Find out what's leaking from your Microsoft 365 tenant — before your insurer or attackers do.

What Irish & UK SMEs usually find when we look at their M365 tenant

Forwarding rules no one set up

We routinely find mailboxes silently auto-forwarding every inbound email to an outside Gmail. Sometimes it's a former employee. Sometimes it's a compromise. Either way, it's been running for months. Our review enumerates every forwarding rule across the tenant.

MFA gaps in the wrong places

MFA is on for 'most' users. The exceptions are the directors, the finance team and the service accounts — the exact accounts attackers want. We map MFA coverage against role and flag the gaps in writing.

DMARC at 'p=none' for years

Your domain has SPF and DKIM, and DMARC is published — but at policy 'none', which is observational only. Spoofed mail still gets delivered. We chart the path from 'none' to 'quarantine' to 'reject' with the legitimate-sender inventory you need so nothing breaks.

Conditional Access policies that exist but don't apply

Conditional Access is on the menu. Someone built three policies a year ago. None of them are scoped properly, two are in report-only mode forever, and the compliant-device requirement was scoped out for an emergency that's been over for six months.

What we check in the free M365 review

Identity & access posture

MFA coverage across the tenant. Privileged role assignments. Stale guest accounts. Sign-in logs for anomalies. Password-spray and impossible-travel signals. Service accounts and legacy-auth exceptions.

• MFA coverage matrix (per role, per geography).
• Privileged-role inventory (Global Admin, Exchange Admin, etc.) — should be 2–5 people, not 30.
• Stale guest accounts older than 90 days.
• Legacy-auth exceptions and the apps still depending on them.
• Sign-in anomalies — impossible travel, password-spray, unfamiliar locations.

Email security & impersonation

DMARC posture (enforcement, alignment, reporting). SPF + DKIM correctness across all sending domains. Inbound impersonation risk — display-name spoofing, lookalike-domain awareness. Outbound mailbox forwarding rules.

• DMARC report aggregation — what's the world doing in your name today?
• SPF + DKIM correctness for every sending source (M365, marketing tool, ATS, etc.).
• Impersonation policy (Microsoft Defender or Exchange Online) review.
• Inbound transport rules — anti-phish overrides, allow-lists, mail-routing exceptions.
• Outbound forwarding rules enumeration — silent exfiltration risk.

Conditional Access & Zero-Trust posture

Every active CA policy listed, scope assessed, gaps flagged. Block-legacy-auth, require-compliant-device, MFA-from-untrusted-network, risk-based sign-in — your current state vs. NCSC / Microsoft baseline.

• Full Conditional Access policy inventory + effective evaluation.
• Report-only policies that should be enforced.
• Scoping gaps — exclusion groups quietly bigger than they should be.
• Risk-based sign-in (Entra ID Protection) on/off review.
• Compliant-device + Intune coverage for laptops and mobiles.

Data protection & DLP

SharePoint / OneDrive sharing posture. External-sharing defaults. Anonymous-link exposure. DLP policies and how they fire. Sensitivity labels — whether they exist and whether anyone uses them.

• External sharing defaults — 'Anyone' vs. 'Specific people'.
• Public anonymous links currently in the wild (often hundreds, often forgotten).
• DLP policy review and false-positive-rate sanity check.
• Sensitivity-label adoption — how many documents are actually labelled?
• Retention policy posture for finance, HR and legal mailboxes.

Secure Score & Microsoft baseline

Tenant Secure Score with the highest-impact uplift items prioritised. We don't chase the score for its own sake — we pick the controls that genuinely reduce risk for your shape of business. Mapped to NIS2 / GDPR Art. 32 evidence requirements.

• Secure Score baseline + 90-day trajectory chart.
• Top 10 impact-ranked uplift items with effort estimates.
• Mapping to NIS2 / GDPR Art. 32 / Cyber Essentials evidence.
• Quick wins (1-day effort) vs. governance work (board-level decisions).

Optional paid engagement — hardening & ongoing oversight

Where the free review surfaces work, we can do the hardening directly: DMARC migration to p=reject, Conditional Access rebuild, privileged-access overhaul, Intune rollout, sensitivity-label deployment, training. Monthly oversight retainer available.

• Fixed-price hardening engagements scoped from the free review.
• DMARC migration project (p=none → quarantine → reject) with rollback.
• Conditional Access rebuild against NCSC / Microsoft baseline.
• Privileged Identity Management (PIM) rollout for Global Admins.
• Monthly oversight retainer — quarterly Secure Score review + board pack.

Where we work

M365 reviews run remote-first; on-site engagements for hardening projects in Ireland and the UK as required.

• Ireland — Dublin, Cork, Limerick, Galway, Waterford, Tipperary (Cashel, Thurles)
• Irish Midlands — Portlaoise, Athlone, Mullingar, Tullamore
• United Kingdom — Cambridge, Suffolk, London, Birmingham, Manchester
• European Union — remote

Microsoft 365 security audit Ireland — Dublin, Cork, Galway, Limerick, Tipperary, Cashel, Portlaoise and the Midlands. UK delivery from Bury St Edmunds.

Why SMEs pick Intellix for M365 reviews

• Free initial review actually shows you something. Not a sales call dressed up as an audit. We come back with a real document and named gaps.
• No vendor kickbacks. Our recommendations aren't shaped by Microsoft, Mimecast or a third-party SIEM reseller. We pick what's right for you.
• Senior-led delivery. The person reading your tenant is a senior consultant, not a graduate working through a checklist.
• EU data residency. The report stays in EU jurisdiction. We can sign a sub-processor DPA if your governance team requires it.
• NIS2 + GDPR Art. 32 mapped. Same evidence works for multiple frameworks — you don't pay us to re-document for each.

Request a free M365 security review

Email [email protected] with your M365 tenant primary domain and a note saying you'd like a security review — or use the form on the live page. We confirm scope, ask for read-only access, run the review and come back inside 5 working days.

← Back to Intellix snapshot · Cybersecurity audit · Hospitality & hotel IT · sitemap

Generated 2026-05-16 13:19 UTC