In 7 out of 10 tenants we check, at least one admin has no MFA. Is yours one of them?

The free check covers nine areas of your Microsoft 365 tenant, from MFA to licences nobody uses – in under 15 minutes and read-only.

Free · GDPR-compliant

No admin access?

Excerpt from the Cloumo scan report with sample data: score 57 out of 100, status critical, biggest risk “Global Admins without strong MFA” with 2 affected accounts, plus 17 critical or high findings, 42 open findings and 3 users with unused licenses — Excerpt from the report · sample data

What we find most often in Microsoft 365 tenants

73% of scanned tenants had admins without MFA protection.
42% of recorded devices ran outdated or unsupported software.

Based on tenant scans carried out by Cloumo.

What the Microsoft 365 security check covers

Nine check areas, one report. Every finding comes with a severity, a plain-language explanation and the next step.

User Accounts
Privileged Accounts
License Assignment
Device Compliance
Exchange Online
Security Configuration
Email Security
Apps and Service Providers
Threats and Critical Changes

Security

Find open doors before an attacker does.

Admin accounts without multi-factor authentication are the most common route to an account takeover. Forwarding rules to external addresses quietly send confidential emails outside your company. The scan shows you both – and what to close first.

Admins without MFA
External forwarding rules in Exchange Online
Orphaned guest accounts with access
Overly broad permissions

The 5 most important Microsoft 365 security measures

Report excerpt Privileged Accounts: score 44, five open findings, first “Global Admins without strong MFA” (critical, 2 affected), then synchronized accounts with admin roles and PIM activation without MFA (high) — Excerpt from the report · sample data

Licences & costs

Stop paying for accounts nobody uses.

An account that hasn't signed in for weeks, or was disabled long ago, still holds a licence. The scan lists each of these accounts with its licence and last activity – so you can see which licences to cancel or reassign.

Inactive accounts with a licence (30+ days without sign-in)
Disabled accounts that still hold a licence
Licence and last activity for every account

Report excerpt License Assignment: finding “Inactive users with licenses” (high) with its recommendation and the two affected accounts, their Microsoft 365 Business Premium license and last activity — Excerpt from the report · sample data

Devices & compliance

Ready for your audit and your cyber insurer.

Outdated Windows versions, devices without a compliance policy, software without support: this is exactly what ISO 27001 auditors and cyber insurers ask about. The scan reads device status from Intune and shows where you need to catch up.

Outdated operating systems (from Intune)
Missing compliance policies
End-of-life software

Report excerpt Device Compliance: score 48, eleven open findings, among them devices on Windows 10 past end of support, Windows devices without encryption, Office past end of support and company computers without device management — Excerpt from the report · sample data

How the scan works

No agent, no client, no installation. The scan uses the Microsoft Graph API with read permissions only.

01

Sign in with Microsoft

Open scan.cloumo.com and sign in with an account that has the Global Administrator role.
02

Confirm read access

Microsoft shows you exactly which read permissions the scan receives. One click is all it takes.
03

The scan runs itself

The analysis runs in the background via the Graph API. You don't have to do anything else.
04

Download your report

In under 15 minutes your report is ready – as a PDF to share with your team.

Start page of scan.cloumo.com: “Connect your Microsoft 365 tenant” with the read-only access badge, the areas users, admins, MFA, licenses, devices and encryption, the OAuth 2.0 consent with no changes to your tenant and the “Connect Microsoft 365” button, which requires the Global Administrator role — Where the scan starts: scan.cloumo.com

Not an admin yourself?

Send the link to your IT administration. Sign-in and consent take only a few seconds.

What the scan reads – and what it never does.

The scan works via the official Microsoft Graph API with read permissions only. It changes nothing in your tenant and never sees your content.

You can revoke access at any time in Microsoft Entra ID.

Reads

User accounts, roles and last sign-in
Licence assignments
MFA and security settings
Forwarding rules in Exchange Online
Device status from Intune

Never reads

Email content
Files in OneDrive and SharePoint
Chats and meetings in Teams
Calendars and contacts

After the scan, you decide.

The report is yours. Implement the recommendations yourself – or let us close the gaps for you.

Security check

€0

One-off and without obligation. No follow-up costs, no automatic renewal.

Report with a score across nine check areas
Every finding with severity and recommendation
The top three steps with effort and score gain
Unused licences with last activity
PDF export for management

Managed Microsoft 365

from €39

per user and month

plus VAT and Microsoft licences

We close the gaps from your report and keep your tenant in good shape for good – with a dedicated contact.

Users, access and devices managed
Licences kept right-sized
Helpdesk with SLA
Security management as an add-on

View managed service Discuss your results with us

Microsoft 365 security check: FAQ

The scan checks your tenant across nine areas: user accounts, privileged accounts, licence assignment, device compliance, Exchange Online, security configuration, email security, apps and service providers, and threats and critical changes. Among other things, it finds admins without MFA, forwarding rules to external addresses, orphaned guest accounts, inactive accounts with an active licence and devices running an outdated operating system. Every finding gets a severity and a concrete recommendation.

The scan only needs read permissions via the Microsoft Graph API, for example for user, licence and configuration data. It never accesses emails, documents or other content. You grant access transparently at sign-in and can revoke it at any time in Microsoft Entra ID.

Yes. The scan reads only configuration and metadata, never personal content such as emails or files. Processing is GDPR-compliant, you receive your report directly, and scan data is never shared with third parties. On request, we delete all collected data after the analysis.

Yes. Granting the read permissions requires an administrator account in your Microsoft 365 tenant. If you aren't an admin yourself, just copy the scan link and send it to your IT team. Sign-in and consent take only a few seconds, after which everything runs automatically.

Usually under 15 minutes. After sign-in, the analysis runs automatically via the Graph API, with no agent and no installation. You then get your report – with risks, unused licences and prioritised recommendations – and can download it as a PDF.

Microsoft Secure Score rates your security settings against Microsoft's own recommendations. The Cloumo scan adds the cost side: it finds inactive and disabled accounts that still hold a licence. The report also shows your Secure Score for reference. All results are prioritised in one report that management can understand without admin knowledge.

The initial analysis is free and without obligation – no follow-up costs and no automatic renewal. What you do with the results is up to you. If you'd rather not close the gaps yourself, we're happy to take over, for example as part of our managed Microsoft 365 service.

The scan comes from Cloumo, a German IT service provider specialising in managed Microsoft 365, cybersecurity and endpoint management. We support small and medium-sized businesses across the DACH region and use only the official, standardised read permissions of the Microsoft Graph API.

How secure is your tenant right now?

Find out in under 15 minutes – free, read-only and without installation.

No admin access?

Contact

Let's get started together.

Write to us or give us a call – we will get back to you within one business day.

"Your inquiry doesn’t end up in a queue – it lands directly with me. I’ll get back to you within one business day."

Joachim Havloujian

Consultant

info@cloumo.com Direct contact +49 2161 2770 164 Phone

We support companies throughout Germany – from our office in Mönchengladbach, with a focus on Düsseldorf and Munich – remotely and on-site.

Send inquiry

All fields marked with * are required.