365 TenantsSecurity settings for every Microsoft 365 tenantIncluded from Suite 3

Every tenant configured securely. Without locking anyone out.

365 Tenants shows you where a Microsoft 365 tenant departs from your security standard and closes the gaps once you approve. Before a new sign-in policy takes effect, 365 Tenants checks that everyone can still sign in afterwards, including you.

Request a demoHow it works
  • Nothing changes without your approval
  • Nothing is ever deleted
  • Data centres in Germany

Example · Berger Law Firm · your standard against the tenant · 3 gaps

Sound familiar?

Three moments every IT service provider knows.

Friday, 4:40 pm
“Who changed that?”

A customer reports that staff can suddenly share files with new external people. Nobody knows since when, or who changed it.

With 365 TenantsEvery change is in the history, with date and author. Risky changes report themselves.
Customer 14 of 30
“But we set that up everywhere.”

Every tenant was configured by hand, each one slightly differently. What was carefully planned for the first customer looks different at the fourteenth.

With 365 TenantsOne standard for all customers. For each tenant you see exactly what is missing.
Monday, 7:55 am
“What if nobody can sign in a minute from now?”

The new sign-in policy is ready. One mistake in it and the whole company stands still, your own admin access included.

With 365 TenantsNew policies run in observation first. They are enforced only with verified emergency access.

How it works

From first look to closed gap.

You start read-only. Nothing changes until you approve it.

  1. 1

    Connect

    An administrator of the customer consents once. At first everything is read only, nothing changes in the tenant.

    Read access granted
    Write access: not yet
  2. 2

    Compare

    You choose your standard, for example our ready-made recommendation. Every gap is listed in plain words.

    As intended38
    Gaps3
  3. 3

    Align

    A dry run shows every change before it happens. Writing starts only after your approval and is verified afterwards.

    Dry run: 3 changes
    Executed and verified

Conditional Access without the risk

One wrong sign-in policy locks everyone out. Not here.

Sign-in policies, called Conditional Access by Microsoft, are the strongest protection for Microsoft 365 and at the same time the riskiest change. That is why there are four safety nets.

Dry run first

You see every change before it happens. Nothing is changed in the process.

Then observe

New policies run alongside at first. You see whose sign-in would have been blocked.

Emergency access checked

Nothing is enforced without a working emergency account. This block cannot be bypassed.

One step back

The latest run can be rolled back. Nothing is ever deleted.

Ready to enforce?

Example
  • Emergency access works2 of 2 break-glass accounts active, with full permissions
  • Observation period overThe new policies ran alongside for a week
  • 3 sign-ins would have been blockedA scanner and two accounts with an old mail client
  • You have reviewed the evaluationOnly then can you enforce
If the step fails, the previous protection is switched back on.Enforce

Configuration drift

You find out first. Not your customer.

No tenant stays the way it was set up. An exception for a project, a setting changed while connecting an app, a share under time pressure: 365 Tenants records every change and reports the risky ones straight away.

  • Every 4, 12 or 24 hours 365 Tenants reads the tenant and compares it with the previous snapshot.
  • With the author. Who made the change comes from Microsoft's audit log. The history can be exported as CSV.
  • Alerts on risky changes, even before Microsoft has delivered the author.
365 TenantsChangesBerger Law FirmExample
  1. 03.03.

    Standard assigned: Conbool hardened, version 3

    IT partner, in the Conbool portal

    First snapshot
  2. 21.03.

    Inviting guests: now every employee

    m.schulz@berger-law.example, in the Entra admin center

    HighAlert sent
  3. 08.05.

    SharePoint sharing: also with new external people

    admin@berger-law.example, in the SharePoint admin center

    HighAlert sent
  4. 02.06.

    Policy “Second factor for everyone” switched off

    Author follows from Microsoft's audit log

    CriticalAlert sent
CriticalA protection that was in force disappears.
HighA door opens that used to be closed.
MediumNot dangerous, but unusual.

And if a run turns out not to fit?

The latest run can be rolled back as long as its changes are still in place. Whatever someone else has changed since stays untouched.

Run of 14.10.Berger Law FirmExecuted and verified
CreateBlock legacy sign-inDone
CreateSecond factor for Azure managementDone
ChangeWho may invite guestsDone
Roll backNothing is deletedRoll back
Switch offBlock legacy sign-innewly created
RestoreWho may invite guestsprevious value
StaysSecond factor for Azure managementchanged since

Try it

Only real gaps. No noise.

If a customer is stricter than your standard somewhere, it stays that way. If a licence is missing, nothing is demanded that the customer cannot have. Choose an example customer:

Example

3 gaps

Three settings are missing or differ from your standard. The dry run closes them. One setting is stricter than required and stays as it is.

Microsoft 365 Business Premium · 40 users

  • Second factor for all usersSwitched onOK
  • Second factor for administratorsSwitched onOK
  • Second factor for Azure managementMissing, will be addedGap
  • Legacy sign-in blockedMissing, will be addedGap
  • Guests by invitation onlyEvery employee may invite, will be adjustedGap
  • Guests do not own groupsAs intendedOK
  • Sharing only with known guestsStricter: within the organisation only. Stays as it is.Stricter
  • No blanket trust in other organisationsAs intendedOK

Our recommendation

Ready on day one: “Conbool hardened”.

Ten settings that are missing in almost every tenant. You adopt the recommendation and adjust it. Or you make one of your own well-configured tenants the standard for all others.

Second factor

A stolen password alone is no longer enough.

  • For all users
  • Specifically for administrators
  • For Azure management
  • Legacy sign-in without a second factor blocked

Sign-in

Secure methods stay available, insecure ones are replaced.

  • Security defaults replaced cleanly
  • Authenticator app and passkeys stay on

Guests

External people see only what they should.

  • Guests by invitation only
  • Restricted view of the directory
  • Guests do not own groups

Sharing

Files do not go to strangers.

  • Sharing only with known guests
  • No blanket trust in other organisations

Your standard never loosens anything. If a customer is stricter somewhere, it stays that way. Values that differ per customer, such as the break-glass accounts, each customer enters separately.

For IT service providers and MSPs

Set it up once. Apply it to every customer.

Instead of configuring thirty tenants one by one, you define your standard once and assign it to every customer.

  • Each customer with its own valuesBreak-glass accounts and IP ranges are entered per customer. Values never carry over to someone else.
  • New version, no surprisesWhen you change your standard, nothing changes at any customer by itself. You decide who moves over and when.
  • Everything in one portalIncluded in Suite 3 or added per user, next to MailGuard, 365 Permissions and 365 Backup in the same portal.
Your standardConbool hardened, version 3Example
Berger Law FirmVersion 33 gaps
Harbour PracticeVersion 31 gap
Nordwerk LtdVersion 3All as intended
Lenz Tax Advisersstill version 2Upgrade available

Trust

What 365 Tenants never does.

A tool that touches the security of your customers needs clear limits. These are ours.

  • Neverchanges anything without your approval.Reading and writing use two separate consents. If you only want to compare, you grant read access only.
  • Neverdeletes anything.Not even on rollback: new policies are switched off, changed values restored.
  • Neverenforces without emergency access.A policy that does not exclude the break-glass accounts cannot even be approved.
  • Neverreads mail, files or chats.It reads settings and policies, never content.
  • Neverinstalls software at the customer.No agent on servers or workstations.
Data centres in GermanyVendor based in Hamburg

Entra ID and Microsoft 365

Eleven areas that decide how secure a tenant is.

All eleven are read and compared with your standard. Ten of them can be aligned, licences are read only.

  • Conditional Accesssign-in policies
  • Security defaultsMicrosoft's default protection
  • Authentication methodsAuthenticator, passkeys
  • Authentication strengthse.g. phishing-resistant only
  • Authentication contextsfor sensitive areas
  • Named locationsIP ranges and countries
  • User and guest rightswho may invite, what guests see
  • Cross-tenant accesstrust in other organisations
  • Microsoft 365 groupsguests as owners
  • SharePoint and OneDrivehow widely files may be shared
  • Licenceswhat the tenant can do, read only
Who has access?365 PermissionsFinds shares that go too far.
Is everything configured correctly?365 TenantsKeeps every tenant on your security standard.
Can everything be restored?365 BackupBacks up users, groups and applications from Entra ID.

Frequently asked questions about 365 Tenants

What does 365 Tenants do?

365 Tenants records a secure state of a tenant's settings as a template: which Conditional Access policies apply, which sign-in methods are allowed, what guests may do and how widely content may be shared. Every tenant is compared against it regularly, and the template can be brought into the tenant after a dry run.

Which licences does the tenant need?

Reading and comparing work in every tenant. Conditional Access requires Entra ID P1, which is included in Microsoft 365 Business Premium, for example. Without the licence, 365 Tenants does not write these entries and does not count them as drift.

What happens to the security defaults?

Security defaults and your own Conditional Access policies are mutually exclusive. They stay on until enforcement and are switched off in the same run that makes MFA for everyone effective. If that run fails, 365 Tenants switches them back on.

Can I lock myself out with Conditional Access?

That is exactly what enforcement is built to prevent. It requires at least one fit break-glass account, an evaluation of report-only sign-ins and an observation period that has ended or was explicitly shortened. A blocking policy that does not exclude the break-glass accounts cannot be approved.

What is a break-glass account?

An emergency account with the Global Administrator role that is excluded from Conditional Access policies and used only in an emergency. 365 Tenants checks that it exists, is enabled, holds Global Administrator and is not synchronised from an on-premises directory.

Can a run be undone?

The latest run can be rolled back as long as its changes are still in place. Changed values are restored, new policies switched off. Nothing is ever deleted, and whatever someone else has changed since stays as it is.

Is Conbool hardened a CIS benchmark?

No. Conbool hardened is Conbool's basic hardening with ten entries, not a complete benchmark. Many entries match recommendations of the CIS benchmark for Microsoft 365, such as MFA for everyone and blocking legacy protocols. Your own templates can go as far as you like.

Does 365 Tenants also cover Intune?

No. Device management and Intune policies are out of scope. 365 Tenants works with the settings of Entra ID and the sharing settings of SharePoint and OneDrive.

Is this a backup of Entra ID?

No. 365 Tenants records settings, compares them and rolls out templates. Users, groups and applications are backed up by 365 Backup, with its own restore.

How does this differ from Microsoft 365 Lighthouse?

Lighthouse is Microsoft's partner interface with its own default settings. 365 Tenants relies on your own templates with per-customer placeholders and immutable versions, a dry run before every write and enforcement only after the break-glass accounts have been checked. Reading and writing use apps consented in the customer tenant.

So every tenant stays the way you set it up.

We show you 365 Tenants on a real tenant, from the first check to the dry run.

Request a demoBook a consultation