Microsoft 365 Health Check
Get a complete Microsoft 365 tenant health assessment covering security, identity, email authentication, data exposure and license efficiency — scored out of 100, in minutes. Read-only, and free to run.
Connects through Microsoft’s own admin-consent screen. No password ever reaches us. Revocable anytime.
A Microsoft 365 health check is a review of a tenant that assesses several areas of health at once — security posture, identity and access, email authentication, data exposure and license efficiency — and turns what it finds into a prioritized list of fixes, rather than a single number.
Five pillars, scored out of 100
Each pillar has its own dedicated assessment. The health check runs all five and rolls them into one score.
Microsoft Secure Score
Ingests your tenant’s actual Secure Score and control profiles, then translates Microsoft’s recommendations into plain-language fixes.
Learn more → 02Identity & access
MFA gaps (with a dedicated check for Global Admins with no MFA), Global Administrator sprawl, dormant admins, stale guests and never-expiring passwords.
Learn more → 03Email authentication
Checks your domain’s SPF and DMARC records by direct DNS lookup so spoofed mail can’t slip through unnoticed.
Learn more → 04Data exposure
Finds third-party apps that hold high-risk Microsoft Graph permissions in your tenant — the consent risk most admins never review.
Learn more → 05License efficiency
Unassigned paid seats, disabled accounts still holding licenses, and users inactive 90+ days who are still being paid for.
Learn more →13 checks across 5 pillars
No black box. Here is every check the assessment runs — nothing more is claimed than this.
| Pillar | Check | Typical urgency |
|---|---|---|
| License | Paid seats bought but never assigned | High |
| License | Disabled accounts still holding a paid license | High |
| License | Users inactive 90+ days still licensed | Medium |
| Identity | Global Administrators with no MFA registered | High |
| Identity | Any user with no MFA registered | High |
| Identity | Global Administrator role sprawl | Medium |
| Identity | Dormant administrator accounts | Medium |
| Identity | Stale guest accounts | Medium |
| Identity | Never-expiring password combined with no MFA | High |
| Data | Third-party app granted high-risk Graph permissions | High |
| Secure Score | Tenant Secure Score & per-control profile | Info |
| SPF record missing | High | |
| DMARC record missing | High |
Inactive-user findings depend on Microsoft usage-report data being available for your tenant; if it isn’t, the assessment still returns every other finding and tells you so.
Three steps, a couple of minutes
Connect
Sign in through Microsoft’s own consent screen with a Global Administrator or Global Reader account. You see exactly which read-only permissions are requested before you approve.
Scan
M365 Health Score reads license, identity, Secure Score, app-consent and email-authentication data via Microsoft Graph. It writes nothing back.
Report
You get your overall Health Score and total estimated monthly waste for free. The full itemized report unlocks the complete breakdown and a prioritized roadmap.
What the health check does not do
Honesty is part of the point of connecting a read-only tool, so here is where the scope ends:
- It reads — it never changes, remediates or reverts anything in your tenant.
- It does not open mailbox content, files, OneDrive or Teams messages.
- It does not analyze Conditional Access policies, DLP, sensitivity labels, retention or device compliance.
- License and inactivity findings are estimates based on assignment and activity data — you confirm the final call.
A health check does not replace Microsoft Secure Score. M365 Health Score complements Secure Score — it ingests your actual Secure Score and adds tenant-health checks around identity hygiene, email authentication, app-consent exposure and license efficiency. See Secure Score vs M365 Health Score.
Microsoft 365 health check FAQ
What is a Microsoft 365 health check?
A Microsoft 365 health check is a review of a tenant that looks beyond a single security score to assess several areas of tenant health at once — security posture, identity and access, email authentication, data exposure and license efficiency — and turns what it finds into a prioritized list of fixes.
Is the Microsoft 365 health check read-only?
Yes. M365 Health Score connects through Microsoft’s own admin-consent screen and requests only read permissions. It cannot change, remediate or delete anything in your tenant, and it never asks for the permission to.
Does it read our email or files?
No. The permissions requested cover license assignments, usage reports, directory data, your Microsoft Secure Score and email-authentication DNS records. It has no access to mailbox content, files, OneDrive or Teams messages.
Who needs to run it?
You need a Global Administrator or Global Reader role to grant consent. Many teams have their in-house admin or IT provider connect it, which takes a couple of minutes.
How long does the health check take?
Connecting takes about two minutes. The scan and your overall Health Score are ready within minutes of consent.
Check your Microsoft 365 health — free
Your overall Health Score and total estimated monthly waste, in minutes. Read-only, revocable anytime.
Check Your Microsoft 365 Health