Instant audit of your
M365 tenant

Mapped to CIS M365 Foundations Benchmark v6.0.0 and Microsoft Zero Trust. All checks are read-only and require no agents.

• Directory.Read.All

  Users, groups, roles, and domain information. No ability to read emails, files, or make any changes.
• AuditLog.Read.All & Reports.Read.All

  Audit log availability and MFA registration status across all users.
• Policy.Read.All

  Conditional Access policies, authentication methods, and authorization settings. Read-only, no changes possible.
• RoleManagement.Read.All

  Privileged role assignments and PIM eligibility schedules. Used to audit Global Admin count, standing vs just-in-time access, and whether admin accounts are cloud-only.
• SecurityEvents.Read.All

  Microsoft Secure Score: your tenant's security posture as rated by Microsoft itself.
• IdentityRiskyUser.Read.All

  Users flagged at risk by Microsoft Identity Protection. Requires Entra ID P2 licence. Detects accounts with signs of active compromise.
• MailboxSettings.Read

  Detects inbox rules that silently forward email to external addresses - a primary indicator of compromised accounts.
• SharePointTenantSettings.Read.All

  SharePoint external sharing level and anonymous link configuration - detects overly permissive file sharing policies.
• TeamworkAppSettings.Read.All

  Teams meeting policies and external access settings. Used to check whether anonymous users can join or start meetings.

Admin consent has been granted. EXEO can now scan your tenant. The scan takes approximately 60–90 seconds and runs 50 controls across identity, Conditional Access, email security, security posture, and sharing and collaboration. Mapped to CIS M365 v6.0.0.

Check your inbox

We've sent a confirmation link to your email.
Click it to access your full M365 security report.