Licences paid for, defaults still on
Business Premium, E3 or E5 include Conditional Access, Defender and Intune. Many security settings still date from the Office 365 days.
Microsoft 365 Security Hardening
Secure your Microsoft 365 tenant, with evidence for every measure.
You pay for Business Premium, E3 or E5, but little of it is set up. We close the findings from the Gap Assessment, from MFA to DMARC, and evidence every measure before and after.
- For
- Companies with 50 or more employees on Microsoft 365
- Scope
- Identities, email, sharing, devices, logging
- Duration
- 6 to 10 weeks
- Result
- Hardened tenant with evidence per measure
- Price
- from €8,900 excl. VAT, fixed price after the Gap Assessment
Sound familiar?
Paid for a lot, set up very little?
Microsoft 365 security depends on configuration, not on the licence. Three typical starting points.
IT can't fit it in
A team of one to five people keeps operations running. Alongside day-to-day work, there is no time left for a hardening project.
Auditors, customers or insurers are asking
NIS2, a customer audit or the cyber insurance questionnaire ask for evidence, not assurances.
From finding to evidence
How does a finding become evidence?
Instead of generic M365 security best practices, we close the findings in your tenant, in an order that locks nobody out. An example project, step by step.
Step 1 / 6
What do we harden?
Microsoft 365 hardening comes in six building blocks. The Gap Assessment shows which ones your tenant needs.
Identity and sign-in
MFA for all accounts, phishing-resistant sign-in, a Conditional Access baseline and two emergency access accounts.
Admin roles
Separate admin accounts with only the rights they need, time-limited activation through PIM where Entra ID P2 is licensed.
SPF, DKIM and DMARC towards p=reject, plus the Standard and Strict presets in Defender for Office 365.
Sharing and guests
External sharing in SharePoint, OneDrive and Teams restricted, inactive guest accounts removed.
Devices
Intune compliance and Defender for Business or Defender for Endpoint, depending on your licence.
Logging and evidence
Unified Audit Log on, retention defined, evidence per measure before and after.
How does the hardening work?
-
€3,500 to €5,000 excl. VAT
Gap Assessment
Findings with location, priority and effort. They set the fixed price of the hardening.
-
Together
Plan
Agree order, pilot group and change windows with your IT.
-
In stages
Implementation
Identity first, then email, sharing, devices and logging. Policies start in report-only mode.
-
In writing
Evidence and handover
Before and after per measure, documentation and runbooks for your team.
-
Optional
Operations
Ongoing upkeep and review through Managed Security.
How much of your licence is actually set up?
In 30 minutes we go through your licences, existing findings and a sensible place to start.
What changes?
Today
- Protection paid for, but not assigned
- MFA with exceptions, permanent admin rights
- DMARC at p=none, sharing without limits
- Auditor questions without evidence
After the hardening
- Protection set up and assigned
- MFA for everyone, admin rights only as needed
- DMARC on a fixed path to p=reject, sharing restricted
- Evidence per measure, before and after
Frequently asked questions
What does it cost to secure a Microsoft 365 tenant?
The hardening costs from €8,900 excl. VAT as a fixed price. We confirm the exact price after the Gap Assessment (€3,500 to €5,000 excl. VAT), because only then are the findings and scope known.
Is Business Premium security enough?
For most building blocks, yes. Business Premium includes Entra ID P1 for Conditional Access, Intune Plan 1, Defender for Business and Defender for Office 365 Plan 1. Time-limited admin roles through PIM also need Entra ID P2.
Is a high Microsoft Secure Score the goal?
No. Secure Score shows whether things are improving and is one indicator among several. The yardstick is the Gap Assessment findings and the evidence per measure.
Do you work with our IT team or IT provider?
Yes. We agree every change and its time window with your IT and hand over documentation and runbooks. Afterwards, your team runs the tenant, or we do through Managed Security.
What is set up in your tenant today?
The starting point is the fixed-price Gap Assessment.