Microsoft 365 - 365 Rating®
Microsoft records over 600 million cyberattacks targeting its services every day. Entra ID, SharePoint, Teams, OneDrive, Exchange, Microsoft Defender… every component of your Microsoft 365 environment is a potential attack surface. Between configuration errors introduced by teams, the rapid evolution of cloud environments, and emerging threats, one question remains central: What is the actual security level of your Microsoft 365 tenant?
365 Rating® enables you to:
Microsoft 365 has become the backbone of identity and collaboration in most organisations. But this widespread adoption also makes it a prime target: compromised identities, uncontrolled file sharing and incomplete Defender configurations are all entry points exploited by cybercriminals on a daily basis.
Entra ID identity compromise : phishing, credential theft, MFA bypass, and exploitation of poorly configured privileged accounts
Data exposure via collaboration tools : excessive sharing on SharePoint, Teams, or OneDrive exposing sensitive data to unauthorized third parties
Incomplete or misconfigured Defender protection : insufficient coverage of endpoints, email, and cloud applications leaving exploitable blind spots
The native Microsoft Secure Score is not enough: oriented toward Microsoft's commercial recommendations, it provides neither an independent synthetic score, nor a consolidated multi-tenant view, nor a report adapted for the C-suite. 365 Rating® fills precisely these gaps.
365 Rating® continuously analyzes the configuration of your Microsoft 365 tenant across 10 domains grouped into 3 axes, relying on 130+ automated controls updated daily. Its global score of 0–1,000 and per-domain ratings (A to E) offer an immediately actionable view, for both technical teams and management.
365 Rating® provides in-depth analysis of the three critical components of your Microsoft 365 environment:
Axis 1 — Identities (Entra ID)
Axis 2 — Collaboration Tools
Axis 3 — Microsoft Defender
Available in French, English, German, Italian, and Spanish — designed for international organizations.
.png)
365 Rating® covers the security of your Microsoft 365 and Entra ID environments. To assess and manage the security of your on-premises Active Directory, discover AD Rating®, our dedicated solution.
Microsoft Secure Score is a useful built-in tool, but it has inherent limitations for organisations that require independent, consolidated reporting that can be presented to senior management.
| Criteria | 365 Rating® | Microsoft Secure Score |
|---|---|---|
| Analysis scope | ✅ Entra ID + collaborative tools + Defender | ⚠️ Commercial bias in Microsoft recommendations |
| Readable synthetic score | ✅ Score 0–1,000 | ⚠️ Technical score, difficult to contextualize |
| Rating by axis (A to E) | ✅ 10 rated domains | ❌ No |
| Executive report | ✅ Yes, automated | ❌ Manual writing |
| Detailed technical report | ✅ Yes, with findings and priorities | ⚠️ Recommendations without clear prioritization |
| Multi-tenant | ✅ Consolidated dashboard | ❌ Tenant-by-tenant view |
| Independence from Microsoft | ✅ Independent third-party analysis | ❌ Vendor self-assessment |
| Multilingual | ✅ 5 languages | ⚠️ Limited |
365 Rating® offers a fundamentally different approach:
Download the installation script from the Board of Cyber platform
Install the 365 Rating® application on your tenant; you must be a tenant administrator to run the script locally on your machine. The script installs the Microsoft dependencies required for the application to function.
Enable permissions for the API: from the ‘API Permissions’ menu, click on ‘Grant admin consent for [Your company]’
Synchronise the application with the Board of Cyber platform and import your tenant’s configuration details
View risk findings, scores and recommendations directly from the Board of Cyber platform
Maintain an optimal security level across your Microsoft 365 tenant, regardless of how fast your cloud environment evolves.
Before an internal, client, or insurance audit, or following a security incident, 365 Rating® allows you to objectively measure your posture and document your corrective actions.
During a merger or acquisition, the target entity's Microsoft 365 environment is often a blind spot from a security perspective. 365 Rating® enables a rapid and structured assessment from the very first stages.
For international groups, managed service providers (MSSPs), or investment funds, 365 Rating® provides a consolidated view of the security posture across all your Microsoft 365 tenants.
365 Rating® automatically generates two types of reports tailored to each audience, with no manual reformatting required.
NIS2, DORA, and ISO 27001 place the security of identities, access, and collaborative tools at the heart of their requirements. 365 Rating® generates the evidence and reports needed for your compliance audits.
A Microsoft 365 security audit is an in-depth analysis of your tenant's configuration: identity and access management (Entra ID), collaborative tools settings (SharePoint, Teams, OneDrive, Exchange), and Microsoft Defender configuration. Its goal is to identify vulnerabilities, misconfigurations, and data exposure risks before an attacker can exploit them. With 365 Rating®, this audit is fully automated and updated on a daily basis.
Microsoft Secure Score is a useful native tool, but it is a self-assessment produced by Microsoft, oriented toward its own commercial recommendations. 365 Rating® is a trusted, independent third-party analysis: it covers the entire tenant (Entra ID, collaborative tools, Defender), generates a 0–1,000 score readable by non-experts, offers a consolidated multi-tenant view, and produces reports tailored for executive leadership, all features absent from the native Secure Score.
Securing a Microsoft 365 tenant relies on several pillars: enforcing robust conditional access policies and enabling MFA on all accounts, controlling Entra ID privileged account permissions, managing sharing settings on SharePoint and Teams, properly configuring Exchange protections (DKIM, DMARC, SPF, anti-phishing), and enabling Microsoft Defender across the entire perimeter. But tenant security is not a fixed state, configurations constantly evolve. That is precisely why a continuous audit solution like 365 Rating® is more effective than a one-time assessment.
Yes. NIS2 and DORA require organizations to demonstrate active management of risks related to identities, access, and digital tools. 365 Rating® incorporates the critical control points tied to these regulations, generates exportable reports usable during audits, and enables documentation of the continuous improvement of your Microsoft 365 security posture.
Yes, and it is actually one of its flagship use cases. The consolidated dashboard of 365 Rating® allows you to simultaneously manage the security of multiple Microsoft 365 tenants — ideal for managed security service providers (MSSPs), international groups, and investment funds managing a portfolio of entities. Each tenant has its own score and its own recommendations, all visible from a centralized view.
Only for the initial installation of the 365 Rating® application on your tenant: you need to be a tenant administrator to run the installation script and grant the required read-only API permissions (Graph API). Once the installation is complete, the analysis runs automatically.
