Skip to content
Code To Cloud

Microsoft 365 and Azure Health Check

Is your Microsoft environment secure, and is it set up the right way?

Tenants drift. Settings that were fine three years ago fall behind, admin rights pile up, sharing spreads and Azure costs creep. We check security, and whether Microsoft 365 and Azure are set up the way Microsoft recommends.

Book a Discovery CallTake the free self-check

Last updated:

Is it for you?

Who it's for, and who it isn't.

A good fit

  • You run Microsoft 365 and Azure, and the environment has grown over the years without a full review.
  • Your Secure Score is low, or you don't know what it is.
  • Cyber insurance, a customer or the board is asking how your Microsoft environment is secured.

Probably not yet

  • You need a compliance audit or certification. This is an engineering assessment.
  • You're not on Microsoft 365 or Azure.

Free self-check · 9 questions · no email

Score yourself in two minutes.

Answer for your own environment. You'll get a security score, a best-practice score and your gaps, each linked to the public framework it comes from.

Part 1 · Is it secure?

1. Is MFA enforced for every user, including admins, through Conditional Access?

2. Do you have fewer than five Global Administrators, with admin roles activated just in time?

3. Is external sharing in SharePoint and OneDrive restricted and reviewed?

4. Do Defender alerts go to someone who acts on them within a day?

5. Do you know your Microsoft Secure Score, and review it at least quarterly?

Part 2 · Is it set up the right way?

6. Are your Azure subscriptions organized under management groups, with Azure Policy applied?

7. Have your production workloads been reviewed against the Azure Well-Architected Framework?

8. Does someone act on Azure Advisor's recommendations regularly?

9. Have you tested restoring a critical workload from backup in the last year?

0 of 9 answered

Part 1 · Security

Is it secure?

  • Identity

    MFA, Conditional Access, privileged roles and just-in-time access, guest accounts and emergency access accounts in Microsoft Entra ID.

  • Email and sharing

    Email protection, and how files are shared in SharePoint, OneDrive and Teams, inside and outside the organization.

  • Threat protection and monitoring

    Defender recommendations, network exposure including Fortinet where you run it, and whether security alerts reach someone who acts on them.

Part 2 · Best practice

Is it set up the right way?

  • Azure foundations

    Management groups, subscriptions, Azure Policy, naming and tagging, logging and backup: whether the landing zone is set up the way Microsoft recommends.

  • Azure Well-Architected review

    Your Azure workloads checked against all five pillars: reliability, security, cost optimization, operational excellence and performance efficiency.

  • Advisor and cost

    Azure Advisor's recommendations put in order of value, and the spend that isn't earning its keep.

Measured against

Public frameworks, not our opinion.

What you get

Findings you can act on.

  • Written findings for security and for best practice, with the evidence behind each one.
  • A prioritized list of what to fix first, in the order to do it.
  • A working session where we walk your team through the findings.

How it runs

From first call to findings.

  1. 01

    Discovery call

    Thirty minutes on what you run and what's worrying you.

  2. 02

    Scope agreed in writing

    We confirm what's in and out, and the fixed fee, before any work starts.

  3. 03

    Assessment

    We review security and best practice against the frameworks on this page.

  4. 04

    Readout and next step

    We walk through the findings. Fixing them with us is your choice.

FAQ

Questions about the Microsoft 365 and Azure Health Check.

What is a Microsoft 365 and Azure Health Check?

A fixed-fee check of your Microsoft 365 tenant and Azure subscriptions. On security, it covers identity, email and sharing, threat protection and monitoring. On best practice, it covers your Azure foundations, a review of your workloads against the five pillars of the Azure Well-Architected Framework, and Azure Advisor's recommendations and spend.

Is it a security assessment or a Well-Architected review?

Both. Security is checked against Microsoft Secure Score, the Microsoft cloud security benchmark and the CIS benchmarks. Whether the environment is set up the right way is checked against the Azure Well-Architected Framework and Azure Advisor.

Isn't Secure Score enough?

It's a good start, but it only scores what Microsoft can measure, and it doesn't tell you which gaps matter most to your business. We read it alongside the CIS benchmarks and how your environment is actually used, and put the fixes in order.

Is this the same as a security audit?

People often call it one. It is a security review of how your environment is configured and built, measured against the public frameworks named on this page. It is not a compliance audit or certification and makes no compliance, certification or data residency finding, though the findings can feed one.

Where do you work?

We're in the Calgary area and work with clients across Canada and the United States. The assessment is delivered remotely, on Mountain Time.

How much does it cost?

The Microsoft 365 and Azure Health Check is a fixed fee, scoped on a discovery call and agreed in writing before work starts. The fee depends on the size of what's in scope.

What access do you need?

We agree the access in the written scope. We ask for read-only access wherever it's enough, and time with the people who run the environment.

Who does the work?

Each engagement has its own lead from our team of employees and specialist contractors in cloud, AI and software engineering, with the team sized to the work. Leads make the day-to-day decisions, so nothing waits on one person. Kevin Evans, the founder and a Microsoft MVP for Azure, sets the technical standards we all build to. Everything is built in your own tenant and repositories, so your team owns and extends it.

What happens after the assessment?

You decide. Some teams fix the findings themselves. Some ask us to fix them with their team, as a project. Either is a normal outcome.

Also available

Other security assessments.

Ready to find out?

Book a discovery call. We'll scope the Microsoft 365 and Azure Health Check with you, or tell you if you don't need it yet.

Book a Discovery CallSee all services