Call
Talk to an expert

Cyber Security

Cloud & Microsoft 365 Security

A ranked list of the risky settings in your Microsoft 365, Entra ID, Azure or AWS accounts, and help fixing them without disrupting staff.

Starting from $1,999 ex GST for a Microsoft 365 security review

Ask about Cloud & Microsoft 365 Security
Your cloud configurationSample view
  • MFA coverageAdmin account brought under MFAManaged
  • Legacy sign-inLegacy authentication blockedManaged
  • External sharingAnonymous links restrictedContained
  • Conditional AccessReport-only policy to approveDecision needed
  • Intune complianceUnencrypted phone blockedManaged
  • Audit loggingAlert set for new admin accountsManaged
Illustration · not live data

In short

Cloud and Microsoft 365 security means configuring your cloud services so that accounts, data and admin access are properly protected, because cloud platforms are not secure by default. Catharsis reviews Microsoft 365, Entra ID, Azure and AWS against recognised benchmarks, maps each finding to ASD Essentials and ISO 27001, fixes risky settings and helps you keep them that way.

01Who it's for

Is cloud and Microsoft 365 security right for you?

Many cloud incidents start with a setting rather than a software flaw: an account without MFA, a sharing link left open or too many admins. A review finds those before someone else does.

Built for

  • Organisations with 5 or more staff that run email, files and identity in Microsoft 365
  • IT teams and Microsoft 365 providers who want an independent configuration check
  • Teams with servers, applications or storage in Azure or AWS
  • Government, health and education teams that must show cloud controls against a named framework

You probably need it if…

  • Your Microsoft 365 tenant was set up years ago and never checked since
  • Not every account, including admin and service accounts, is protected by MFA
  • Staff share files with people outside your organisation and nobody tracks it
  • You're planning to roll out Microsoft 365 Copilot

02What's included

What cloud and Microsoft 365 security includes

Microsoft 365 & Entra ID

Microsoft 365 security review

A review of your tenant against recognised baselines, covering Exchange Online, SharePoint, OneDrive and Teams settings, external sharing, audit logging and Microsoft Secure Score. You get a ranked list of fixes.

Entra ID and Conditional Access

We review sign-in security in Microsoft Entra ID (formerly Azure Active Directory): multi-factor authentication (MFA) coverage, Conditional Access policies, legacy authentication, guest accounts and admin roles, then help you close the gaps safely.

Device compliance with Intune

Policies in Microsoft Intune that require devices to be encrypted, updated and protected before they can reach company data, including personal phones used for work email.

Keep it secure

Ongoing posture management

Regular checks that settings stay secure as your environment changes, with drift reported to you. This can run as a standalone service or as part of managed security.

Azure & AWS

Azure and AWS configuration review

A review of your Azure or AWS accounts covering identity and access, network exposure, storage permissions, encryption and logging. Findings are mapped to the provider's security benchmark and ranked by risk.

Logging & backup

Logging and alerting

We check that the logs you need after an incident are switched on and kept long enough, and set alerts for high-risk events such as new admin accounts or suspicious sign-ins.

Cloud data backup

Microsoft 365 and cloud platforms keep your data available, but they are not a full backup. We check how your email, files and cloud workloads are backed up and how quickly you could restore them.

03Related work

Cloud and Microsoft 365 security in practice

Real engagements, anonymised because our clients are under NDA. The full write-ups, with results, are on our work page.

  • Technology and software · client under NDA

    Cloud security and Zero Trust transformation

    A rebuilt, multi-account AWS environment moving to a Zero Trust model, tested by a red-team simulation.

    • High-risk access permissions reduced by 94%
    • Audit logging coverage up from 62% to 100% of accounts

  • Australian small business · client under NDA

    Business email compromise investigation

    An investigation and clean-up after an attacker took over a Microsoft 365 mailbox, hid a forwarding rule and emailed everyone in the user's contacts.

    • Root cause and timeline established from logs and email evidence
    • The attacker's hidden forwarding rule found and removed

See all our work

Clean data centre hall with server cabinets under overhead cable trays and a white raised floor

Cyber Security

Keeping a secure configuration from drifting

New apps, guest accounts and admin exceptions slowly undo a hardened tenant. Recording an agreed baseline after a review makes later changes easier to check, rather than rediscovering them at the next audit.

04In detail

Cloud & Microsoft 365 security, in depth

Why does this matter before Microsoft 365 Copilot?

Copilot can find and summarise anything a user already has permission to access. If a SharePoint site full of payroll files is shared with everyone, Copilot makes that much easier to discover.

A security review before rollout fixes oversharing, tightens permissions and checks sensitivity labels, so Copilot is far less likely to surface data a person shouldn’t see. Our Copilot readiness service builds on this review with licensing, governance and adoption.

Which framework controls does this cover?

Under the shared responsibility model, the settings these frameworks care about are yours to manage, not the provider’s.

Several of the controls ASD prioritises apply directly to Microsoft 365. In ASD Essentials, sign-in and admin controls fall under the identity services domain. In the maturity model organisations are assessed against today, the relevant controls include multi-factor authentication, restricting administrative privileges, restricting Microsoft Office macros, user application hardening and regular backups. ISO/IEC 27001:2022 includes a specific control for information security in the use of cloud services (A.5.23), which an ISMS needs to consider. Each finding in your report is mapped to these frameworks, so the work counts towards your compliance goals.

Who applies the fixes?

Either we do, or your own team or Microsoft 365 provider does with our support. Changes such as enforcing MFA are planned and piloted, as the FAQ explains, and each finding carries the business risk alongside the fix so you can decide the order.

For example, a review might find a Microsoft 365 tenant where an old global admin account has no MFA and mailbox auditing is switched off. Both would be fixed as a priority, and the admin role moved to a separate, protected account.

05The process

How cloud and Microsoft 365 security works

  1. Scope

    We agree which tenants, subscriptions and accounts are in scope, and the read-only access we need.

  2. Review

    We assess your configuration against recognised benchmarks and your own requirements.

  3. Report and plan

    You receive a plain-English report with ranked findings and a fix plan your IT team or provider can follow.

  4. Remediate

    We apply the agreed fixes for you, or support your team, testing each change to avoid locking staff out.

  5. Keep it secure

    Optional ongoing checks catch settings that drift and new risks as your cloud use grows.

06Frameworks

How this maps to the frameworks

Useful for your auditor, board or procurement team. The mapping shows where this service supports each framework. It doesn't replace a formal assessment.

Cloud & Microsoft 365 Security: framework mapping
ControlASD EssentialsASD maturity model (current)ISO/IEC 27001NIST CSF
Microsoft 365 security reviewNot applicableNot applicableA.5.23, A.8.9Protect (PR.PS-01)
Entra ID and Conditional AccessIdentity servicesMulti-factor authenticationRestrict administrative privilegesA.5.15, A.8.2, A.8.5Protect (PR.AA-05)
Azure and AWS configuration reviewNot applicableNot applicableA.5.23, A.8.9Identify (ID.RA-01)
Logging and alertingVisibility and responseNot applicableA.8.15, A.8.16Detect
Cloud data backupNot applicableRegular backupsA.8.13Protect (PR.DS-11)

07Pricing

Pricing and how to start

Starting from

$1,999 ex GST

per assessment

What changes the price

Final price depends on the number of users, tenants, subscriptions and accounts in scope, whether you want us to apply the fixes, and whether you add ongoing posture checks.

  • Review of one Microsoft 365 tenant, including Entra ID and Conditional Access
  • Ranked findings report with a practical fix plan
  • Walkthrough session with your team or IT provider
Get a quote

08FAQ

Cloud & Microsoft 365 security, answered.

Can't see your question? Ask a specialist and get a straight answer.

Ask a specialist
Isn't Microsoft 365 secure by default?

Microsoft secures the underlying platform, but many settings that protect your accounts and data are your responsibility. This is the shared responsibility model. Common gaps include MFA that doesn't cover every account, legacy sign-in methods still enabled, wide external sharing and too many global administrators. A security review shows which settings apply to you and how to fix them safely.

What is the shared responsibility model?

The shared responsibility model sets out who secures what in the cloud. The provider, such as Microsoft or Amazon, secures the physical data centres, hardware and core platform. You remain responsible for your accounts, access permissions, data, configuration and, depending on the service, your operating systems and applications. Configuration gaps on the customer's side of that line are a common cause of cloud incidents.

Do you secure Azure and AWS as well as Microsoft 365?

Yes. We review Azure and AWS accounts against each provider's own security benchmark. Many organisations use Microsoft 365 alongside one of these platforms, so we can review both together and help keep sign-in and admin controls consistent across them. Findings for each platform are ranked in one report, so your team can work through a single list.

Will changing security settings disrupt our staff?

Changes such as enforcing MFA or blocking legacy sign-in can lock people out if they are rushed. We plan each change, test it with a pilot group, use report-only mode for Conditional Access where possible, and give staff clear instructions beforehand. Most changes then roll out with little or no disruption to day-to-day work.

How much does a Microsoft 365 security review cost?

At Catharsis, a review of one Microsoft 365 tenant, including Entra ID and Conditional Access, starts from $1,999 ex GST. The final price depends mainly on the size and complexity of your environment: several tenants or Azure and AWS workloads take longer to review. We confirm the price after a short scoping call, and fixes can be quoted separately or included.

Cyber Security

Email Security

Filter phishing, impersonation and fake invoices before they reach staff.

Secure AI

Copilot Readiness

Fix oversharing and permissions before Copilot surfaces them for you.

Talk to our team

Talk to us about cloud & Microsoft 365 security.

No obligation. You talk to the people who do the work.