This is what your real report will look like — built from your own tenant's data.
Run your free scan62/ 100
M365 Health Score
Needs attention. There are real gaps below, several worth fixing this week.
Total monthly waste
$434.00
$5,208.00/year
6
High
4
Medium
2
Low
Action roadmap
Every finding below, re-sorted into what to tackle first.
This week
MFA gap — Require MFA for 4 users with no method registered
Email security — Publish a DMARC record for contoso-retail.com
Risky app — Review "QuickReports Connector" — granted Mail.ReadWrite
This month
Admin sprawl — Review 7 Global Admins, move most to scoped roles
Stale guest — Remove guest access for 2 inactive external collaborators
License — Remove Microsoft 365 E3 from 3 disabled accounts
This quarter
License — Reduce Microsoft 365 E3 by 6 unassigned seats at renewal
Secure Score — Enable self-service password reset
Findings by category
Every finding across all five pillars, listed in full — nothing here is truncated or summarized.
💰 License Efficiency
4 findingsEvery unassigned seat, disabled account, or inactive user holding a license is money leaving your budget for no benefit.
High priority2 items
Microsoft 365 E3 — 6 seats
6 purchased seats not assigned to any user
→ Reduce your Microsoft 365 E3 subscription by 6 seats at next renewal
$216.00/mo
Microsoft 365 E3 — Maria Santos · [email protected]
Disabled account still holding Microsoft 365 E3
→ Remove Microsoft 365 E3 from disabled account: Maria Santos
$36.00/mo
Medium priority2 items
Power BI Pro — David Kim · [email protected]
No M365 activity in 90+ days while holding Power BI Pro
→ Confirm with David Kim whether they still need this license
$10.00/mo
Visio Plan 2 — 3 seats
3 purchased seats not assigned to any user
→ Reduce your Visio Plan 2 subscription by 3 seats at next renewal
$45.00/mo
🔐 Identity & Access
5 findingsIdentity is the most common breach entry point. Admin sprawl, missing MFA, and stale guest access all widen your attack surface.
High priority3 items
No MFA method registered — Priya Patel · [email protected]
→ Require Priya Patel to register MFA, or enforce it tenant-wide via Conditional Access / Security Defaults
7 users hold Global Administrator — Microsoft recommends 2–4
→ Review the 7 Global Admins and move anyone who doesn't need full tenant control to a scoped role
Global Administrator with no M365 activity in 90+ days — Tom Reyes · [email protected]
→ Confirm whether Tom Reyes still needs Global Admin — if not, remove the role
Medium priority2 items
Guest account with no recorded M365 activity, added over 90 days ago — Jordan Lee (Guest) · [email protected]
→ Remove guest access for Jordan Lee if the collaboration has ended
Password set to never expire, and no MFA registered — Sam Wong · [email protected]
→ Register MFA for Sam Wong — a non-expiring password with no MFA is a standing exposure
🛡️ Secure Score
3 findingsMicrosoft's own composite security score for your tenant, with the highest-impact unresolved recommendations surfaced here.
Medium priority3 items
Enable self-service password reset
→ See Microsoft Secure Score in the admin center for remediation steps
Designate more than one global admin
→ See Microsoft Secure Score in the admin center for remediation steps
Use limited administrative roles
→ See Microsoft Secure Score in the admin center for remediation steps
📁 Data Exposure
1 findingThird-party apps with broad permissions and license-holding shared mailboxes are quiet sources of data exposure and cost.
High priority1 item
Third-party app "QuickReports Connector" has been granted: Mail.ReadWrite
→ Review "QuickReports Connector" in Entra ID → Enterprise Applications and remove it if it's not actively in use
📧 Email Authentication
1 findingMissing SPF/DMARC is the single most common reason SMBs get spoofed — anyone can send email pretending to be you.
High priority1 item
No DMARC record found for contoso-retail.com — this is the single most common reason SMBs get spoofed
→ Publish a DMARC TXT record at _dmarc.contoso-retail.com (start with p=none to monitor, then move to p=quarantine)
Methodology & glossary
What was scanned
This report was generated using Microsoft Graph API with read-only permissions (User.Read, Reports.Read.All, Directory.Read.All, Organization.Read.All, SecurityEvents.Read.All). M365 Health Score cannot and does not modify your tenant, change any licenses, or alter any settings.
"90+ days inactive"
Based on Microsoft's Office 365 Active User Detail report over a trailing 90-day window, covering Exchange, Teams, SharePoint, and OneDrive activity.
Health Score formula
Your overall Health Score blends four weighted inputs: Microsoft Secure Score (40%), Identity & Access findings (25%), License Efficiency — waste as a share of total license spend (20%), and Email Authentication — SPF/DMARC presence (15%).
Ready to see your tenant's actual Health Score?
Run your free scan