Synthetic sample. No scan performed. Example Practice is fictional. Every check, policy and observation on this page was invented to demonstrate the report format; none is customer evidence.
Cloud Start Solutions
Microsoft 365 security assessment
Example Practice · Illustrative report
- Evidence source
- Hand-authored synthetic data
- Tenant access
- None
- Assessment date
- Not applicable
Executive Summary
Illustrative pass rate
This illustrative report shows how Cloud Start Solutions presents a Microsoft 365 assessment for Example Practice. Of six synthetic checks, two pass and one fails its stated criterion. One needs investigation, one could not complete and one is outside scope.
The first priority is to review the example access policy before changing enforcement. Validate the policy exception and resolve the missing audit evidence separately. These observations do not establish a compromise or an overall business-risk level.
- 6
- Example checks
- 2
- Passed
- 1
- Failed criterion
- 1
- Needs investigation
- 1
- Collection error
- 1
- Outside scope
Scoring Indicators
Illustrative pass rate
- Evaluated checks
- 3 of 6
- Confirmed criterion failures
- 1
- Business risk level
- Requires assessment
- Remediation effort
- Requires scoping
All example check states
- Passed (2)
- Failed (1)
- Investigate (1)
- Error (1)
- Skipped (1)
Coverage before score
Illustrative pass percentage: 67%. 2 of 3 evaluated checks pass. 3 of 6 checks are unresolved or outside scope. Investigation, errors and skipped checks are excluded from the percentage.
This is a test-result proportion, not a breach probability, Microsoft Secure Score or certification. A high percentage with limited coverage can be misleading. Improvement is measured by repeating the agreed checks after approved changes.
Priority Review Actions
| # | Issue | Why it matters | Effort | User impact | Timing |
|---|---|---|---|---|---|
| 1 | Example pilot policy is in report-only modeDEMO-01 · Failed | This example policy does not enforce its requirements. Other policies may still protect the same users. It does not establish that MFA is absent across the tenant or that an account was compromised. | Scope after dependency review | Sign-in changes need a pilot | Before enforcement |
| 2 | Review the purpose of an example policy exceptionDEMO-02 · Investigate | An exception is not automatically a vulnerability. Its membership, owner and purpose need to be reviewed before a finding can be confirmed. | Unknown until reviewed | Confirm affected workflows | Before changing exceptions |
| 3 | Example audit-log query could not completeDEMO-03 · Error | This is a collection failure, not evidence that audit logging is disabled. It is excluded from the pass/fail percentage. | Confirm after access review | Evidence collection only | Before drawing conclusions |
Priorities are illustrative. A real assessment assigns severity after reviewing exposure, business impact and compensating controls. Timing is agreed during scoping.
Evidence and Remediation Detail
Example pilot policy is in report-only mode
Severity: Illustrative medium; confirm against business context.
Current state and evidence
Synthetic policy: Example pilot policy. State: enabledForReportingButNotEnforced. Agreed example criterion: the approved pilot policy should enforce its configured requirements.
What this means
This example policy does not enforce its requirements. Other policies may still protect the same users. It does not establish that MFA is absent across the tenant or that an account was compromised.
Recommended next step
Review overlapping policies and exceptions, validate the pilot group and emergency access arrangements, then obtain change approval before enabling enforcement.
Impact of a change
A change could block legitimate sign-ins. Test the change with representative users and agree on a rollback trigger before rollout.
Validation
Check permitted and blocked sign-in scenarios, confirm emergency access, inspect relevant logs and rerun the scoped check. A passing test alone does not validate every workflow.
Suggested owner: Tenant administrator and business approver. Effort: Scope after dependency review.
Review the purpose of an example policy exception
Severity: Not assigned; evidence pending.
Current state and evidence
The synthetic policy includes an exception group. Its business purpose and compensating controls have not been supplied in this example.
What this means
An exception is not automatically a vulnerability. Its membership, owner and purpose need to be reviewed before a finding can be confirmed.
Recommended next step
Ask the policy owner to document the purpose, membership, review date and alternative protections. Record whether a change is justified.
Impact of a change
Removing a justified exception without testing could interrupt an application or business process.
Validation
Have the owner approve the disposition and test affected workflows if a change is agreed. Preserve justified exceptions in the assessment record.
Suggested owner: Application owner and tenant administrator. Effort: Unknown until reviewed.
Example audit-log query could not complete
Severity: Not applicable; collection error.
Current state and evidence
The synthetic query returned an access error. No audit-log results were collected for this example check.
What this means
This is a collection failure, not evidence that audit logging is disabled. It is excluded from the pass/fail percentage.
Recommended next step
Verify the approved permission and licence requirements. Retry within the authorised scope or record the check as unavailable; do not request broader access automatically.
Impact of a change
No tenant configuration change is justified by this error alone.
Validation
Confirm a successful scoped query with a collection timestamp, or document the remaining limitation. Do not relabel an error as a failed control.
Suggested owner: Assessment engineer. Effort: Confirm after access review.
Remediation roadmap
- Validate. Resolve the evidence gaps and review exceptions with the business and system owners.
- Scope and approve. Agree on the paid work, confirm the affected users and required licences, and approve the acceptance criteria, change windows and rollback plan.
- Pilot and verify. Test agreed changes with representative users before rollout; check business workflows and scoped controls.
- Handover. Document the result, assign ongoing ownership and confirm removal of temporary assessment access.
We confirm dates and costs after agreeing on the scope. No future score or risk reduction is promised.
Methodology and limitations
This sample follows the structure of a configuration assessment but contains no automated or manual scan results. A real report identifies the authorised scope, collection time, tool versions, permissions and evidence limitations. Technical recommendations require engineer review.
A Microsoft 365 configuration review does not by itself establish endpoint health, restore capability, user behaviour, incident history or the adequacy of every business process. A public domain check cannot inspect tenant policies.
All synthetic check states
- Failed · DEMO-01: Example pilot policy is in report-only mode
- Investigate · DEMO-02: Review the purpose of an example policy exception
- Error · DEMO-03: Example audit-log query could not complete
- Skipped · DEMO-04: Backup recovery is outside this example scope
- Passed · DEMO-05: Example guest invitation setting matches the agreed baseline
- Passed · DEMO-06: Example administrator inventory is documented
A clear next step, without a commitment to buy
The free assessment provides an executive summary, prioritised findings with evidence limitations and a discussion. Any remediation is separately scoped and approved. Ongoing managed services are optional.