How secure is your Microsoft 365 tenant?
Answer 22 yes or no questions about identity, devices, email, data and monitoring. You get a score out of 100, a bar for each area, and for every gap the exact Microsoft setting to change and where to find it, in the order to fix them. Built for small and mid-sized businesses by IT Rapid Support in Vaughan.
Identity
Devices
Data
Monitoring
Questions you skip count as Not sure.
What this check is, and what it is not
This is a self-assessment. It scores the answers you give, not your actual tenant, and it cannot see a setting you believe is on but is not. Microsoft Secure Score in the Microsoft Defender portal is the authoritative view, because Microsoft calculates it from your real configuration across identity, devices, apps and data. Reading that score automatically would require an administrator in your organisation to grant consent to a connected app. This page deliberately does not do that, so there is nothing to approve and nothing to revoke.
Every setting name and menu path on this page was checked against Microsoft Learn in September 2026, and each recommendation links to the Microsoft page it came from.
Related help
- Microsoft 365 managed services for businesses that want these settings looked after every month.
- Microsoft 365 and Azure migration if you are moving in and want the tenant set up securely from day one.
- Free email spoofing check to read your domain’s SPF, DKIM and DMARC records in seconds.
- SPF, DKIM and DMARC explained and how to stop phishing attacks.
- Microsoft 365 security best practices for 2026.
- Contact IT Rapid Support with a question about any result.
Frequently asked questions
Does this tool connect to my Microsoft 365 tenant?
No. It is a self-assessment. You answer the questions, and the scoring runs in your own browser. Nothing is sent to IT Rapid Support or anyone else, and your answers disappear when you close the tab. Reading your real Secure Score would need an administrator in your tenant to grant consent to an app, and this page deliberately does not ask for that.
How is the score calculated?
Each of the 22 checks carries a weight from 3 to 10 based on how often that gap is how attackers get in, for a total of 121 points. A Yes earns the full weight. A No or a Not sure earns nothing, because a control you cannot confirm should be treated as missing until someone checks. The score is your points as a share of 121, from 0 to 100.
Is this the same as Microsoft Secure Score?
No. Microsoft Secure Score is calculated by Microsoft from your actual tenant settings and covers far more recommendations. This checklist picks the controls that matter most for a small or mid-sized business and explains each one in plain words, with the exact setting to change. Use both: this page to understand the gaps, Secure Score to confirm them.
Which Microsoft 365 licences do these settings need?
Security defaults need no extra licence. Conditional Access needs at least Microsoft Entra ID P1, and the sign-in risk and user risk policies need Entra ID P2. Device compliance and disk encryption policies need Intune. Safe Links, Safe Attachments and impersonation protection need Microsoft Defender for Office 365, which comes with Microsoft 365 E5 or as an add-on. Data loss prevention licensing varies by plan. Check your own plan before you buy anything new.
What should I fix first?
Work top down through the priority list on your results. It is sorted by weight, with a definite No ahead of a Not sure at the same weight. For most businesses the first three are multifactor authentication for everyone, blocking legacy authentication and turning off automatic forwarding to outside addresses.
Can IT Rapid Support check these settings for me?
Yes. As part of a free IT health check, an engineer can review these controls with you and give you a written list of findings that is yours to keep, whether or not you ever work with us.