20%
Secure Score
Collects Microsoft Secure Score as a Microsoft signal. The SPB modeled score is separate.
SPB LABS · MICROSOFT 365 POSTURE ASSESSMENT
V1.0 · LiveIndependent project
Microsoft 365 security posture—collected locally, explained clearly.
Assess selected Microsoft Entra, Exchange/Defender, Purview, SharePoint/OneDrive, and Microsoft Secure Score signals with an explainable posture model and explicit collection coverage.
No server-side raw assessment upload is required for V1.0 scoring. Real collector JSON should still be treated as confidential security configuration data.
HOW IT WORKS
A simple, privacy-conscious assessment path
1
Collect
Run the read-oriented PowerShell collector from an authorized admin workstation.
2
Keep local
The collector writes a local JSON security configuration artifact.
3
Analyze
Select that JSON in the browser. V1.0 performs scoring and findings locally in the browser.
4
Prioritize
Review modeled risk, findings, recommended actions, and collection coverage.
Microsoft 365 → Local PowerShell Collector → Local JSON → Browser-Local Analysis
V1.0 ASSESSMENT AREAS
Five modeled domains, with Microsoft Secure Score kept distinct
25%
Identity & Access
MFA capability, Security Defaults, Conditional Access, direct privileged user role assignments, scope and exclusions.
20%
Email Security
Anti-phishing, Safe Links, Safe Attachments, outbound forwarding, and unified audit configuration.
20%
Compliance & Data
Purview DLP, retention, sensitivity labels, and sensitivity-label publishing policies.
15%
Collaboration
SharePoint/OneDrive sharing posture, default links, and legacy-authentication settings.
Coverage matters. Missing data is surfaced as incomplete coverage rather than silently assumed to be secure.
VALIDATION
Built by testing behavior, not just portal screenshots
V1.0 was matured through controlled real-tenant testing and synthetic regression fixtures. The objective was to verify whether the product could distinguish configuration presence, Report-only state, actual enforcement, and incomplete evidence.
- Unified Audit Log remediation detection
- Microsoft Entra Security Defaults awareness
- Conditional Access Report-only vs enabled state
- Broad MFA scope and exclusions
- Legacy-authentication blocking
- Device-code-flow blocking
- Controlled Security Defaults → Conditional Access cutover
- Conditional Access What If simulation
- Post-cutover sign-in-log verification
PRIVACY & SAFETY
Designed around administrator control of the assessment artifact
Local collector
Collection runs on the administrator workstation using authorized Microsoft 365 sessions.
No content collection by design
The collector is not designed to export passwords, password hashes, tokens, message bodies, Teams chats, document contents, secret values, or private keys.
Confidential JSON
Configuration metadata can still reveal security posture. Store real JSON and PDFs as confidential artifacts.
Public demos
Use the synthetic dataset or a carefully sanitized assessment for public screenshots and demonstrations.
WHAT V1.0 DOES WELL
Explainable posture assessment
- Separates Microsoft Secure Score from the SPB modeled score
- Shows why a finding exists and recommends an action
- Recognizes Security Defaults as a legitimate baseline signal
- Does not treat Report-only Conditional Access as enforcement
- Surfaces intentional exclusions for governance review
- Reports which data areas were and were not collected
KNOWN V1.0 LIMITS
Boundaries are part of the product
- Privileged-role analysis covers direct user assignments; group-transitive and PIM-eligible assignments require separate review.
- Conditional Access configuration analysis does not replace Microsoft What If or effective sign-in-log evaluation.
- Licensing, permissions, APIs, and module versions can change collection availability.
- The SPB modeled score is not an audit certification, compliance attestation, or Microsoft score.
- V1.0 does not perform remediation changes.
SPB LABS · V1.0