Microsoft 365 security posture, Cloud infrastructure posture, Connected app risk, Business email compromise, SOC 2 compliance drift.
This report brings the selected assessments for Northwind Logistics Pvt Ltd into one document, so you read one report instead of several. Each section stands on its own and states what was checked and how.
One assessment, three audiences. Each reader can go straight to the part they need.
Secure Score, gap roadmap, licences and cost
Secure Score 36.2%, 44 open gaps (17 high priority)
Northwind Logistics Pvt Ltd scores 92 of 254 available Microsoft Secure Score points (36.2%). Microsoft's comparison group for organisations of a similar size averages 44.8% (113.8 of 254 points), so the tenant is 8.6 percentage points below that benchmark. The assessment found 44 open improvement opportunities worth 162 points: 17 high priority, 24 medium and 3 lower priority. 31 of them are protections your licences already include but that are not switched on yet, which makes them the fastest wins.
8.6 percentage points below the peer average.
Open improvement opportunities grouped by security domain, ranked by recoverable points.
| SECURITY DOMAIN | OPEN ACTIONS | NOT STARTED | POINTS AVAILABLE |
|---|---|---|---|
| Apps | 31 | 29 | +118 |
| Identity | 7 | 5 | +24 |
| Data | 4 | 4 | +12 |
| Device | 2 | 2 | +8 |
All 44 improvements, ranked by Secure Score points recovered, each with the steps to fix it. Impact and effort ratings come from Microsoft's control profiles for your tenant.
Improvements 10–44 continue in the full report in the same format.
Microsoft 365 Copilot shows people anything they can already open, so loose sharing becomes visible overnight. This is a tenant-level preview from settings and directory data only. File contents are never read.
18 guest accounts · 0 of 0 Copilot seats assigned
What your Microsoft 365 licensing costs, and where paid seats might be going to waste.
| Finding | Seats | Est. per month |
|---|---|---|
| Business Standard licences on disabled accounts | 6 | $84 |
| Business Premium licences not assigned to anyone | 3 | $66 |
| Licensed users with no sign-in for 90+ days (review) | 5 | not counted |
The platform's own read-only checks of your Microsoft 365 and Entra ID settings, beyond Microsoft Secure Score. 27 checks assessed: 12 need attention, 15 pass. 9 could not be assessed (see below). Five examples are shown.
Administrators are required to use MFA; SMS and voice-call sign-in methods are disabled; Administrator accounts are cloud-only; Disabled accounts hold no administrator roles; App registrations have no expired credentials; A security notification contact is set; All domains added to the tenant are verified; and 8 more.
Not counted as passes or failures; the reason is a licence, not a finding. Needs Microsoft Entra ID P1 (Conditional Access), which this tenant does not appear to have. Affects: Access requires a compliant device; Sign-in frequency for sensitive access; Trusted locations; and 6 more.
Which of your Microsoft 365 controls provide evidence toward each clause. 101 of the 102 controls assessed in this report are mapped.
Indicative mapping, pending independent review. A clause with no open finding means no gap was found in the controls assessed; it is not a statement of compliance. Formal audits and certification are performed by independent auditors.
The same findings grouped by how an attacker would use them, in kill-chain order. Counts show open findings out of the controls assessed.
The full report lists all 9 tactics and 21 techniques.
Data is read through Microsoft Graph using the following application permissions granted in your tenant: AuditLog.Read.All (sign-in activity timestamps); Directory.Read.All (users, groups, licences and connected apps); MailboxSettings.Read (mailbox rule and forwarding settings, not message content); Policy.Read.All (Conditional Access and tenant policies); RoleManagementPolicy.Read.Directory (privileged-role policy settings); SecurityEvents.Read.All (Secure Score and control profiles). All are read-only and revocable at any time from the Microsoft Entra admin center. None of these permissions allows the platform to read email content or file contents. Scores and recommendations originate from Microsoft's own assessment of your tenant; the platform adds prioritisation, benchmarking, framework mapping and remediation planning. The peer average is Microsoft's own comparison value, shown as a percentage of the maximum score. This report reflects posture at the assessment timestamp and should be refreshed after remediation.
Azure, AWS and GCP through Microsoft Defender for Cloud
2 Azure subscriptions + 1 AWS account · 67 unhealthy findings (14 high)
Across 2 Azure subscriptions and 1 connected AWS account, Microsoft Defender for Cloud reports a combined secure score of 52%. The assessment found 67 unhealthy findings on 41 resources: 14 high, 31 medium and 22 low severity. Two storage locations are reachable from the internet, and virtual machine management ports are open to any address. Only the free foundational posture checks are active; no Defender workload protection plans are switched on.
| ENVIRONMENT | RESOURCES | HIGH | SECURE SCORE |
|---|---|---|---|
| Azure · Production subscription | 24 | 8 | 48% |
| Azure · Dev/Test subscription | 9 | 2 | 61% |
| AWS · Logistics apps account | 8 | 4 | 50% |
| Protection plan | Resources in scope | Status |
|---|---|---|
| Foundational CSPM (free) | All 41 | On |
| Defender CSPM (attack paths, agentless scanning) | 41 | Off |
| Defender for Servers | 7 VMs (5 Azure, 2 AWS EC2) | Off |
| Defender for Storage | 6 storage accounts / buckets | Off |
| Defender for SQL / databases | 3 databases | Off |
Ranked by severity and exposure. The full report lists all 67 findings by resource, with remediation steps.
Third-party apps and what they can access
23 third-party apps, 2 high risk
We reviewed 23 third-party apps (311 service principals in total, the rest being Microsoft's own services) connected to your tenant. 2 hold high-risk access and 4 more are worth reviewing. Your consent setting also lets users approve new apps without review.
| App | Access held | Consented by | Risk |
|---|---|---|---|
| PDF Merge Online | Read and write all mail; read all files | 1 user | HIGH |
| QuickSync Contacts | Read directory; read all users' calendars (application) | Admin, tenant-wide | HIGH |
| Calendar Sync Pro | Read and write calendars | 3 users | REVIEW |
| CRM Connector (legacy) | Read directory | Admin, tenant-wide | REVIEW |
| Survey Builder | Read user profile, send mail as user | 6 users | REVIEW |
| E-Sign Express | Read and write files the user selects | 4 users | REVIEW |
Scope: only applications connected through Microsoft's own sign-in and consent screens are visible. This report never revokes or changes anything; every action is for your Global Administrator to apply.
Hidden inbox rules and forwarding used in invoice fraud
1 critical finding on a finance mailbox
We checked mailbox rules and forwarding settings on all 120 mailboxes. One mailbox in the finance team has a hidden rule that forwards invoice and payment emails to an outside address, the classic sign of a compromised account. Act on this today.
This check reads mailbox rule and forwarding settings only, never message content. With monitoring on, new rules like this raise an alert within hours, in plain language, with the fix.
Access-control configuration against SOC 2 and CIS
2 controls drifted since the baseline
Two monitored controls drifted from the baseline recorded on 2026-09-30: an MFA exclusion was added for one user, and a new Global Administrator was assigned. Both affect SOC 2 CC6 logical-access criteria. Legacy authentication remains blocked.
| Date | Change detected | Criteria | Severity |
|---|---|---|---|
| 2026-10-12 | MFA exclusion added for 1 user (sales team) | SOC 2 CC6.1 · CIS identity | HIGH |
| 2026-10-15 | New Global Administrator assigned (external contractor) | SOC 2 CC6.2, CC6.3 · CIS privileged access | HIGH |
Scope: this report supports a SOC 2 programme by monitoring relevant Microsoft 365 configuration. It is not a SOC 2 audit, examination or attestation; those are performed by an independent licensed CPA firm.
This report was produced on Zybim, a Microsoft-native security assessment and monitoring platform from Zybim Technologies, a verified Microsoft partner. Read-only access through a publisher-verified Entra app; nothing is installed and nothing in your tenant is changed.
Prices are list prices in USD on Microsoft Marketplace, billed through your Microsoft invoice, and may differ through partners.