Microsoft 365 security assessment sample report
The Vitals Assessment, published.
The Vitals Assessment, in full, from a tenant built for the purpose. No form, no email address. Names, files and sites are replaced, as in every Assessment. Vitals In-Depth adds the example lines behind each finding, a page for each capability and the full Copilot working pages. 31 pages, with the evidence rows under each finding.
This is a real Microsoft 365 security assessment report: the same format, the same 26 checks and the same scoring a paying customer receives, run against a tenant built for the purpose.
Kirkwell Industries Ltd is not a real company. The tenant, the staff and the findings are invented, and deliberately typical rather than a worst case.
What to look for in the sample
Three things worth checking, because they are what separate a report from a dashboard export.
Every finding names the evidence it was read from — the Microsoft data, not an assertion. Every finding says how it knows: observed, calculated, inferred, or not assessed. And the coverage page states what was not scanned, so anything unassessed is excluded from the score rather than quietly counted as a pass.
See how a finding is made →See all 26 Microsoft 365 checks →
What the document contains
In the order it arrives in.
The score, and what it means
One number out of 100 with the band it falls in, then five area scores — identity, email, data, licensing and workplace — so a low score names the area that owns the problem rather than passing one verdict on everything.
An action plan in order
Now, soon and later. Each piece of work gathers the findings it resolves, and work that other work depends on comes first — so sign-in protection comes before anything that relies on it.
Evidence tables
Every domain against SPF, DKIM and DMARC. Every third-party application and what it can reach. Who can complete a multi-factor prompt. The narrative explains; the tables are what somebody works through.
The Copilot pilot outcome
One outcome for a controlled pilot — ready, blocked, cannot yet be determined, or not available — with the evidence behind it. The sample is blocked: sign-in protection is not in force, and the report says what must happen before a controlled pilot.
Every finding, in full
Grouped by area and ordered by severity within each, so the document can be worked through one area at a time or forwarded to whoever owns that area.
What was not scanned
How many sites were examined out of how many exist, and which checks did not run. Anything unassessed is excluded from the score rather than counted as a pass.
The same document, in your name
Partner reports carry your name for each customer you assess through Vitals: the same format, the same checks, your name and logo on the cover, and what changed since the last one. Vitals for MSPs is free to join, from £99 a month for up to 10 customer tenants.
One tenant, once. A single Vitals Assessment is £99 plus VAT, delivered within three working days of access being approved, and nothing renews. Get an assessment →
Read about Vitals security and access first, or see the Copilot pilot assessment.