SPB LABS V1.0

SPB Labs · Security & Compliance

Microsoft 365
Security & Compliance Analyzer

Assess Microsoft 365 security posture across Secure Score, identity controls, email protection, compliance, and collaboration settings—without uploading the raw assessment dataset to a server-side analyzer.

Run Assessment
Read-only collection Local JSON Browser analysis Coverage-aware scoring
M365

Security posture beyond identity

Designed to complement IdentityGuard by assessing broader Microsoft 365 controls: email security, data protection, compliance, collaboration, Secure Score, and tenant governance.

5Posture domains
100Modeled score
LocalAnalysis model
ReadCollector actions

Assessment

Start with demo data or your local collector output

1

Try the synthetic demo

Explore the dashboard, scoring model, findings, and coverage without using a real Microsoft 365 tenant.

3

Import local JSON

The selected file is read by this browser. V1.0 does not upload the raw assessment JSON to a server-side analysis API.

No file selected
No assessment loaded. Use the synthetic demo or import collector JSON.

Dashboard

Microsoft 365 posture at a glance

Load an assessment to generate the dashboard.

Findings

Risk, reason, and recommended action

No findings yet.

Collection Coverage

Know what was—and was not—assessed

Load an assessment to review collection completeness.

Methodology

How V1.0 interprets posture

Modeled score

The 0–100 score is an SPB Labs posture model, not Microsoft Secure Score. Microsoft Secure Score is collected and shown separately as a source signal.

  • Secure Score — 20%
  • Identity & Access — 25%
  • Email Security — 20%
  • Compliance & Data — 20%
  • Collaboration — 15%

Enforcement semantics

  • Report-only Conditional Access is visible but is not treated as enforcement.
  • Confirmed Security Defaults can satisfy baseline MFA, legacy-authentication, and device-code-flow protections when custom Conditional Access is not enforced.
  • Conditional Access exclusions are surfaced for review rather than automatically treated as insecure.
  • Configuration analysis does not replace Microsoft What If or sign-in-log validation.

Coverage behavior

  • Missing product domains reduce assessment coverage rather than being assumed secure.
  • If a prerequisite signal such as Security Defaults state was not collected, V1.0 avoids claiming the control is absent solely from missing data.
  • Collection warnings remain visible in the Coverage section.

Known V1.0 limits

  • Privileged-role analysis covers direct user role assignments; group-transitive and PIM-eligible assignments require separate review.
  • Licensing and admin permissions can change which Microsoft 365 signals are available.
  • Findings should be validated in authoritative Microsoft admin portals before production changes.
  • Emergency accounts can still encounter Microsoft platform-mandated MFA even when excluded from custom Conditional Access.

Privacy & Security Model

Designed for local control

Microsoft 365Authorized tenant
→
Local CollectorRead-oriented commands
→
Local JSONYou control the file
→
Browser AnalysisNo raw-data backend

What the collector does

  • Uses read permissions / Get-* administrative cmdlets.
  • Collects posture summaries and policy configuration needed for assessment.
  • Records collection warnings when a module or permission is unavailable.
  • Supports anonymization of tenant and policy names.

What it is not designed to collect

  • Passwords or password hashes
  • Authentication secret values
  • Email message bodies
  • Teams chat content
  • SharePoint / OneDrive document content
  • Application secret values or private keys
Collector JSON still contains security configuration information and should be treated as a confidential security artifact. IdentityGuard should be used for deeper identity-specific assessment; this product focuses on broader Microsoft 365 security and compliance posture.