Microsoft 365 controls assessed	✓ 93, M365-specific	~ Part of a broader control set	~ Depends on scope
How the tenant is read	✓ Microsoft Graph, read-only	~ Integration-dependent	✗ By hand, portal by portal
Time to first report	✓ 2–5 minutes	~ Onboarding period	✗ Days to weeks
Compliance frameworks	✓ 17, clause by clause	✓ Varies by platform	~ Usually one
DPDP, CERT-In, RBI, SEBI CSCRF	✓ All four	✗ Rarely covered	~ At extra cost
Evidence in each finding	✓ The observed value, the fix, the clause	~ Varies	✓ If the consultant records it
Unassessable controls	✓ Named, with the reason	~ Varies	~ Varies
Continuous monitoring	✓ Teams alerts on drift	✓ Typically included	✗ Point in time
Pricing model	✓ Per user, one-time	~ Annual subscription	~ Day rate

Everything We Check.
Nothing Left to Chance.

A professional PDF that tells you exactly where you stand.

Security Score

Category Breakdown

Live Tenant Metrics

Prioritised Findings

17 Framework Scores

AI Advisory

Microsoft Secure Score

Device Compliance

93 controls. Every category of M365 security.

All 93 controls Kyvoi checks

Identity & Access

Email Security

Data Protection

Devices & Endpoints

Threat Detection & Cloud Apps

Workload Identities

Tenant Configuration

17 frameworks to choose from. Every finding mapped to a clause.

Kyvoi, GRC platforms and consultants

See everything in a free sample report.