---
title: "M365 Security Configuration Review"
type: article
version: 1
version_id: "27c60596-004c-4fa1-8fda-1b50c95cba5d"
generated_at: "2026-09-23T07:10:12.367Z"
author: "ANZ organisations Including Temple"
language: en
reading_time: "12 min"
word_count: 2242
keywords: ["M365 Security Configuration Review"]
url: "https://insiconcyber.com/m365-security-review"
---
# M365 Security Configuration Review
## Key Takeaways
- Don't wait for Microsoft's deadline to find out what's misconfigured.
- M365 Security Configuration Review pricing
- Book Your Review
- Frequently asked questions
## Contents
- [Don't wait for Microsoft's deadline to find out what's misconfigured.](#don-t-wait-for-microsoft-s-deadline-to-find-out-what-s-misconfigured)
- [M365 Security Configuration Review pricing](#m365-security-configuration-review-pricing)
- [Book Your Review](#book-your-review)
- [Frequently asked questions](#frequently-asked-questions)
Skip to the main content.
[Contact Insicon Cyber](https://cta-ap1.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIKz7Qr8EZXDHjNn9DxW6YuIUxelxyknI4aHGxzj1LAYJqEevvvY4XwdcjMurqgi00qM4PJcvUZl7ARQzwU%2FRgf35wnAeYoDZLypbFiixhtRHCfKaGC2kc9vCyfk%2BVAtbzlrt1oTFuBlJbeuthup0lsgBhzuzzGa2iOmz0CLc5207HW&portalId=22526539&webInteractiveContentId=185537949708&webInteractiveId=400917561141&containerType=EMBEDDED&campaignId=455dafe1-9d18-4fca-9d14-65aa6db10ff2&pageUrl=https%3A%2F%2Finsiconcyber.com%2Fm365-security-review&pageTitle=M365+Security+Configuration+Review&referrer=&userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F130.0.0.0+Safari%2F537.36&hutk=&hssc=&hstc=&pageId=382159492551)
[Linkedin](https://www.linkedin.com/company/insicon-cyber) [YouTube](https://www.youtube.com/@insiconcyber)
⏱ Microsoft makes passkeys the default from 1 Sept 2026 · SMS/voice MFA retires entirely 1 Feb 2027
Cyber Security Awareness Month 2026 · Assumed Breach, Actual Fix
# Is Your M365 Tenant Actually Secure?
Most Australian and New Zealand organisations running M365 have never had their tenant security configuration reviewed. A fixed-scope review tells you exactly what's on, what's off, and what to fix — before Microsoft forces the issue for you.
Book Your M365 Security Review
19%
of Australian businesses reported email compromise with no financial loss — the top self-reported cybercrime threat (ASD, 2024–25)
32%
of Australian organisations rank business email compromise as their single most troubling threat (Moxie Insights, 2025–26)
595
data breach notifications in just six months (Jul–Dec 2024) — the highest half-year total since reporting began (OAIC)
### Identity and access, reviewed properly
Conditional Access policy coverage, MFA method policy including SMS/voice usage and passkey readiness, legacy authentication protocols, privileged and Global Admin role assignment, and guest and external user access.
### Email security and data sharing, locked down
SPF, DKIM and DMARC configuration, Exchange Online mail flow and external forwarding rules, SharePoint and OneDrive external sharing defaults, and data loss prevention policy coverage.
### Monitoring, licensing and governance, made visible
A Secure Score benchmark, audit logging and retention policy coverage, and a gap analysis between the security features you're already licensed for and what's actually configured.
Cyber Security Awareness Month 2026
## Don't wait for Microsoft's deadline to find out what's misconfigured.
A fixed-scope review tells you exactly what's on, what's off, and what to fix — before 1 February 2027, when SMS and voice MFA disappear entirely.
Book Your Review [Talk to Our Partner Team](mailto:info@insiconcyber.com?subject=MDR%20Partner%20Programme%20enquiry)
### Why organisations trust Insicon Cyber
ISO 27001 certified
Organisational-level certification, not just client-facing advice
Founder-led delivery
Matt Miller and Greg Bunt, Co-Founders and Fractional CISOs, stay close to client engagements
Trusted by ANZ organisations
Including Temple & Webster and James Milson Village
Award-winning
Retail Cyber Security Partner of the Year, 2025 Benchmark Security Awards
## M365 Security Configuration Review pricing
### 50–100 seats
For organisations running a single M365 tenant with 50 to 100 seats.
AU$10,000 ex GST
#### What's included
- Identity and access review (Conditional Access, MFA, passkey readiness)
- Email security and data sharing audit
- Secure Score benchmark
- Prioritised findings report and fixed-scope remediation quote
Book your review
### 100+ seats
For larger ANZ organisations and corporates running M365 at scale.
AU$15,000 ex GST
#### What's included
Book your review
### MSP and partner
Managing M365 security across multiple client tenants? Ask about the MDR Partner Programme.
Custom pricing
#### Built for MSPs
- Multi-tenant review pricing
- A wedge into a fuller MDR Partner Programme conversation
- Aware, Active and Adaptive partner tiers available
[Talk to our partner team](mailto:info@insiconcyber.com?subject=MDR%20Partner%20Programme%20enquiry)
## Book Your Review
## Frequently asked questions
Why run this review now?
Microsoft is retiring SMS and voice MFA in favour of passkeys, with passkeys becoming the default authentication method from 1 September 2026 and full retirement from 1 February 2027. Most Australian and New Zealand organisations running M365 have never had their tenant configuration reviewed end to end, and this deadline is forcing the issue.
What does the review actually check?
Identity and access (Conditional Access, MFA method policy, legacy authentication, privileged roles, guest access), email security (SPF, DKIM, DMARC, mail flow rules), data sharing (SharePoint and OneDrive external sharing, DLP), device and app access, and monitoring, licensing and governance.
What do we receive at the end?
A findings report ranked by severity, a Secure Score benchmark, and a fixed-scope quote for remediation if you'd like us to action the findings.
Do we have to engage Insicon Cyber to fix what you find?
No. You can keep the report and action the findings yourselves, or engage Insicon Cyber as a professional services project. We set out a clear RASCI for both paths before you decide.
Do you work with organisations outside Australia?
Yes. We work with organisations across Australia and New Zealand.