“Free Microsoft 365 security assessment” is a crowded phrase, and most of what sits behind it is an automated score screenshot or a thinly veiled sales call. The honest answer is that there are two different things: a genuinely free check you can have today, and a full paid assessment when you want the detail. Here is exactly what each covers, and what “free” really means.
What you can have for free
The free check is a Copilot readiness check: a read-only scan of what Microsoft 365 Copilot would surface to your staff, before you switch it on. It gives you:
- A clear score across six areas (identity, devices, SharePoint, email, data, Copilot), measured against the Glow Cloud M365 Security Framework.
- The oversharing and exposure findings that matter most: anonymous links, broad and org-wide access, and unlabelled content.
- All of it prioritised and in plain English, in a report you keep.
It is genuinely free, read-only, and there is no obligation. That is the entry point, and for most teams worried about Copilot, knowing where they stand is enough to act.
What “free” actually means
Fair question to ask of anything free. The straight version:
- No obligation. You keep the report whether or not you ever work with us.
- The catch, such as it is: we are good at this, and we expect the report to make that obvious. Some people fix the findings themselves. Some ask us to.
- Nothing installed, no content leaves your tenant. It is read-only, more on access below.
If an “assessment” needs you to install an agent, hand over admin credentials, or sit through a pitch before you see anything, that is a lead-generation tool, not an assessment.
Where the free check ends and the paid assessment begins
The free check tells you where you are exposed. The full, paid Glow Cloud M365 Security Assessment gives you the receipts:
- Every applicable control, scored pass / partial / fail, with the evidence behind it and a per-domain compliance breakdown.
- A site-by-site sharing map: every site’s exposure broken down by link type, anyone / org-wide / guest.
- A link-by-link drill-down: who can actually reach what, and how.
That depth is what feeds a real remediation plan. Fixing the findings is a separate, fixed-scope sprint, and keeping the tenant clean as it drifts is a governance retainer. The free check is the front door; the assessment is the full picture.
The six areas, and why a framework
Both the free score and the paid assessment are measured against the Glow Cloud M365 Security Framework, our own control set, refined across years of hands-on Microsoft 365 governance work, rather than against a vibe. (Findings are aligned with recognised industry best practice.)
- Identity and access. MFA coverage, legacy authentication, admin roles, conditional access.
- Devices and Intune. Enrolment, compliance, encryption, and unmanaged devices reaching company data.
- SharePoint and external sharing. Default link types, expiry, anonymous access, and content shared too broadly.
- Email security. SPF, DKIM, DMARC and anti-phishing.
- Data protection. Sensitivity labels, DLP and retention.
- Copilot readiness. What Copilot would surface on day one, mostly a function of the oversharing above.
What it is not
- Not a raw score dump. A single native score is one number that mostly rewards buying more licences, not a picture of where you are actually exposed.
- Not a raw tool you run blind. You should not have to decode a wall of PowerShell yourself.
- Not a sales trap. No pitch gate, no obligation, and you keep the report.
How the access works
You stay in control the whole way:
- Access-first: grant a temporary, least-privilege read-only role (such as Global Reader) that you revoke the moment we are done.
- Or self-run: run a sealed, read-only script yourself and send us the output.
Either way, nothing is installed, nothing is changed, and no content is removed from your tenant.
The honest reason to do it now
Most tenants are more exposed than anyone realises, and Copilot is about to make that exposure instantly findable. The free check tells you where you stand before you scale it: prioritised, in a morning, for nothing.
Start with the free Copilot readiness check. When you want the full per-control detail and the site-by-site sharing map, that is the paid assessment. And if oversharing is the part that worries you, here is what it actually looks like.