Microsoft 365 ships convenient by default, not secure by default, and most organisations never revisit the settings after migration. We review your tenant against Microsoft's own security baseline, show you what is exposed, and harden it in a sequence that will not break how your people work.
A Microsoft 365 security assessment is a configuration review of the tenant that, for most Malaysian organisations, now holds nearly everything: email, files, chat, and the identity that unlocks all of it. We review it against Microsoft's own security baseline and recognised hardening guidance, then work through the gaps with you.
The review covers identity in Entra ID, including multi-factor authentication coverage, conditional access, privileged role assignment and legacy authentication; Exchange Online, including anti-phishing and anti-spoofing settings, external forwarding rules and mailbox audit retention; SharePoint and OneDrive sharing, particularly anonymous links and guest access; Teams external access; Defender policies; and the audit logging and retention you would depend on during an investigation.
Two outputs follow. First, findings ranked by exposure with an indicative Secure Score improvement, so progress is measurable in Microsoft's own terms. Second, a hardening plan sequenced so changes land without breaking how people work, because a security change that blocks the finance team on a Friday afternoon gets reversed on Monday and never gets attempted again.
Microsoft 365 has become the single highest-value target in most SMEs. One compromised account with no multi-factor authentication gives an attacker the mailbox, the files, the chat history and often the ability to reset other credentials. It is also the launchpad for business email compromise, because a fraudulent payment request sent from a genuine internal mailbox defeats nearly every check a finance team applies.
The defaults are the problem. Tenants are usually configured during migration by whoever ran the migration, optimised for a smooth cutover rather than a secure end state. Legacy authentication is often left enabled so an old device keeps working. Anonymous sharing stays on because it is convenient. Global admin is granted to more people than anyone remembers. Then nobody revisits it, sometimes for years.
Misconfiguration also carries direct PDPA exposure. An anonymous SharePoint link to a folder of customer records is a personal data disclosure, and it is the kind of finding that is trivial to fix beforehand and very difficult to explain afterwards. Mailbox audit retention matters for the same reason: without it you cannot establish what an attacker accessed, which is exactly what determines your notification obligation.
Reviewed against Microsoft's published baseline and recognised hardening guidance, adjusted for your licensing, since not every control is available on every plan.
Multi-factor authentication coverage across users, admins and service accounts, conditional access policy design, legacy authentication, privileged role assignment and standing global admin, guest access, and password and lockout settings.
Anti-phishing, anti-spoofing and impersonation protection, Safe Links and Safe Attachments, external sender warnings, auto-forwarding rules to external addresses, and mailbox audit logging and retention.
Anonymous and guest sharing settings, existing shared links and what they expose, external Teams access, and retention and deletion behaviour. Live anonymous links to sensitive folders are one of the most common material findings.
Defender policy configuration, device compliance and conditional access based on it, and whether personal devices can reach corporate data without controls. Adjusted to what your licensing actually includes.
Whether audit logging is enabled, what retention you have, and whether you could reconstruct what an attacker accessed. This matters enormously during an incident and is almost always set to defaults nobody chose.
Changes ordered by exposure reduced against disruption risk, with a rollout approach and a rollback path for each. Delivered as guidance for your IT team or MSP, or implemented alongside them where you prefer.
This is usually the highest return per ringgit of anything we do, because the fixes are configuration changes rather than purchases.
Account takeover through an unprotected mailbox is the most common route into a Malaysian SME. Enforcing MFA properly and disabling legacy authentication closes most of it, and costs nothing but a change window.
Nearly every recommendation uses licensing you already pay for. Organisations regularly discover they own controls they never switched on.
Secure Score gives a before and after your board can see, and a metric your IT team can be held to without arguing about methodology.
Assessments routinely surface anonymous sharing links to folders containing customer or HR data, live and indexable. Each one is a potential PDPA disclosure and each takes minutes to revoke.
Turning on audit logging and extending retention costs nothing and is the difference between establishing what was accessed during an incident and having to assume the worst in your notification.
Enterprise security questionnaires ask directly about MFA coverage, conditional access and data sharing controls. A hardened tenant turns several awkward answers into straightforward ones.
Two to three weeks from access to hardening plan. Faster than most engagements because the evidence is all in one place.
We agree scope and licensing, and you provide time-limited read-only access, usually a Global Reader role, or export the configuration yourself if you prefer not to grant access at all. We never require write access to assess.
A systematic review across identity, Exchange, SharePoint, Teams, Defender and audit settings against the baseline, plus an inventory of existing anonymous and guest shares, which is often the most revealing single artefact.
Findings ranked by real exposure rather than by Secure Score points alone, because those weightings do not always match your risk. An anonymous link to payroll data outranks several higher-scoring items.
A sequenced plan with the user impact and rollback path for each change, walked through with your IT team or MSP so they understand not just what to change but what will happen when they do.
Optional. We can guide your team through the changes, or implement alongside them in a staged rollout starting with a pilot group. Higher-impact changes such as conditional access are always piloted first.
After hardening we re-review and issue an updated report with the new Secure Score, giving you evidence the work landed. Most clients then reassess annually or after a significant tenant change.
Written so your IT team or MSP can execute directly, with enough context for management to approve the change windows.
Every finding by service area with current setting, recommended setting, exposure and indicative Secure Score impact.
Changes sequenced by exposure reduced against disruption risk, each with user impact, rollout approach and rollback path.
Existing anonymous and guest links, what they expose and which should be revoked immediately.
MFA coverage by account type, privileged role assignments, standing global admins and dormant accounts.
One page for leadership: current position, the material exposures and the change windows needed.
Post-hardening re-review with the updated Secure Score, suitable for showing an insurer or an enterprise client.
Any organisation running Microsoft 365 that has not had the tenant reviewed since it was set up, which in our experience is most of them.
Universal wherever Microsoft 365 holds business data, with the sharpest case in sectors handling personal or financial records.
Effort scales with tenant complexity rather than headcount, so smaller organisations are quick and inexpensive to assess.
Delivered with IT, but the sharing and retention findings usually need input from the data owners.
The technical findings are the easy part. Getting the changes actually deployed without them being rolled back is the hard part.
We assess against a documented baseline and produce evidence that maps onto your PDPA and ISO 27001 obligations, not just a Secure Score number. Sharing exposure and audit retention findings are framed in terms of the notification position they would create during an incident, which is the framing that gets them prioritised.
Every change carries its user impact, rollout approach and rollback path, sequenced so nothing lands on your finance team at month end. We would rather deliver eight changes that stay deployed than twenty that get reversed after the first complaint.
Our consultants have run compliance, data protection and security functions inside Malaysian organisations, not only advised on them from outside. That shows up in the advice: we know what a lean IT team can absorb in a quarter, and we know which recommendations get quietly shelved.
Scenarios use Malaysian references your staff will recognise, from DuitNow payment requests and e-invoice notices to LHDN and EPF correspondence. Reporting is framed against the obligations your regulators and auditors actually cite, including the 72-hour personal data breach notification duty introduced by the 2024 amendments to the PDPA.
Where the assessment shows users are working around controls rather than with them, for example forwarding mail externally to get work done, the awareness training that addresses it can be delivered as an HRD Corp claimable programme for levy-contributing employers.
Tell us your headcount, your industry and what triggered the interest, whether that is an audit finding, a near miss, a board question or a regulator letter. We will come back with scope, timeline and a fixed quotation. No obligation, and we will say so if you do not need us yet.
