ISO 27001 certified
for Modern Work
Sign-in locations
We review up to 90 days of Microsoft Entra ID and mailbox sign-in logs for sign-ins from unexpected countries, impossible travel and suspicious IP addresses.
MFA status
We check multi-factor authentication on every account. An account with only a password is one of the easiest ways into a Microsoft 365 tenant.
Secure Score
We assess your Microsoft Secure Score and pick out the recommendations that will make the biggest difference to your security.
Forwarding rules
We scan every mailbox for automatic forwarding rules. Attackers often add hidden forwarding rules after they get into an account, so this is one of the first things we check.
Transport rules
We review the Exchange transport rules that control how email flows through your business. A badly set rule can bypass spam filtering, send data outside or redirect sensitive messages.
Shared mailboxes
Shared mailboxes with direct sign-in turned on are a common gap. We check for ones that could be reached without multi-factor sign-in and recommend the right setup.
Mobile devices
We list the mobile devices connected to your Microsoft 365 and check whether device management policies are in place. Unmanaged devices with company data on them are a real risk.
Authorised apps
We review the third-party applications staff have allowed into their Microsoft 365 data. An app with too much access, or a malicious one, can read email and files without anyone knowing.
External sharing
We review SharePoint and OneDrive external sharing over the past 90 days. Uncontrolled sharing is a common way sensitive documents end up outside the business without anyone noticing.
A clear summary of where your security stands across identity, email, data and devices. We score each area and show how it compares with Microsoft’s recommended baselines.
A ranked list of improvements ordered by impact and effort. We do not just point out problems. We tell you what to do about each one, in plain English, with the most important at the top.
We review your Microsoft 365 licences and show where upgrading or consolidating would add security features you are missing, or that you are paying for separately.
Examples of the alerts that become available once monitoring is in place, such as forwarding rule detection, impossible travel alerts and mass deletion events.
We map your setup against the Notifiable Data Breaches scheme and the Essential Eight, so you know which requirements you meet and where the gaps are.
A practical plan to put the recommendations in place, split into quick wins we can fix straight away and longer-term improvements. If you choose to work with us, we can do all of it for you.
01
We talk about your current setup, any worries you have and what you want to learn, so the audit fits your business.
02
We ask for read-only access to your Microsoft 365 tenant. That lets us review settings and logs without changing anything.
03
Our tools scan your tenant for known misconfigurations. We then review the results by hand, check them against current threats and build your report.
04
We send your report and walk you through the findings on a video call, explaining what each issue means in practice and answering your questions.
Businesses with an annual turnover over $3 million are covered by the Privacy Act, and some smaller ones are too. A covered business must report a data breach that is likely to cause serious harm to the OAIC and the people affected.
Health service providers are covered by the Privacy Act whatever their turnover.
Since December 2022, the maximum civil penalty a court can order against a company for a serious interference with privacy is the greater of $50 million, three times the benefit obtained or, if the benefit can’t be worked out, 30% of its adjusted turnover during the breach period.
An audit shows whether your Microsoft 365 has the controls you need to detect, contain and report a breach.
The Australian Signals Directorate’s Essential Eight is the baseline cyber security framework for Australian organisations. It was first written for government agencies, but cyber insurers, industry regulators and government buyers increasingly refer to it.
Our audit checks several Essential Eight controls in Microsoft 365, including multi-factor authentication, restricting administrative privileges and regular backups.
Many businesses we audit find their Microsoft 365 licences already include features that help, but nobody has set them up. The audit finds these, so you can close the gaps without buying more software.
As at October 2026
The Gold Coast’s highest-rated MSP on Google. 166 reviews, more than any other Gold Coast managed IT provider rated 5.0.
Reviewed by Elliot Munro, CISO at GCIT and Microsoft Certified: Cybersecurity Architect Expert.
