AZ Innovations

Microsoft 365 & Azure
Evidence Deliverable

Microsoft Environment Risk Scorecard

A fixed-fee, read-only diagnostic of identity, data, cost, and resilience risk across a Microsoft 365 and Azure estate, scored for leadership.

This is a composite example, not a client report. The firm, the figures and the findings reflect patterns seen repeatedly in Microsoft estates of this size, and no single client is described here.

1Engagement overview

Background and objectives

A 120-user professional-services firm had grown its Microsoft estate organically over a decade and inherited it through an MSP handover. Leadership could not get a straight answer to three questions: what is actually risky, what is being wasted, and what to fix first. With a cyber-insurance renewal approaching, "are we actually secure?" had become a board-level question. They wanted a plain-English picture and a practical first step, not a forty-page audit or an open-ended retainer.

Methodology

This is run as a fixed-fee, read-only review across four domains: initial findings scored within five business days, full delivery in 10 business days once scope is confirmed and read-only access works, and no production changes at any point. Every finding is scored by severity and rolled into one Risk Index, ranked for leadership.

• Identity: authentication methods, legacy authentication, admin roles, MFA coverage, guest access.
• Data: external sharing, broad-access groups, sensitive locations, sensitivity-label readiness.
• Cost: license assignment and waste, unused features, duplicate or oversized plans.
• Resilience: backup coverage and, critically, whether a restore had ever been tested.

2Executive scorecard

Posture by domain

3Findings

• Identity, critical. Legacy authentication was still enabled, and two of the four global admins used app-push MFA rather than phishing-resistant methods, which adversary-in-the-middle kits can bypass.
  How this was found: sign-in log export filtered to legacy protocols, plus the per-admin authentication methods report. Your IT can pull the same two exports in an hour.
• Data, critical. Several "everyone" sharing links exposed HR and finance libraries, and no sensitivity labels were in use, so nothing was classified or protected.
• Cost, high. Roughly 22% of license spend was wasted: unassigned licenses, oversized plans, and add-ons the firm already owned but never enabled.
  How this was found: license assignments cross-referenced against last-activity dates. The waste hides in departed users and add-ons nobody ever enabled.
• Resilience, high. Backups were assumed but had never been restore-tested, so the real recovery time was unknown.
• The remaining three high and eight medium findings spanned stale guest accounts, missing Conditional Access coverage, an unowned Azure resource group, and administrator accounts holding more permission than they needed.

4Ranked recommendations

1. Disable legacy authentication and move all admins to phishing-resistant MFA.
2. Remediate the "everyone" links on HR and finance, then introduce sensitivity labels.
3. Right-size licensing to recover the wasted spend and fund the remediation.
4. Run one controlled restore test to prove recovery time, then close the backup gaps. The test itself sits outside this read-only review and is quoted separately.

5The first step

In this example the recovered license spend covers the fee for the assessment several times over, and the ranked list becomes the scope for a separate fixed-price remediation. What your own tenant yields depends on what is actually in it.