Eliminate Microsoft 365 Blind Spots Before Attackers Exploit Them.
Probatio's specialized M365 Security Check conducts an exhaustive deep scan of your tenant in under 10 minutes. Uncover hidden BEC forwarding rules, dangerous Entra ID privilege escalations, toxic OAuth applications, and phishing waves – backed by court-certified forensic experts.
The Microsoft "Shared Responsibility" Model
Many organizations fall victim to a dangerous assumption: "We are in the Microsoft cloud, so we are inherently secure." This is a fatal misconception. Over 80% of all successful cloud compromises stem from tenant misconfigurations on the customer side.
Microsoft's Responsibility
Physical Cloud InfrastructureMicrosoft guarantees the physical resilience and uptime of its global data centers:
Your Responsibility (100% Customer)
Direct Attack SurfaceSecuring your identities, data assets, and access configurations rests solely on you:
The Probatio M365 Security Check illuminates precisely the 100% customer responsibility surface where Microsoft bears no liability.
The 6 Pillars of M365 Threat Detection & Hardening
Focused high-impact indicators for Business Email Compromise, Entra ID persistence, and phishing waves – backed by forensic hardening, proven best practices, and court-certified expert witness expertise. Explore all 6 dimensions:
Pillar 1: Identity & Access Management (Entra ID)
Identities are the primary modern perimeter. Our Entra engine inspects administrative roles, newly created accounts and devices, authentication methods, and risk states.
Privileged Role Assignments & Privilege Escalation
Continuous audit of high-privilege directory roles (Global Administrator, Privileged Role Administrator, Security Admin, Exchange Admin). Immediate alerting on unapproved role grants.
New User Accounts & Device Registrations
Surveillance of recently created user accounts and newly registered devices across the lookback window. Spots covert backdoor identities and unmanaged rogue hardware.
MFA Method Inventory & Admin Factor Tampering
Granular inventory of registered MFA methods (FIDO2, Authenticator, Phone) per user, detecting legacy auth fallbacks and unauthorized MFA additions or deletions on privileged accounts.
Entra ID Risky Users & Foreign MFA Failures
Direct interrogation of Entra ID Protection (atRisk / confirmedCompromised) and detection of sign-ins failing MFA originating from outside Austria or operational zones.
Pillar 2: Conditional Access & Zero Trust Architecture
Context-aware access policies protect corporate assets. entra-watch continuously tracks every policy change to detect dangerous configuration drift.
Conditional Access Policy Mutations & Drift
Automated state diffing of all Conditional Access policies. Immediate alerting on policy disabling, condition loosening, or added exclusion lists.
Tenant-Wide Authentication Methods Policy
Continuous monitoring of tenant-wide AuthenticationMethodsPolicy settings, defending against unauthorized activation of weak factors or SMS fallback.
High-Risk Sign-Ins & Session Anomaly Audit
Detection of sign-in events with aggregated risk levels (atRisk / confirmedCompromised), client-app anomalies, and suspicious Conditional Access evaluations.
Non-Operational Geolocation Sign-In Attempts
Evaluates sign-in attempts originating outside of Austria and defined trusted boundaries against configured Named Locations.
Pillar 3: Email Hygiene, BEC & Phishing Defense
Email remains the primary attack vector for CEO fraud and payload delivery. Our BEC and Phish-Watch engines detect attacks in real time with privacy-preserving in-memory heuristics.
Illegitimate Forwarding & Deletion Rules (BEC)
Automated deep scan for covert mailbox rules with external forward, redirect, or delete actions configured to conceal financial and invoice tampering.
In-Memory Phishing Wave & Campaign Detection
Real-time campaign fingerprinting detecting identical phishing waves across multiple internal mailboxes. 100% ephemeral in RAM with zero storage of email content.
Password Disclosed in Body for Encrypted Attachments
Heuristic detection of password-protected archives (.zip, .7z, .rar) accompanied by plaintext password disclosure in the email body to bypass standard gateway scanners.
Heuristic Link Intelligence & Credential Bait
Multi-attribute link scoring: IP-literal hosts, URL shorteners, login-path keywords, payload deliveries, and cloud share masquerades correlated with urgency bait language.
Pillar 4: SharePoint, Exposure & Shadow IT
Uncontrolled external file sharing and shadow cloud tools risk confidential assets. We combine user deep dives with forensic hardening advisory.
Forensic Compromised Account Deep-Dive
Targeted forensic triage for suspected accounts: Mailbox forwarding rules, sign-in history, registered devices, OAuth grants, and outbound mail reconstructed end-to-end.
Outbound Phishing & Repeated Link Hosts
Detection of recurring external destination domains across sent emails, identifying accounts actively hijacked to deliver outbound phishing to customers and partners.
Security-Relevant Group Modifications
Tracks membership and permission changes across security-enabled groups and role-assignable groups, filtering out benign administrative background noise.
Forensic Tenant Exposure & Sharing Hardening
Court-certified expert analysis of anonymous file sharing links, guest collaborator lifecycles, and cloud sync policies with actionable hardening steps.
Pillar 5: OAuth Applications & Illicit Consent Hygiene
Illicit application consents and hijacked service principals are premier covert backdoors. We track every enterprise app and secret credential addition.
Illicit OAuth2 Delegated Permission Grants
Monitors all delegated OAuth2 permission grants against high-risk scopes like `Mail.ReadWrite`, `Files.ReadWrite.All`, or `Directory.AccessAsUser.All`.
Service Principal Credentials & Secret Additions
Immediate real-time alerting whenever new client secrets or certificates are attached to existing applications or service principals in Entra ID.
New Enterprise Apps & Service Principals
Identifies newly registered applications and service principals across the tenant, including target audience types and initiating audit actors.
Admin Consent Workflows & App Governance
Actionable guidance on revoking open end-user consent policies, establishing mandatory admin consent approvals, and enforcing app governance.
Pillar 6: Audit Logging, NIS-2 & Forensic Readiness
Immutable audit logging and expert forensic incident support. We combine continuous audit deltas with court-certified DFIR expertise.
Continuous Directory Audit Delta Streaming
Granular delta extraction of security-relevant directory operations (role assignments, policy updates, password resets, auth registrations) with actor UPN and IP.
Local AI Pattern Recognition & Severity Floor
Multi-event correlation (e.g. new app + consent grant + role assignment) evaluated by local LLMs with an unbreakable deterministic severity floor.
1-on-1 Expert Witness Debriefing & Playbooks
Dedicated consultation with Probatio's court-certified DFIR experts, delivering prioritized remediation playbooks with exact Graph and PowerShell remediation steps.
Court-Certified NIS-2 & GDPR Evidence
Certified audit evidence establishing state-of-the-art security measures (GDPR Art. 32) and mandatory supply chain risk management under NIS-2.
M365 Guardian vs. One-Time Audits
Microsoft introduces hundreds of setting adjustments every month. At the same time, internal IT admins continually adjust policies during daily operations. A static audit is merely a snapshot – M365 Guardian continuously protects you against dangerous configuration drift.
| Security Capability | Traditional One-Time Audit | Probatio M365 Guardian |
|---|---|---|
| Scan Frequency How often is the M365 tenant evaluated? | Once on audit date | Daily fully automated (24/7) |
| Configuration Drift Detection Alerts when MFA or policies are accidentally weakened | ||
| Microsoft Defaults Alignment Automatic inclusion of new M365 threat patterns and indicators | ||
| Smart Risk Management Workflow Mark findings as Accepted (with justification) or Solved | ||
| Re-Emerging Vulnerability Watchdog Alerts if a previously resolved vulnerability is re-introduced | ||
| Forensic Expert Debriefing 1-on-1 strategic session with court-certified DFIR specialists | Single 60-min session |
Smart Risk Management in the Live Portal
Not every issue is critical and sometimes accepting a risk is a necessary business decision. With Probatio M365 Guardian, you retain complete governance:
Eliminate assumptions. Certified evidence readiness for cyber insurance and NIS-2.
Explore Guardian PackageConcrete, Actionable Results
We deliver actionable intelligence rather than unmanageable raw logs.
1. Executive Scorecard
Board-level risk summary, indicator score, and executive heatmap tailored for C-suite decision-makers.
2. Remediation Playbook
Step-by-step technical remediation guidelines with exact PowerShell scripts, Graph API queries, and admin clickpaths.
3. Forensic 1-on-1 Debriefing
A 60-minute interactive deep-dive with a court-certified digital forensics specialist to prioritize remediation steps.
4. Interactive Live Portal
Continuous access to our cloud dashboard to filter findings, track configuration drift, and export compliance proof.
Complete Tenant Audit in 3 Steps
Zero software installations, zero local agents, zero access to private emails. Ready in under 10 minutes.
Read-Only App Connection
Your administrator authorizes our certified Microsoft Entra Enterprise App. We request strictly read-only security permissions (e.g. `Reports.Read.All`).
Automated Deep Scan & Delta Analysis
Our specialized engines interrogate your tenant for BEC indicators, hidden mailbox rules, unapproved Entra ID privileges, and phishing patterns.
Scorecard & Forensic Debriefing
Immediately access your online scorecard and actionable playbook. Join your 1-on-1 session with our forensic engineers to review findings.
Tailored Service Packages
Choose between a comprehensive baseline audit or continuous ongoing protection with M365 Guardian.
M365 Baseline Audit
One-time in-depth posture evaluation – ideal for baseline hardening and initial compliance audits.
M365 Guardian
Continuous 24/7 posture management with automatic drift alerts and daily re-scans.
Enterprise Retainer
For large corporations, multi-tenant groups, and regulated industries requiring guaranteed 24/7 DFIR SLAs.
Preview: Security Cockpit (Explored in your live demo call)
Experience modern Posture Management: Filter findings by severity, track configuration drift in real-time, and delegate remediation tasks directly to your internal engineering team.
- Central dashboard for M365 threat detection & posture drift
- Audit-proof justification log for accepted business risks
- 1-click evidence export for NIS-2 and cyber insurance renewals
Clear Answers to Common Questions
Everything you need to know about permissions, privacy, regulatory compliance, and setup.
The Probatio scanner application requests strictly read-only permissions (such as `SecurityReader`, `Reports.Read.All`). Zero write permissions are requested. We cannot alter configurations, reset user passwords, or delete data. Your Global Administrator can revoke the enterprise app with a single click at any time inside the Microsoft Entra admin center.
No, absolutely not. Our check inspects metadata, access policies, configuration settings, and administrative switches. We neither request nor possess any access rights to read mailbox contents, Teams chat transcripts, or files stored in OneDrive and SharePoint.
Microsoft's native Secure Score is designed to encourage customers to purchase higher-tier Microsoft licenses (such as E5 or Intune). Probatio provides independent, vendor-agnostic auditing strictly against real attack and persistence patterns (Business Email Compromise, toxic OAuth consents, Entra configuration drift). We show you how to maximize resilience even with standard Business Premium or E3 licenses – accompanied by court-certified forensics experts who understand real-world adversary behavior.
Under NIS-2, entities are required to maintain state-of-the-art cybersecurity risk management and supply-chain hygiene. GDPR Article 32 mandates regular testing, assessing, and evaluating the effectiveness of technical measures. Our Executive Scorecard report serves as formal, audit-ready proof for auditors, regulatory authorities, and cyber insurance providers.
Authorizing the Microsoft Entra app takes less than 5 minutes. The automated deep scan across all specialized security indicators completes in roughly 10 minutes. Your findings become visible in the dashboard immediately. Your 1-on-1 debriefing session is scheduled flexibly at your convenience.
Ready to Secure Your M365 Environment?
Book a free, guided live demo or non-binding initial consultation with our senior digital forensics engineers directly online.
Schedule a Guided Live Demo
Select a convenient slot for a guided live walkthrough (15–30 min) directly on our calendar. We will demonstrate the Security Cockpit and discuss tailored quick wins for your tenant.
Email Inquiry
Have custom enterprise procurement guidelines or require a formal RFP response?
office@probatio.netResponse within one business day