What a Microsoft 365 Assessment Covers, Plus a Self-Check to Run First

A Microsoft 365 assessment is a structured review of how your company's Microsoft 365 environment (your tenant) is set up today: what you pay for, who can do what, how well sign-ins and email are protected, where files live and who they are shared with. A good one is read-only, ends in written findings ranked by risk, and gives you a prioritized plan. Before you ask anyone for one, you can run a short self-check of your own, and we include one below.

Why an assessment is worth doing

Most small firms set up Microsoft 365 once and then add to it for years. Licenses pile up, former staff keep accounts, sharing settings drift, and nobody is sure which security features are actually on. None of this is unusual, but it means you may be paying for things you do not use and missing protections you already own.

An assessment turns that uncertainty into a list. It tells you what is fine, what is risky, what is wasteful, and what to fix first. It is also useful evidence when an insurer, a client or an auditor asks how your systems are protected.

What a Microsoft 365 assessment covers

Scope varies by provider, but a thorough review usually looks at these areas:

A self-check you can run without admin access

You do not need to be a Microsoft 365 administrator to answer these. Write down your answers, including "I don't know," which is a finding in itself.

If you answered "I don't know" to three or more, an assessment is likely worth the time.

Secure Score and the CIS Benchmark: useful, but not a grade

Microsoft Secure Score is a number in the Microsoft Defender portal that rises as you complete Microsoft's recommended security actions. Microsoft is clear that it measures adoption of controls, not the likelihood of a breach, and that not every recommendation suits every organization.

The CIS Microsoft 365 Foundations Benchmark is a community-developed set of configuration recommendations published by the Center for Internet Security. It is more prescriptive than Secure Score and is widely used as a reference point for Microsoft 365 settings. Neither one is a certification.

Two different NexJen assessments

We offer two fixed-scope engagements that people sometimes confuse. Both are advisory only: we take a read-only look at your tenant, analyze what we find, deliver written risk-rated findings and a roadmap, and walk you through them on a readout call. We make no changes to your tenant during either one.

If you are unsure which fits, start from the decision you need to make. Budget and cleanup questions point to the first. Questionnaires and security reviews point to the second.

A worked example

Take a hypothetical 18-person engineering firm on Microsoft 365 Business Standard. The owner's self-check turns up three "I don't know" answers: who the admins are, whether MFA covers everyone, and how files are shared with clients.

An assessment might find four Global Administrators, two of them former staff whose accounts were never deleted; MFA enforced for most users but not for a shared front-desk account; Anyone links turned on with no expiration; and five licenses assigned to people who left. The roadmap would rank those items by risk, note which fixes cost nothing, and flag where a plan change such as Business Premium would or would not be worth it.

Common mistakes

For the hands-on fixes that usually follow an assessment, see our guide to Microsoft 365 security best practices.

How NexJen can help

Both assessments are fixed-scope, fixed-fee engagements. We do not publish prices because the fee depends on your tenant size and scope; we quote it before you commit. They are open to any business, whether or not you use our managed services, and there is no long-term contract.

Implementation is separate. You can take the roadmap to your own IT team, have us quote the work as a fixed-fee project, or fold it into NexJen Essentials, our managed IT plan.

Common questions