Innoligo microsoft 365 security assessment · Final report
Halden Freight Ltd
Fictional UK logistics firm, 85 staff across two depots, Microsoft 365 with one on-premises file server, IT support from a local MSP.
The question: Are we exposed, and what should we fix first?
1Executive summary
Exposed in four places that matter, all fixable within 90 days, mostly with licences you already pay for.
Halden Freight is more exposed than its directors believed. The biggest risks are accounts without multi-factor authentication, old sign-in methods left switched on, and no tested way to recover email and files after ransomware. Most fixes use features already included in Business Premium. The licence savings found broadly pay for the one new cost recommended: a backup service.
46 / 100
security rating today (target 75 within 90 days)
9
findings: 3 high, 4 medium, 2 low
£3,300 to £3,600
licence and tool savings a year, to test
2Scope and method
What we looked at
- Microsoft 365 tenant: identity, sign-in and admin roles
- Exchange Online email protection, SPF, DKIM and DMARC
- SharePoint, OneDrive and Teams sharing settings
- Device management and encryption (Intune and BitLocker)
- Backup and recovery for Microsoft 365 and the file server
- Licence fit: who holds which plan and whether it is used
Access and evidence
- Read-only Global Reader role for 30 days
- Sign-in and audit logs for the last 30 days
- Two 45-minute interviews: Finance Director and the MSP account manager
Not included
- Penetration testing (no attempt was made to break in)
- Warehouse operational technology and handheld scanners
- Certification: this prepares for Cyber Essentials but does not award it
3Security rating by area (out of 5)
- Identity and sign-in14 accounts sign in without multi-factor authentication2 / 5
- Admin accounts6 global admins, all used for daily email1.5 / 5
- Email protectionFiltering good; DMARC not enforced3 / 5
- Devices38% of laptops unmanaged2 / 5
- Data sharing214 open "anyone" links2.5 / 5
- Backup and recoveryNo Microsoft 365 backup; restore never tested1 / 5
- MonitoringAlerts go to an unread mailbox1 / 5
- Licence fit11 licences on leavers' accounts3.5 / 5
4Findings, ranked
Every finding has the evidence behind it, what it means for the business, the fix, the effort and the cost. A real report adds an evidence appendix with the underlying exports.
1.HighMulti-factor authentication not enforced
- Evidence
- 14 accounts, including 2 global admins, signed in with a password only in the last 30 days.
- Business impact
- One phished password gives an attacker the mailbox, files and, for the admins, the whole tenant.
- Fix
- Require multi-factor authentication for every account with Conditional Access; create two protected emergency access accounts.
- Effort
- 1 to 2 days
- Cost
- Included in current licences
2.HighLegacy sign-in methods still allowed
- Evidence
- 3 mailboxes connect by IMAP, one from an overseas IP address never seen before.
- Business impact
- Legacy protocols bypass multi-factor authentication completely.
- Fix
- Block legacy authentication tenant-wide; move the 3 users to the Outlook app.
- Effort
- Half a day
- Cost
- None
3.HighNo tested recovery for email and files
- Evidence
- No Microsoft 365 backup in place. The file server backup has never been restored as a test.
- Business impact
- Ransomware or a malicious deletion could cost weeks of data with no reliable way back.
- Fix
- Add a third-party Microsoft 365 backup with an isolated copy; test a full restore of the file server each quarter.
- Effort
- 3 days, then 2 hours a quarter
- Cost
- £2,000 to £3,300 a year
4.MediumToo many everyday admin accounts
- Evidence
- 6 global admins; all are the users' normal email accounts.
- Business impact
- Every phishing email to these 6 people is an attack on the whole tenant.
- Fix
- Reduce to 2 named admins with separate admin-only accounts; give others limited roles.
- Effort
- 1 day
- Cost
- None
5.MediumUnmanaged and unencrypted laptops
- Evidence
- 27 of 71 laptops (38%) not enrolled in Intune; 9 without BitLocker.
- Business impact
- A lost laptop is a reportable data breach; patching cannot be enforced.
- Fix
- Enrol every laptop in Intune and enforce BitLocker and a 14-day update policy.
- Effort
- 3 to 5 days
- Cost
- Included in Business Premium
6.MediumOpen sharing links to finance data
- Evidence
- 214 active "anyone with the link" shares; 31 point to finance folders.
- Business impact
- Anyone who gets a link, including former staff, can open the file without signing in.
- Fix
- Remove existing anyone links to finance; restrict new ones to named people with expiry.
- Effort
- 1 day
- Cost
- None
7.MediumEmail domain can be spoofed
- Evidence
- DMARC policy set to "none"; DKIM not enabled.
- Business impact
- Criminals can send convincing invoices that appear to come from Halden Freight.
- Fix
- Enable DKIM, move DMARC to quarantine, then reject after 6 weeks of clean reports.
- Effort
- 2 hours, then monitoring
- Cost
- None
8.LowLicences on leavers' accounts
- Evidence
- 11 Business Premium licences on accounts with no sign-in for 90 days or more.
- Business impact
- About £2,390 a year spent on people who have left; open accounts are also a risk.
- Fix
- Remove the licences and disable the accounts; add licence removal to the leaver checklist.
- Effort
- 2 hours
- Cost
- Saves about £2,390 a year
9.LowNobody watches the alerts
- Evidence
- Security alerts go to a shared mailbox with 1,900 unread messages. Secure Score 41%.
- Business impact
- Attacks that tools already detect go unnoticed.
- Fix
- Name one owner; route high-severity alerts to the MSP with a response time in the contract.
- Effort
- 1 day
- Cost
- Within the MSP contract
5What security-related IT costs today
| Item | Per year |
|---|---|
| Microsoft 365 Business Premium, 70 licences | £15,200 |
| Microsoft 365 Business Standard, 20 licences | £2,760 |
| Third-party email filtering (overlaps Defender for Office 365) | £1,200 |
| MSP support contract | £21,600 |
| Cyber insurance premium | £4,800 |
| Total | £45,560 |
From invoices supplied by Halden Freight. Excludes VAT and staff time.
6Savings and costs to test
| Item | Range | Confidence |
|---|---|---|
| Remove 11 leavers' licences Confirmed from sign-in logs | £2,390 | High |
| Retire the duplicate email filter once Defender policies are set Depends on the filter's notice period | £900 to £1,200 | Medium |
| New: Microsoft 365 backup service Recommended new cost | −£2,000 to −£3,300 | High |
| Cyber insurance renewal with evidence of controls Ask the broker; no saving assumed | Not estimated | Low |
Net effect: the savings found roughly pay for the backup service, so the risk reduction costs little or nothing a year. Ranges are to be tested, not promises.
7Your action plan
The fixes, sorted into three time buckets so nothing is overwhelming: quick wins first, then planned work, then longer-term improvements. Hand it to your IT provider, or to us, and say "do this, in this order".
First 30 days: quick wins
- Multi-factor authentication for every account
- Block legacy sign-in
- Separate admin accounts, cut to 2 global admins
- Remove 11 leavers' licences
- DKIM on, DMARC to quarantine
30 to 90 days: planned work
- Choose and switch on Microsoft 365 backup; test a restore
- Enrol all laptops in Intune with BitLocker
- Clean up anyone links to finance folders
- Name an alert owner and agree MSP response times
3 to 12 months: longer term
- Prepare for Cyber Essentials before the insurance renewal
- DMARC to reject
- Quarterly access and licence review
- Test the incident plan once a year
8Decisions for you to make
The few questions IT cannot answer alone, because they need budget or authority. Your owner or directors can settle them in one meeting.
- Approve a backup budget of up to £3,300 a year, funded by the licence savings.
- Name one person accountable for security, with the MSP doing the work.
- Decide whether to seek Cyber Essentials before the March insurance renewal.
The report ends with a senior readout: a one-hour session to walk through the findings and these decisions with you and anyone else who needs to be there. The report, findings and plan are yours to keep and use with any supplier.