Microsoft 365 Security Optimization in Rwanda
A review of your Microsoft 365 tenant's security settings against what's actually enabled.
Microsoft 365 security optimisation is a focused review of your tenant’s security settings, compared with what your licences already include and what your risks require, followed by fixing the gaps in order of importance. Any organisation on Microsoft 365 that hasn’t had its configuration reviewed since it was first set up needs it. This page covers the Microsoft 365 tenant. A review of your whole security position, including network, devices and policies, is covered by cybersecurity assessment.
What is Microsoft 365 security optimisation, and who needs it
It’s a structured, setting-by-setting review of identity, email, data sharing, devices, administration and logging in your tenant, with a ranked list of findings and, where agreed, the fixes applied. It suits organisations whose tenant was set up quickly years ago, those that upgraded to Business Premium or an enterprise plan without switching on what they gained, and those recovering from a compromised mailbox.
The problem it solves
Under the shared responsibility model, Microsoft secures the service while you secure how it’s configured. Many protective features aren’t switched on automatically, and organisations often pay for capabilities they’ve never used. Business Premium, for example, includes conditional access, Defender for Office 365 Plan 1 and data loss prevention for Exchange, SharePoint and OneDrive. Left at defaults, those features protect nothing. A review is often the cheapest security improvement available, because the licences are already paid for and the work is configuration, not new products.
What we review
Identity. Multi-factor authentication coverage, conditional access, legacy authentication, risky sign-ins and the number of global administrators. Deeper identity design is covered by Microsoft Entra ID configuration.
Email. Anti-phishing and impersonation protection, Safe Links and Safe Attachments where licensed, SPF, DKIM and DMARC, automatic forwarding to external addresses and suspicious mailbox rules.
Data and sharing. External sharing settings in SharePoint, OneDrive and Teams, guest access, data loss prevention policies and sensitivity labels where licensed.
Devices. Whether only managed or compliant devices can reach sensitive data.
Administration and logging. Admin roles, audit logging switched on and retained, and alerts reaching someone who will act.
Licences. What each user holds, and features already paid for but unused.
Secure Score, and why it isn’t the whole answer
Microsoft Secure Score measures how your settings compare with Microsoft’s recommendations and lists improvement actions. It’s a useful tracker, and we report it before and after. But it doesn’t measure the likelihood of a breach, and it weighs recommendations generally rather than for your organisation. Some low-scoring items matter a great deal for you, and some high-scoring ones matter little, so we rank findings by your actual risk.
What the work involves
- Collect configuration, licences, admin roles and Secure Score with read-only access.
- Review each area against licences and good practice.
- Report findings ranked by risk, with the effort and user impact of each fix.
- Fix agreed items, testing changes that affect staff with a pilot group first.
- Re-measure and hand over a record of every change.
What’s included and what’s not
Included: tenant configuration review, a ranked findings report, implementation of agreed fixes, and a before-and-after Secure Score.
Not included unless bundled: full conditional access and identity redesign (see Microsoft Entra ID), device enrolment (see Microsoft Intune) and cloud infrastructure security (see Microsoft Defender for Cloud).
Typical timelines and what drives cost
The review typically takes one to two days, with fixes taking from a day to a couple of weeks depending on what’s found and how carefully changes must be rolled out to staff. Cost is driven by tenant size, licence mix, how many findings you choose to fix, and whether fixes need user communication and support.
Equipment typically used
The Microsoft 365, Defender, Entra and Purview admin centres, Microsoft Secure Score, and read-only reporting tools for configuration export. No software is installed on staff devices for the review itself.
Common mistakes we see
Multi-factor authentication enforced for most staff but not for one old shared account. Automatic forwarding to external addresses allowed. Anyone-with-the-link sharing enabled by default. Audit logging never checked. Five or more global administrators. And Secure Score treated as a target to raise, rather than a prompt to fix the risks that matter.
.CLnYnaU8_1JOeBB.webp)
Microsoft & Cloud
Related services
-
Microsoft 365 Deployment
Microsoft 365 tenant setup, migration and licensing sized to how your teams actually work.
-
Microsoft Entra Id
Identity, conditional access and single sign-on configured through Microsoft Entra ID.
-
Microsoft Intune
Device enrolment and policy management across company and BYOD devices through Intune.
Insights
Related reading
-
, 4 min read
How Much Does User Device Management Cost in Rwanda?
User device management cost depends on device count, policy complexity, and device type mix — here's what drives the ongoing number.
-
.CdYgWjfb_ZDmPMs.webp)
, 4 min read
Signs Your Business Needs Cloud Infrastructure Management
Specific, practical signs — not general cloud usage — that indicate your organisation would genuinely benefit from proper cloud infrastructure management.
Frequently asked questions
Isn't Microsoft 365 secure by default?
The platform is secure; your configuration may not be. Microsoft protects its datacentres and services, but many protections inside your tenant depend on your licence and your settings: enforced multi-factor authentication, conditional access, anti-phishing policies, data loss prevention, external sharing limits and audit logging. Responsibility for those settings sits with your organisation, not Microsoft.
How do we know if our tenant has security gaps?
Microsoft Secure Score, in the Defender portal, gives a first indication by comparing your settings with Microsoft's recommendations. It's a useful starting point but doesn't know your risks or which recommendations matter most to you. Our review goes through each area by hand, against what your licences include, and ranks findings by real-world risk.
Is this the same as the Cybersecurity Assessment service?
No, it's narrower and deeper. A cybersecurity assessment reviews your whole security position, including network, devices, backups, policies and people. This review looks only at your Microsoft 365 tenant, setting by setting, and usually includes fixing what it finds. If Microsoft 365 is where most of your data lives, it's often the best first step.
How often should this review happen?
Once a year, and after any major change, such as a licence upgrade, a merger, a security incident or a large change in how staff work. Microsoft adds and changes security features and defaults through the year, so a configuration that was good last year can fall behind without anything in your organisation changing.
What do attackers most often exploit in Microsoft 365 tenants?
Stolen passwords without multi-factor authentication, phishing that tricks staff into approving sign-ins, old protocols that bypass modern sign-in, and mailbox rules that quietly forward mail to an outsider. Over-generous external sharing and too many global administrators make the damage worse once an account is taken. The review checks each of these directly.
Getting full value from Microsoft 365?
Tell us your licence tier and what your staff struggle with. We’ll review the setup and quote what changes.