Frequently asked questions

A Microsoft 365 assessment and governance platform. It connects to a tenant with read-only consent, evaluates 53 controls across identity, access, devices, email, collaboration, threat protection, licensing and governance, and produces branded reports. It then tracks what changes between assessments, holds tenants to your own baselines, and plans device refreshes.

Managed service providers and IT consultancies that look after several Microsoft 365 tenants, primarily in the UK. In-house IT teams with a single tenant can use it too; the Starter plan covers them.

Add the tenant in SurePosture and send the generated consent link to a Global Administrator (or Privileged Role Administrator) in that tenant. Microsoft shows them exactly which read-only permissions are requested. Once they approve, the first assessment starts automatically.

Usually a few minutes. Very large tenants take longer because Microsoft Graph limits how quickly data can be read. Assessments run in the background, and you can be emailed when one finishes.

Yes: 14 days, one tenant, every feature, no card. When it ends you can still sign in and see your reports; adding tenants and scheduled assessments stop until you choose a plan.

Yes. The self-contained Windows demo runs the whole product on one PC with three synthetic tenants, and never connects to Microsoft 365. Ask us for the download link.

Read-only Microsoft Graph application permissions: organisation, users, groups, policies, directory roles, applications, audit logs, reports and security events. Optional read permissions (Intune, Identity Protection, SharePoint settings, mailbox rules) widen coverage; without them the related controls are reported as not assessed, never as passed. The full list is on the data protection page.

Not unless you set it up to. Assessment is read-only. Automated fixes need a separate consent for write permissions, automation switched on for that specific tenant, a successful dry run, and approval from someone other than the person who proposed the change. Every change records a rollback plan and is audited.

No. It reads configuration and directory information: accounts, groups, policies, devices and subscriptions. It does not request the permissions that would allow it to read message bodies, file contents, chats or calendars. The forwarding check reads inbox rule definitions only.

The client’s administrator can delete the SurePosture enterprise application in the Entra admin centre (Enterprise applications) at any time. Access stops immediately. Removing a tenant in SurePosture also deletes its assessments, findings and reports.

No. SurePosture signs in as its own multi-tenant application, which your administrator consents to. If a client insists on using their own app registration, its secret is encrypted with AES-256-GCM and bound to that tenant record.

Yes, two ways. Sign in with Microsoft uses your own work account, so your organisation’s Conditional Access and MFA apply. Password accounts can add two-step verification with any authenticator app, with single-use recovery codes, and a workspace owner can require it for everyone. Passwords are at least 12 characters and stored as salted scrypt hashes, sign-in attempts are rate limited, and you can see and end your active sessions under Settings → Security.

Yes, as a readiness check. Each tenant has a Cyber Essentials view that maps the scheme’s five controls to the checks SurePosture runs: MFA, admin rights, leavers, device configuration and unsupported operating systems are evidenced straight from the tenant. Firewalls, anti-malware and patching timelines cannot be seen from Microsoft 365, so your consultants record those with a note, and the technical report includes the result. It prepares a client for assessment; certification itself is awarded by an IASME certification body.

53 controls: MFA and authentication methods, Conditional Access, legacy authentication, privileged roles, app registrations and consent grants, Intune compliance and device health, SPF, DKIM, DMARC and MTA-STS, mail forwarding, guest and sharing settings, Secure Score, risky users and alerts, licence waste and governance hygiene. Each finding includes the evidence, the business impact and step-by-step remediation.

It compares each assessment with the previous one. A fix only counts when the re-read tenant passes the check. It is credited to an approved automated change or to the consultant who marked it done, with their note; otherwise it is shown as a change made directly in the tenant. Anything marked done that still fails is reported as such.

A set of controls every tenant should meet, for example the standard your managed service promises. Apply it to all tenants or to tenants with a given tag, and SurePosture shows compliance per tenant, the controls hardest to meet, and drift since the last assessment.

They are indicative UK business prices excluding VAT, meant for budgeting rather than quoting. Each tier states a minimum specification to hold resellers to, with current example models.

Yes. Your logo, brand colour and footer go on every report. There are executive, technical and board reports, plus the client review pack for quarterly meetings, as PDF or HTML, with optional expiring share links.

Email authentication (SPF, DKIM, DMARC, MTA-STS) for every custom domain, and inbox rules that forward mail outside the organisation. Transport rules and anti-phishing policy settings need Exchange Online PowerShell and are not covered yet.

By the number of tenants you manage, in pounds, excluding VAT, with seats included. Annual billing costs ten months for twelve.

Yes, from Billing in the console at any time. Your plan runs to the end of the period you have paid for.

In the region shown on the data protection page. Assessment data is kept while your workspace exists so trends and change tracking work. Removing a tenant deletes its data; to close your workspace entirely, contact us and it is deleted.

SurePosture is built to data-minimise: collectors keep only the fields the checks need. For the tenant data you process through it, you are the controller and we act as your processor under a data processing agreement. The data protection and privacy pages set out the detail.