Microsoft 365 security hardeningFor businesses and MSPs
Lock down Microsoft 365 without locking out your team.
MFA for everyone, Conditional Access, managed devices, safer sharing, and protected admin accounts, rolled out in stages and documented policy by policy.
- Free scoping
- Fixed-fee proposal within two business days
- Labor warranty
Have the technical details? Skip the discovery call with our project information form.
The protections are already in your license. Many are switched off.
MFA that only some people use, admins who sign in with everyday accounts, sharing links anyone can open: these are the gaps attackers exploit and insurers ask about. We review what you have, agree on a baseline that fits how your team works, and roll it out without locking anyone out on a Monday morning.
When to consider starting this project
- Not everyone has MFA yet
- Staff read work email on personal phones
- Nobody has reviewed your Microsoft 365 settings since it was set up
A baseline built around how your team works.
- A review of Secure Score and current settings
- MFA and Conditional Access policies
- Admin role cleanup and emergency access accounts
- Device enrollment and compliance policies in Intune
- External sharing and guest access settings
- Audit logging and alert policies
From first call to documented handoff.
Scoping is free, and the price is agreed before any work begins. Most projects are quoted at a fixed fee.
Before the work
-
Discover
We start with a free call. You tell us what you want, what you use now, and when you need it done.
-
Plan
We send you a free written plan. It lists the work and any equipment, with a price for each.
-
Sign
You sign the plan, and we put your project on our calendar. Nothing starts until you say yes.
The work
-
Implement
We do the work, mostly over the internet. If a job needs us in person, we come to you.
-
Adjust
Testing and real-life use show what needs work. We fix those things and fine-tune the setup.
-
QA
We check every item in your plan, one at a time. We don’t move on until everything works.
After the work
-
Document
We write down what we built, how it’s set up, and why. Our diagrams help whoever works on it next.
-
Handoff
We show you and your team how it all works. Then we hand over the passwords and the documents.
-
Follow-up
After we hand it over, we check back with you. We make sure everything still works.
We take on a limited number of projects at a time, so the sooner you’re scoped, the sooner you’re on the calendar.
Straight answers
Something else on your mind? Ask us directly.
Will MFA frustrate our staff?
We roll it out in stages with the Microsoft Authenticator app, explain it before it starts, and use Conditional Access to cut down repeat prompts on managed devices.
Do we need new licenses?
Not always. Conditional Access and Intune come with Microsoft 365 Business Premium, E3, and E5; other plans have fewer options. We map what your licenses already include during scoping.
Doesn’t Microsoft require MFA already?
For administrators, yes. Microsoft began requiring MFA to sign in to the Azure, Entra, and Intune admin centers in October 2024, and the Microsoft 365 admin center in February 2025. Everyone else is protected only by the policies you set.
What do we get at the end?
A before-and-after Secure Score, documentation of every policy we set, and emergency-access procedures so you can’t lock yourselves out.
For MSPs
A fixed-scope Microsoft 365 hardening baseline for a client tenant, documented in your platform.
We deliver it white-label or co-branded, work in your PSA, RMM, and documentation platform, and never sell managed services to your clients.
Related projects
-
Email security and DMARC
Stop criminals from sending email in your name and keep your own mail out of spam folders, with SPF, DKIM, and DMARC set up correctly and the protections Microsoft 365 already includes turned on.
-
Cyber-insurance readiness
Answer your cyber-insurance questionnaire accurately and close the gaps underwriters ask about, such as MFA, backups, and endpoint protection.
-
Backup and recovery
Backups for servers, PCs, and Microsoft 365 that are set up correctly, kept off-site, and proven with a test restore.
See where your tenant stands.
Book a free scoping call. You’ll get a fixed-fee hardening proposal within two business days.
Planning around year-end? A fixed-fee proposal lets you commit this year’s budget before it closes, or put your project first on next year’s calendar.
Have the technical details? Skip the discovery call with our project information form.