Know who can reach what in your Microsoft 365 - and prove it.

Read-only, apart from one change you approve and we remove. A Global Administrator takes three one-time steps, about fifteen minutes: approving our read-only assessment application, running one short command that gives it Microsoft’s read-only Global Reader role, and approving our SharePoint sign-in application, whose delegated permissions act only with the rights of whoever signs in to it. You also create a temporary engagement account with the SharePoint Administrator role and share its sign-in details with us, because a run signs in to it three times, hours apart, and we do the signing in. That role does not open any site’s contents, so, with your written agreement, we add the account as a site collection administrator on every SharePoint site before the run and remove every addition at handover - the only change the assessment makes. Every sign-in shows in your Entra sign-in logs, and the additions and removals in your audit log. As a fallback, if you cannot allow the change, an account that already belongs to most sites can sign in instead - its administrator signs in at each of the three points, twice at the start of the run and once hours later - and any site it cannot open is named in the report as not read.

Nowhere you have to log into. The assessment produces a single, self-contained report you own and keep. The working data behind it stays on our own assessment machine in Microsoft Azure (UK South), which accepts no inbound connections. The delivered encrypted package and our readout brief are held in Glow Cloud's own Microsoft 365 tenant (our SharePoint delivery site and our OneDrive), not in any third-party assessment product or shared platform, and no copy of your run data is kept on any other machine once the engagement is delivered. Only one aggregate record reaches our client portal - your score, verdict, summary counts, the run date and tier, organisation name, contact email and report link - never findings, raw data or report files. The delivered encrypted package is removed from our delivery site by our scheduled sweep once it is more than thirty days old (by default), or at once on request, and we delete everything we hold for a client on request, in writing, at any time. Retainer clients keep prior runs by design, because the quarter-over-quarter drift is computed from them.

The reachability map - who can reach which file, and exactly how - a link-by-link external-sharing deep-dive down to the recipient, and a config baseline across Entra, email, Teams, SharePoint, devices and data protection. All scored against the Glow Cloud M365 Security Framework, licence-aware and honest.

Free scanners and native scoring grade your configuration - that is the floor, and it is useful. We start above it: who can actually reach your data, what is over-shared, and what to fix first - interpreted by a named architect who is accountable for the answer. A config score cannot tell you who can reach what, or stand behind the finding.

Yes. We surface the oversharing and broad access Copilot would expose to staff on day one, so you can fix it before switching Copilot on.

No. It is a point-in-time assessment, not a certification or accredited audit, and not legal advice. Assessments can be aligned to recognised industry best practice on request.

No. Every paid engagement includes a live readout with the architect who ran it - we walk your team through the findings, what they mean for your estate specifically, and what to do first. The report is yours to keep and is written to be read without us, but the readout is where most of the value lands: the questions that matter are almost always about your data, not about the method. Retainer clients get one every quarter.

The Complete engagement - config baseline, sharing deep-dive and permission map in one run - is £2,700, and is what most buyers take. Individually: the Permission (RBAC) Map is £1,750, the Sharing & Permission Deep-Dive is £1,000, the Full Suite (baseline and deep-dive, no map) is £2,200, and the config baseline on its own is £1,500. The quarterly retainer starts at £7,500/yr and includes four complete engagements, the drift comparison between them, and a readout each quarter. The Copilot-readiness health-check is free.

Your report lands within 3 business days of access for the Assessment, and within 5 business days for the Deep-Dive, Full Suite and RBAC Map.

The fixed prices cover a tenant of up to around 250 SharePoint sites - typically a few hundred users, though headcount is only half of it. The effort, and the size of the reports, scale with the number of sites, and a small team can easily have thousands. Above that the work is scoped individually, and we will always confirm the price before anything starts. Tell us roughly how many sites you have, or just book a call.

The assessment still runs, and anything that needed a consent you chose not to grant is marked “requires consent” in your report rather than being silently missing, guessed at, or scored against you. The engagement account works differently and we would rather say so: without it, the tenant-level SharePoint settings and the scan for content shared with everyone are reported as not assessed, and the permission map shows access rolled up to the site instead of down to the library - a shallower map that can overstate reach. We will tell you at the readout if that happened.

Yes - it is a fixed-scope engagement: a full refund if we cannot gain the agreed access within 5 business days. Once the assessment run begins it is non-refundable.