Below is the shape of a report you receive after an agreed assessment. Company details are anonymised. This is not an assessment of your environment — only a section template.
1. Metadata
| Field | Content |
|---|---|
| Scope | Microsoft 365 tenant (1 domain), 2 Windows Server hosts on the office network, 1 edge firewall, public DNS for the company domain |
| Out of scope | End-user workstations, guest Wi‑Fi, SaaS apps outside M365, active web-app penetration test |
| Work period | 3–5 March 2026 |
| Methods | Interview with the administrator, Entra ID / Exchange Online configuration review, DNS read (SPF/DKIM/DMARC), NAT/firewall rule review, listen list on agreed hosts |
| Limits | No break-glass account for read-only checks; VPN logs only for 14 days |
2. Decision summary
Highest risks in scope: (1) Global Administrator without phishing-resistant MFA, (2) RDP from the internet to one host marked “temporary”, (3) no documented backup restore test in the last 12 months. None of the findings is a “security score out of 10”.
3. Findings
F-01 — Global Administrator without passkey / FIDO2
- Priority: critical
- Fact: Two Global Administrator accounts use TOTP-app MFA; no security key registered.
- Risk: Successful phishing of the session or code yields full tenant control.
- Recommendation: Enforce phishing-resistant MFA on privileged roles; add a second backup method away from the daily phone.
- Owner (proposed): IT / company owner
F-02 — RDP published on a public address
- Priority: critical
- Fact: Host
srv-app01accepts TCP/3389 from an untrusted network; rule labelled “temporary” with no expiry. - Risk: Automated scans and credential stuffing against local / domain accounts.
- Recommendation: Close the publication immediately; access only via VPN or a broker with MFA; if it must remain — source allowlist + dedicated account + logon monitoring.
- Owner (proposed): Network administrator
F-03 — DMARC at none without report ownership
- Priority: important
- Fact: DMARC record
p=none; a report mailbox exists but has no standing owner. - Risk: Domain spoofing without a signal to the owner.
- Recommendation: Assign a report owner; after source inventory move stepwise to
quarantineper the procedure.
F-04 — Backup without a confirmed restore test
- Priority: important
- Fact: Copy to a network disk in the same site; last successful file restore — per interview — more than a year ago.
- Risk: After ransomware or media failure there is no proof recovery works.
- Recommendation: One restore test using the worksheet; consider a copy outside the production site.
F-05 — Former collaborator still in the VPN group
- Priority: later
- Fact: Account disabled in AD, still a member of the VPN access group.
- Recommendation: Remove from access groups; add an offboarding checklist.
4. What was not checked
- Endpoints and EDR
- Guest / IoT VLAN segregation
- Company web application (no consent for active tests)
- DLP policies and sensitivity labels
5. Proposed fix order
- Close internet RDP (F-02).
- Enforce phishing-resistant MFA on Global Admin (F-01).
- Assign DMARC ownership and a rollout calendar (F-03).
- Run and record a restore test (F-04).
- VPN offboarding (F-05).
6. Attachments (in a full report)
- Mail DNS record export
- Firewall rules covered by scope
- Note on access limitations
If you want this shape for your environment: agree an assessment scope.