IAM12
Identities and privileged access
MFA, Conditional Access, roles, PIM and emergency access.
For MSPs, consultancies and Microsoft 365 administrators
The PowerShell assessment package for professional Microsoft 365 security reviews.
Review up to 53 control areas, collect traceable technical evidence and deliver a customer-ready HTML report. The workflow is read-only by design and does not require a recurring SaaS subscription.
View installation and usage 53 control areas Full PowerShell source code Customer-ready reporting
Technical assessmentContoso GmbH
RUN GSE-8F21Technical score72/100
31Passed
6Failed
8Not tested
IAM-01
Admin MFA coverage is incompleteTwo privileged accounts are outside the effective policy.
CriticalCOL-01
External sharing is too broadAnonymous links remain available on sensitive sites.
Warning18:42:11WARNING
DEV-02 not tested – Intune data source unavailable
Fictional demo data. The generated report may change technically and visually with future product versions.
Read-only by designNo write operations in the assessment workflow.
Source code includedNo mandatory SaaS lock-in.
Not tested is not passedMissing licences and permissions remain visible.
Customer-ready reportWhite labelling from Professional upwards.
Version 0.18.0 verified
Tested with a real tenant run, controlled changes and a 53-control report review.
The published verification report separates confirmed functions, scope-limited claims and explicit limitations. The final run contained 0 internal evaluation errors; unavailable data was not counted as passed.
53/53 controls rendered4/4 changes detectedSHA-256 outputs verified
Read the test report53-control catalog
What GraphSec reviews in a Microsoft 365 tenant.
The catalog follows the main work areas of Microsoft 365 administrators. Select an area to open the matching controls in the searchable catalog.
Search the full catalogAPP6
Apps, OAuth and supply chain
Consent, application permissions, credentials and cross-tenant trust.
EXT5
Users, guests and groups
Inactive accounts, external identities, owners and lifecycle evidence.
DEV6
Devices and endpoints
Compliance, application protection, encryption, patching and Defender.
MAIL10
Email and collaboration
Exchange, Teams, SharePoint, OneDrive, sharing and legacy protocols.
DATA5
Data protection and retention
Audit, DLP, sensitivity labels, retention and compliance roles.
DET9
Detection and resilience
Alerts, logging, incident response, backup and recovery evidence.
Need to verify the exact technical scope?
Open the control catalog Search all 53 controls by ID, service, risk or mapping.
Customer-ready output
Management summary, control results, evidence and run log.
The report separates executive information from technical detail so that decision-makers and administrators can use the same deliverable.
Management summary
Score, test coverage, major risks and prioritised actions.
Control results
Status, reason and recommendation for every control.
Technical evidence
Data source, relevant values and documented testing limitations.
Run log
Connections, data collection, missing permissions, licences and exports.
See the report before buying.
Open live report The live demo uses the same sample values as the landing-page preview.
Three plans · one-time payment
Choose the licence scope that matches your business.
All plans include the same technical assessment engine. They differ in customer scope, internal users, white-labelling rights and update period.
Independent consultant
Consultant
For a limited, stable customer base.
€499net
one-time
one-time
- up to 5 active customer tenants
- 1 internal user
- commercial use of generated reports
- source code and all exports
- 6 months of updates
Recommended for MSPs
MSP and consultancy
Professional
For repeatable assessments delivered as a customer service.
€799net
one-time
one-time
- unlimited own customer tenants
- up to 5 internal users
- white-labelled reports
- interactive, device-code and app-only operation
- 12 months of updates
Larger internal team
Team
For multiple engineers, locations or dedicated security teams.
€1,299net
one-time
one-time
- unlimited own customer tenants
- up to 15 internal users
- central use within one company
- white-labelling and all exports
- 24 months of updates
Disclaimer
GraphSec supports technical assessment. Professional judgement remains with the user.
Results depend on scan time, tenant configuration, licences, read permissions, Microsoft APIs and manual evidence. The product is not legal advice, a certification or a complete NIS2, BSI, ISO 27001 or GDPR assessment.
Read the full disclaimer