Free · Complete · Yours to keep
A real assessment of your Microsoft 365, within an hour of connecting it
Not a maturity score. Not a 40-page template with your logo on it. A report that names Anna and Marek, tells you that both of them can delete every mailbox in the business and read email with those same accounts, and estimates the fix at ten minutes each.
- 82
- deterministic checks
- ~30 min
- unattended discovery
- 12
- read-only Graph calls
- 0
- writes before you approve
The whole report is free and permanent — findings are not blurred, gated or summarised behind a sales call. A prospect who has read their own tenant's findings has been persuaded by their own business rather than by us, which is worth considerably more.
Free, no card. You will connect Microsoft 365 read-only after signing up.
Sample output. The findings, reasoning and remediation text are the product’s own, verbatim. The names are invented.
- Blast radius
- Every mailbox and every account in the tenant
- Why it matters
- An account that reads email all day is exposed to every phishing message that arrives. When that same account can delete everything the business has in Microsoft 365, one bad click is the end of the business rather than an inconvenience.
- What the attacker does
- The attacker sends a convincing invoice. The admin opens it on the account that can disable every other account and switch off the audit log, so nobody can see what was taken or undo it.
- The fix
- Give each of these people an ordinary account for daily work and keep the admin account for admin only, with a hardware-backed passkey on it. About ten minutes per person.
- Why it is in “only you can decide”
- this is a business trade-off the platform does not have the facts to decide
Mapped obligations:NIS2 Art 21(2)(i)NIS2 Art 20CIS M365 1.1.4ISO 27001 A.8.2
How it works
Discovery is deterministic. Assessment is deterministic. Only the writing is not.
Four architectural decisions do most of the work here, and all four are about keeping a language model away from anything it could get wrong in an unrecoverable way.
Minute 0
One connection
You create an application registration in your own Microsoft tenant, grant it read permissions, and paste three values into Qorionix. Nothing is written to your tenant at this stage; every call discovery makes is a read.
We ask for read access to your directory, your sign-in methods, your administrator roles, your Conditional Access policies, your licences, your devices, your application consents, your sign-in logs and inbox rules. Each one maps to specific checks, and the full list with the reason for every permission is published.
Minutes 1–30
Deterministic discovery
Twelve read calls against Microsoft Graph build an inventory of who exists, who can do what, what is registered, what is consented and what has been signing in. Never a language model — an inventory is a fact, and a hallucinated asset is unrecoverable poison.
Requests ask only for the fields the checks actually read. Graph returns a much larger default projection; not taking it keeps responses small and avoids pulling personal data we have no purpose for, which is a data-minimisation requirement rather than an optimisation.
Immediately after
82 deterministic checks
A versioned pack, not model output. “Count of accounts holding Global Administrator is greater than two” is a comparison, not a judgement call. Each check that fires produces a finding naming the actual accounts, applications or devices involved.
A check that cannot see its data is reported as skipped, never as passed. If your licence tier does not emit sign-in detail, the affected checks say so — because that is how a licence limitation would otherwise become a false all-clear.
Same session
A report written for you, not for a CISO
The model's only job is narration over verified structured facts: “you have three administrators, two of whom read email with those accounts, and here is what one bad click costs” rather than “MFA coverage: 40%”. If no model is configured, a deterministic narrator writes it instead and the product still works.
Every finding states why it matters in business terms, what an attacker actually does with it, the fix and roughly how long the fix takes, and the compliance obligations it touches. Those four fields are mandatory — the build fails on a check that omits one.
One tap each
A change set in three buckets
What we already did, what needs your approval, and what only you can decide. The first bucket is nine specific reversible changes from a closed allowlist; every multi-factor and Conditional Access change is deliberately excluded from it.
Every change carries a recorded undo handle before it is applied, including the human-readable reversal path, shown next to the undo control so you are never guessing. An unnecessary approval costs a click; a wrong autonomous change costs trust.
The check pack
What gets checked
Nine categories in the shipping pack, m365-2026.08.1. Twelve of the 82 are critical, twenty-one are high. Every finding names real objects — a finding with a blast radius and no named subjects is rejected as a bug, because a finding you cannot act on should not exist.
- 13
- Privilege
- Who can delete the business, and whether they read email with that account.
- 12
- Authentication
- Second factors, passkeys, and the old protocols that bypass both.
- 11
- Access policy
- Whether your sign-in rules exist, are switched on, and actually apply. Report-only counts as zero protection.
- 11
- Account hygiene
- Dormant accounts, unaccepted guests, shared logins, leftover on-premises admins.
- 9
- Exposure
- Forwarding rules, concealment rules, impossible geography, unmanaged mail clients.
- 8
- Devices
- Unmanaged and non-compliant machines, unsupported operating systems, tampered phones.
- 7
- Applications
- What your OAuth consents can read, send and change — and who the publisher is.
- 6
- Logging
- Whether anything is being recorded, and for long enough to investigate.
- 5
- Licensing
- Seats nobody uses, security features you already pay for and have not switched on.
What the report will not tell you
Where the assessment stops
A free assessment that overstates its own coverage is worse than none, because you would act on it. Three limits are worth knowing before you read yours.
It sees Microsoft 365, not your whole business
The assessment covers your Microsoft tenant. Your on-premises server, your line-of-business application and the laptop somebody bought themselves are outside it until the endpoint sensor is installed. The report says which parts of the estate it could not see.
It cannot see what your licence does not emit
Sign-in log analysis and Conditional Access evaluation need Entra ID P1, which is included in Business Premium and not in Business Standard. Where the data is unavailable, the affected checks are marked skipped and we tell you what the upgrade would add before you decide.
It is a snapshot, not monitoring
A posture assessment tells you the state of your tenant now. It does not detect the intrusion that starts tomorrow — that is the detection library's job, and it needs your logs flowing and a fortnight to learn what normal looks like.
Read your own findings
Connect Microsoft 365 and read your own report. If it tells you something you already knew, you have lost twenty minutes. Most people find at least one thing they did not.
No card. No sales call before you have read the report.