VITALS

The checks

27 checks. Six areas. One prioritised report.

Each check is a defined rule over evidence read from your tenant, weighted so that a low score names the area that owns the problem. The shares below are computed from the weights, and they move when a check is added — which is the product telling the truth about what it now weighs most.

All twenty-seven checks

Grouped into six areas and weighted, so a low score names the area that owns the problem rather than passing one verdict on everything. The percentage is that area’s share of the overall score.

Content & Protection

10 checks39%

How content is shared, labelled, owned and maintained — and what an AI assistant would surface first.

  • Access & Oversharing
  • Labelling & Protection
  • Sharing Defaults
  • Guest Access
  • Site Ownership
  • Content Freshness
  • Duplication
  • Findability
  • Workspace Hygiene
  • Bulk Access Exposure

Identity & Access

8 checks33%

Who can get in, how strongly, and whether a conversation with an outsider could become access.

  • Sign-in Protection
  • Multi-Factor Coverage
  • Authentication Maturity
  • Identity & Administration
  • Third-Party Applications
  • Microsoft Security Baseline
  • Collaboration Exposure
  • Credential Registration

Email & Domain

2 checks8%

Whether the organisation can be impersonated, and what its mailboxes are doing.

  • Email Domain Protection
  • Mailbox Rules

Workplace Experience

4 checks10%

Whether the intranet is current, worth visiting, and built on anything Microsoft is retiring.

  • Page Freshness
  • Legacy SharePoint
  • Publishing Hygiene
  • Landing Pages

Licensing & Devices

2 checks6%

What is paid for, what is used, and what is managed.

  • Licence Utilisation
  • Device Management

And the verdict

Copilot Readiness

1 check · 4%

Judged on everything above rather than measured separately. Copilot answers with whatever the person asking is already allowed to see — it does not widen access, it makes existing access findable by asking. So the verdict is a consequence of the governance findings, and it will say not yet while critical items are open, whatever the licence position.