============================================================ TITLE: M365 Security Configuration Review TYPE: article VERSION: 1 VERSION_ID: 27c60596-004c-4fa1-8fda-1b50c95cba5d GENERATED_AT: 2026-09-23T07:10:12.367Z AUTHOR: ANZ organisations Including Temple READING TIME: 12 min WORD COUNT: 2242 KEYWORDS: M365 Security Configuration Review SOURCE URL: https://insiconcyber.com/m365-security-review ============================================================ KEY TAKEAWAYS: * Don't wait for Microsoft's deadline to find out what's misconfigured. * M365 Security Configuration Review pricing * Book Your Review * Frequently asked questions Contact Insicon Cyber Linkedin YouTube ⏱ Microsoft makes passkeys the default from 1 Sept 2026 · SMS/voice MFA retires entirely 1 Feb 2027 Cyber Security Awareness Month 2026 · Assumed Breach, Actual Fix Is Your M365 Tenant Actually Secure? Most Australian and New Zealand organisations running M365 have never had their tenant security configuration reviewed. A fixed-scope review tells you exactly what's on, what's off, and what to fix — before Microsoft forces the issue for you. Book Your M365 Security Review 19% of Australian businesses reported email compromise with no financial loss — the top self-reported cybercrime threat (ASD, 2024–25) 32% of Australian organisations rank business email compromise as their single most troubling threat (Moxie Insights, 2025–26) 595 data breach notifications in just six months (Jul–Dec 2024) — the highest half-year total since reporting began (OAIC) Identity and access, reviewed properly Conditional Access policy coverage, MFA method policy including SMS/voice usage and passkey readiness, legacy authentication protocols, privileged and Global Admin role assignment, and guest and external user access. Email security and data sharing, locked down SPF, DKIM and DMARC configuration, Exchange Online mail flow and external forwarding rules, SharePoint and OneDrive external sharing defaults, and data loss prevention policy coverage. Monitoring, licensing and governance, made visible A Secure Score benchmark, audit logging and retention policy coverage, and a gap analysis between the security features you're already licensed for and what's actually configured. Cyber Security Awareness Month 2026 Don't wait for Microsoft's deadline to find out what's misconfigured. A fixed-scope review tells you exactly what's on, what's off, and what to fix — before 1 February 2027, when SMS and voice MFA disappear entirely. Book Your Review Talk to Our Partner Team Why organisations trust Insicon Cyber ISO 27001 certified Organisational-level certification, not just client-facing advice Founder-led delivery Matt Miller and Greg Bunt, Co-Founders and Fractional CISOs, stay close to client engagements Trusted by ANZ organisations Including Temple & Webster and James Milson Village Award-winning Retail Cyber Security Partner of the Year, 2025 Benchmark Security Awards M365 Security Configuration Review pricing 50–100 seats For organisations running a single M365 tenant with 50 to 100 seats. AU$10,000 ex GST What's included Identity and access review (Conditional Access, MFA, passkey readiness) Email security and data sharing audit Secure Score benchmark Prioritised findings report and fixed-scope remediation quote Book your review 100+ seats For larger ANZ organisations and corporates running M365 at scale. AU$15,000 ex GST What's included Book your review MSP and partner Managing M365 security across multiple client tenants? Ask about the MDR Partner Programme. Custom pricing Built for MSPs Multi-tenant review pricing A wedge into a fuller MDR Partner Programme conversation Aware, Active and Adaptive partner tiers available Talk to our partner team Book Your Review Cyber Security Awareness Month 2026 · Assumed Breach, Actual Fix # Is Your M365 Tenant Actually Secure? Most Australian and New Zealand organisations running M365 have never had their tenant security configuration reviewed. A fixed-scope review tells you exactly what's on, what's off, and what to fix — before Microsoft forces the issue for you. of Australian businesses reported email compromise with no financial loss — the top self-reported cybercrime threat (ASD, 2024–25) of Australian organisations rank business email compromise as their single most troubling threat (Moxie Insights, 2025–26) data breach notifications in just six months (Jul–Dec 2024) — the highest half-year total since reporting began (OAIC) ### Identity and access, reviewed properly Conditional Access policy coverage, MFA method policy including SMS/voice usage and passkey readiness, legacy authentication protocols, privileged and Global Admin role assignment, and guest and external user access. ### Email security and data sharing, locked down SPF, DKIM and DMARC configuration, Exchange Online mail flow and external forwarding rules, SharePoint and OneDrive external sharing defaults, and data loss prevention policy coverage. ### Monitoring, licensing and governance, made visible A Secure Score benchmark, audit logging and retention policy coverage, and a gap analysis between the security features you're already licensed for and what's actually configured. Cyber Security Awareness Month 2026 ## Don't wait for Microsoft's deadline to find out what's misconfigured. A fixed-scope review tells you exactly what's on, what's off, and what to fix — before 1 February 2027, when SMS and voice MFA disappear entirely. ### Why organisations trust Insicon Cyber ISO 27001 certified Organisational-level certification, not just client-facing advice Founder-led delivery Matt Miller and Greg Bunt, Co-Founders and Fractional CISOs, stay close to client engagements Trusted by ANZ organisations Including Temple & Webster and James Milson Village Award-winning Retail Cyber Security Partner of the Year, 2025 Benchmark Security Awards ## M365 Security Configuration Review pricing ### 50–100 seats For organisations running a single M365 tenant with 50 to 100 seats. AU$10,000 ex GST #### What's included * Identity and access review (Conditional Access, MFA, passkey readiness) * Email security and data sharing audit * Secure Score benchmark * Prioritised findings report and fixed-scope remediation quote ### 100+ seats For larger ANZ organisations and corporates running M365 at scale. AU$15,000 ex GST ### MSP and partner Managing M365 security across multiple client tenants? Ask about the MDR Partner Programme. Custom pricing #### Built for MSPs * Multi-tenant review pricing * A wedge into a fuller MDR Partner Programme conversation * Aware, Active and Adaptive partner tiers available ## Book Your Review Frequently asked questions Why run this review now? Microsoft is retiring SMS and voice MFA in favour of passkeys, with passkeys becoming the default authentication method from 1 September 2026 and full retirement from 1 February 2027. Most Australian and New Zealand organisations running M365 have never had their tenant configuration reviewed end to end, and this deadline is forcing the issue. What does the review actually check? Identity and access (Conditional Access, MFA method policy, legacy authentication, privileged roles, guest access), email security (SPF, DKIM, DMARC, mail flow rules), data sharing (SharePoint and OneDrive external sharing, DLP), device and app access, and monitoring, licensing and governance. What do we receive at the end? A findings report ranked by severity, a Secure Score benchmark, and a fixed-scope quote for remediation if you'd like us to action the findings. Do we have to engage Insicon Cyber to fix what you find? No. You can keep the report and action the findings yourselves, or engage Insicon Cyber as a professional services project. We set out a clear RASCI for both paths before you decide. Do you work with organisations outside Australia? Yes. We work with organisations across Australia and New Zealand. Sources: ASD, Cyber Action Year 2026 · ASD, Annual Cyber Threat Report 2024-25 · OAIC, Notifiable Data Breaches Jul-Dec 2024 · Help Net Security, Entra ID authentication overhaul · Office 365 for IT Pros, MFA telephony retirement ## Frequently asked questions Microsoft is retiring SMS and voice MFA in favour of passkeys, with passkeys becoming the default authentication method from 1 September 2026 and full retirement from 1 February 2027. Most Australian and New Zealand organisations running M365 have never had their tenant configuration reviewed end to end, and this deadline is forcing the issue. Identity and access (Conditional Access, MFA method policy, legacy authentication, privileged roles, guest access), email security (SPF, DKIM, DMARC, mail flow rules), data sharing (SharePoint and OneDrive external sharing, DLP), device and app access, and monitoring, licensing and governance. A findings report ranked by severity, a Secure Score benchmark, and a fixed-scope quote for remediation if you'd like us to action the findings. No. You can keep the report and action the findings yourselves, or engage Insicon Cyber as a professional services project. We set out a clear RASCI for both paths before you decide. Yes. We work with organisations across Australia and New Zealand. About Blog Case Studies Contact Partners Careers * Case Studies Managed Security Services Managed Security Services Security Operations Centre (SOC) Managed Detection and Response (MDR) Managed Autonomous Red Teaming Managed SIEM Managed IT Services * Security Operations Centre (SOC) * Managed Detection and Response (MDR) * Managed Autonomous Red Teaming * Managed SIEM * Managed IT Services Advisory and Compliance Services AI Security & Governance Cyber Advisory AI Security Governance Advisory Cyber Security Risk Assessment Tabletop and Cyber Simulation Exercises CISOaaS (CISO as a Service) Information Security Compliance (ISO 27001) AI Compliance (ISO 42001) Quality Assurance Compliance (ISO 9001) Essential Eight (E8) * AI Security & Governance * Cyber Advisory * AI Security Governance Advisory * Cyber Security Risk Assessment * Tabletop and Cyber Simulation Exercises * CISOaaS (CISO as a Service) * Information Security Compliance (ISO 27001) * AI Compliance (ISO 42001) * Quality Assurance Compliance (ISO 9001) * Essential Eight (E8) Industries Aged Care Finance and Lending Online Retailers and SaaS Leaders Legal Sector and Law Firms Software and SaaS Platforms * Finance and Lending * Online Retailers and SaaS Leaders * Legal Sector and Law Firms * Software and SaaS Platforms Other Stuff Report a Scam or Breach Cookie Policy Privacy Policy Terms and Conditions * Cookie Policy * Privacy Policy * Terms and Conditions © 2026 Insicon Pty Ltd Linkedin YouTube Insicon Cyber acknowledge the Traditional Owners of Country throughout Australia and recognise the continuing connection to lands, waters and communities. We pay our respect to Aboriginal and Torres Strait Islander cultures; and to Elders past and present. ------------------------------------------------------------ ABOUT THIS CONTENT ------------------------------------------------------------ Source: https://insiconcyber.com/m365-security-review Author: ANZ organisations Including Temple This content is provided for informational purposes. Please visit the original source for the most up-to-date information.