Improve
Microsoft 365 security
Secure your Microsoft 365 tenant without breaking how your business works.
We review how your Microsoft 365 tenant is set up — sign-in, administrators, sharing, email and devices — agree the changes that matter, make them with your IT provider and verify each one. Every change is planned around your service accounts, integrations, emergency access and the way your staff actually work. We do not apply blanket settings.
Request a quote- Price
- Quoted on scope
- How you can engage us
- One-off project · Ongoing service · Project, then ongoing
- Delivered by
- Cyber Guys
- Review cadence
- Quarterly when continued as an ongoing service
Who it is for
Businesses that run email, files and collaboration on Microsoft 365 and want the tenant configured securely, with evidence that it is.
Scope
Your Microsoft 365 tenant — Microsoft Entra ID, Exchange Online, SharePoint, OneDrive and Teams, and Intune where you have it — as agreed in the scope.
What is included
- Multi-factor authentication coverage and enforcement for staff and administrators
- Privileged role review, with separate administrator accounts for administrative work
- Conditional Access policy design and staged rollout, where your licence includes it
- Legacy authentication review and blocking, once dependent devices and services have been identified
- Account lifecycle: joiners, movers, leavers, shared mailboxes and dormant accounts
- Guest and external access settings for Teams, SharePoint and OneDrive
- App consent settings, and review of OAuth permissions already granted to third-party apps
- Review of mailbox forwarding and inbox rules, including forwarding to external addresses
- Audit logging confirmed as on, with retention checked against your licence
- Email protection settings in Exchange Online Protection, and Defender for Office 365 where licensed
- SharePoint and OneDrive sharing defaults, and a review of existing anyone-with-the-link sharing
- Recovery arrangements: emergency (break-glass) access accounts and administrator account recovery
- Compliance policies for supported devices, where Intune is licensed
- Verification of each change, with the evidence recorded
What is not included
- Work outside the agreed scope, which is quoted separately
- Purchasing, upgrading or reassigning Microsoft licences
- Tenant, mailbox or file migrations
- Rebuilding, wiping or re-enrolling devices
- Changes inside line-of-business applications that connect to Microsoft 365, beyond identifying the dependency
- Incident response to an active compromise
- Penetration testing (available as a separate service)
How delivery works
- 01
Discover
We review tenant settings, administrators, sign-in activity, app permissions, forwarding rules and sharing, and list every service account and integration that depends on how sign-in works today.
- 02
Prioritise
We agree an ordered list of changes with you and your IT provider, with the business impact, licence needed and rollback for each.
- 03
Implement
Changes are made in stages inside agreed change windows. Sign-in policies run in report-only mode first so we can see who they would affect before they are switched on.
- 04
Verify
We check each change against sign-in logs and configuration exports. Anything that does not pass is reopened, not closed.
- 05
Maintain
Optional: an ongoing service reviews the tenant on a schedule and flags new administrators, apps, forwarding rules or settings that have drifted.
Who does what
You
- Name a decision-maker who can approve changes
- Provide a named, least-privilege administrator account for the engagement (never a shared password)
- Tell us about scanners, line-of-business apps, shared mailboxes and integrations that sign in to Microsoft 365
- Let staff know about changes that affect how they sign in
- Approve or decline each proposed change, and accept or decline any exception in writing
Cyber Guys
- Review the tenant and explain the findings in plain English
- Map service accounts, integrations and workflows before proposing any sign-in change
- Plan each change with its business impact, licence dependency and rollback
- Make or coordinate the agreed changes in stages
- Verify each change and record the evidence
- Report what was done, what was verified and what remains
Your IT provider or partner
- Your IT provider, where they manage the tenant or devices, makes or approves changes and confirms the result
Access we need
- A named administrator account with the least privilege needed for the agreed work, created by you or your IT provider
- Read access to sign-in and audit logs
- Read access to Intune where it is in use
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Conditional Access needs Microsoft Entra ID P1, which is included in some Microsoft 365 plans such as Business Premium; without it we use the closest available option, such as security defaults
- Risk-based sign-in policies need Microsoft Entra ID P2
- Device compliance policies need Intune licensing and devices enrolled in Intune
- Some email protections, such as Safe Links and Safe Attachments, need Defender for Office 365
- Audit log retention depends on your licence
- We confirm what your licences include before proposing a change that depends on them
What you receive
- Tenant findings report
- Service account and integration register
- Prioritised change plan with business impact and rollback
- Change log with verification results
- Emergency access procedure
- Evidence pack and handover report
How we know it is finished
- Every agreed change is verified, failed and reopened, or recorded as an exception you accepted
- Emergency access accounts are in place and their sign-in has been tested
- The handover report and evidence pack are delivered
Related services
Security baseline and uplift
Find the gaps, fix what matters, prove it is done.
Quoted on scopeRequest a quoteEmail security and fraud protection
Make your domain harder to spoof and payment fraud harder to pull off.
Quoted on scopeRequest a quoteEssential Eight uplift
Know your Essential Eight maturity, and lift it to the level you choose.
Quoted on scopeRequest a quoteAI security and governance
Use AI tools with clear rules, sensible permissions and evidence.
Quoted on scopeRequest a quote
Request a quote for Microsoft 365 security
Tell us a little about your business. We will arrange a short scoping call to agree what is in scope and send a written quote. The call is about scope and price — it is not free security advice.