Your Microsoft 365, checked before an attacker — or an insurer — checks it.
TenantCheck 365 is a Microsoft 365 security check for small firms with no IT person. Most small tenants run on setup defaults: no MFA on some accounts, old sign-in protocols still on, third-party apps holding mail access nobody remembers approving. One scan of your tenant produces a fix plan you approve step by step, a ranked list of risky app grants, and an evidence pack your cyber-insurance renewal can actually use.
How it works
1. Export — your tenant's settings are exported as one JSON file shaped like Microsoft's own admin data. See exactly where each part comes from, or skip straight to the demo below.
2. Upload — the scan runs on the export. No Microsoft sign-in, no password, nothing installed.
3. Review — you get the three reports below, each dated and DRAFT-stamped. Fixes are a plan for your approval, never applied behind your back.
A live connection that skips the export is the next step — it needs an app registration and consent from your own admin. How that will work.
TenantFix 365 Module 1 — live
The hardening scan: accounts without MFA (admins flagged critical), legacy authentication still enabled, inbox rules quietly forwarding mail outside the business, anonymous file sharing, too many Global Administrators, dormant admin accounts, broad guest access, and weak password policy. Every finding comes with the reason it matters and the exact fix steps, as an owner-approved fix plan.
Founding price: $149 one time for the scan and fix plan · $39/month monitoring with re-scan alerts.
Run a scanTokenWatch Module 2 — live
Every third-party app your people have connected to Microsoft 365 keeps the access it was granted — often mail and file access — long after everyone forgot it. TokenWatch inventories every OAuth grant and ranks it by what it can reach, how long it has sat unused, and whether one user approved it alone, with extra weight on unverified publishers. These grants bypass MFA entirely.
Included in the bundle below.
InsureReady 365 Module 3 — live
Thirteen questions a typical Canadian cyber-insurance renewal asks — MFA, legacy auth, EDR coverage, tested backups, admin limits, training, incident response — each answered Supported, Gap, or Evidence missing from the same scan, with the evidence attached. Where the tenant data cannot support an answer, the pack says so instead of guessing.
Included in the bundle below.
The bundle All three modules
TenantFix + TokenWatch + InsureReady on one tenant scan engine, with scheduled re-scans so the state you attested to stays true between renewals.
Founding price: $49/month for the full bundle.
Founding prices are the introductory prices for the first cohort. This site takes no payment yet — checkout opens when the founding cohort launches. Join the list below and founding pricing is locked for you.
See it on a demo tenant first
The demo runs the full scan on a fictional 18-person bookkeeping firm with real problems planted in it — no MFA on three accounts including an admin, an inbox rule forwarding invoices to an outside address, and a forgotten app with mail access unused for 210 days. Same engine, same reports, zero risk.
Join the founding list
Leave your details and we will write when the founding cohort opens. No email is sent by this form — it only records your details for the launch note.
TenantCheck 365 prepares evidence. It does not certify compliance and is not legal or insurance advice. Every finding is an issue to review, found by deterministic checks — never a certification.