Sign in
Sign in as a Global Administrator through Microsoft's own sign-in. The first time, Microsoft asks you to approve read-only access for your organisation.
Microsoft 365 security assurance
m365cis
Know where your Microsoft 365 stands against the CIS Benchmark.
m365cis reads your tenant's security settings, checks them against the CIS Microsoft 365 Foundations Benchmark, and gives you a clear report: what passes, what fails, and exactly what to change in which admin portal.
Read-only. No app registration. Sign in as a Global Administrator and run.
6.5.4SMTP AUTH is disabledPASS
5.2.2.2MFA required for all users (Conditional Access)PASS
5.1.2.2Users cannot register applicationsFAIL
What to do: change the setting in the Microsoft Entra admin center
- Users > User settings: set Users can register applications to No.
- Run the assessment again to confirm PASS.
5.2.2.6Identity Protection user risk policyNOT LICENSED
8.1.1Teams file sharing limited to approved cloud storageCHECK MANUALLY
Workflow1 2 3
How it works
No agents, no cloud service, nothing to configure in your tenant. m365cis runs on one Windows computer.
Assess
m365cis reads the settings of Entra ID, Exchange Online, Defender for Office 365, SharePoint and your mail DNS records, and checks them against the benchmark.
Act on the report
An action plan, sorted by priority, tells you what to fix first. Every finding has steps and a link to the right admin portal.
Coverage
What it checks
For the CIS Microsoft 365 Foundations Benchmark v7.0.0, m365cis assesses 49 recommendations automatically and gives clear manual-check guidance for the rest—all 160 recommendations appear in your report.
| Area | Examples | Automated checks |
|---|---|---|
| Microsoft Entra ID | Conditional Access and MFA, legacy authentication, user and guest permissions, authentication methods | 18 |
| Defender for Office 365 | Safe Links, Safe Attachments, anti-spam and anti-malware, DKIM, SPF and DMARC | 13 |
| Exchange Online | Audit logging, SMTP AUTH, mail forwarding, MailTips, add-ins, modern authentication | 10 |
| SharePoint and OneDrive | External sharing, legacy authentication, resharing | 4 |
| Microsoft 365 admin center | Password expiry, calendar sharing, Customer Lockbox | 3 |
| Microsoft Purview | Unified audit log | 1 |
| Total automated checks | 49 | |
Teams, Fabric and Intune recommendations are listed with step-by-step manual checks. m365cis detects your Microsoft 365 licences (Business Premium, E3, E5) and reports features you are not licensed for as licence-dependent—not as failures.
Reporting
Reports you can act on—and show to an auditor.
An action plan, not just a score
Findings are grouped by what to do—fix a setting, check manually, licence-dependent—with the admin portal for each.
Evidence for every result
Each result shows the setting found and the value expected, with the date it was read.
Exceptions and attestations
Record accepted risks with an owner and expiry date, and manual checks as attestations that come up again for review.
The formats you need
HTML report (light and dark), CSV for spreadsheets, JSON for automation and SARIF for security tooling.
Security by design
Built for security teams to trust.
Read-only
m365cis only reads settings. It never changes anything in Microsoft 365—write access is refused by design.
No app registration
Sign-in goes through Microsoft's own PowerShell modules. No client secrets or certificates are created in your tenant.
Your data stays with you
Everything runs and stays on your computer. Nothing is sent to Innogen Technologies or any other service.
Personal data protected
E-mail addresses, user IDs and IP addresses are replaced with pseudonyms in reports. Stored evidence is encrypted (AES-256-GCM) and every action is recorded in a tamper-evident audit log.
Short-lived sign-in
Sign-ins are kept in memory only and end on sign-out, on exit, or after 30 minutes without activity.
Deployment
Requirements
- ComputerWindows 10 or 11 (64-bit), internet access. No installation—runs from a folder.
- PowerShellPowerShell 7 with two Microsoft modules, installed once:
Install-Module Microsoft.Graph.Authentication -Scope CurrentUserInstall-Module ExchangeOnlineManagement -Scope CurrentUser - Microsoft 365Business Premium, E3 or E5, and a Global Administrator account to sign in.
- BenchmarkThe CIS Microsoft 365 Foundations Benchmark v7.0.0 PDF, available from the Center for Internet Security website. You import it once.
LicensingBest value
Licences
One licence per computer. Assess as often as you like during the licence period.
3 months
Price on request
per computer
Request a quote6 months
Price on request
per computer
Request a quote12 months
Price on request
per computer
Request a quoteHow licensing works: download m365cis, open the Licence page and send us the request code it shows. You receive a licence file for that computer.
FAQ
Questions
Does m365cis change anything in my tenant?
No. It only reads settings. Write permissions are refused by design, and Exchange is limited to read-only commands.
Do I need to create an app registration in Entra ID?
No. m365cis signs in through Microsoft's own PowerShell modules. The first time, a Global Administrator approves Microsoft's "Microsoft Graph Command Line Tools" app for read-only access.
Where does my data go?
Nowhere. Settings are read from Microsoft 365 to your computer and stay there. Reports are files you control.
Does it work with Microsoft 365 Business Premium?
Yes. m365cis detects your licences and applies the matching CIS profile. Recommendations that need features outside your plan—such as Entra ID P2—are shown as licence-dependent with your options.
Why are some recommendations "check manually"?
Some settings cannot be read reliably through Microsoft's interfaces yet, or are not covered by m365cis today (for example Teams and Fabric). For each one the report gives the steps and the admin portal, and you can record the result so it is tracked.
Can I assess more than one tenant?
Yes. Sign in to each tenant in turn; each one is added automatically and gets its own reports.
Get m365cis
Assess Microsoft 365 against the CIS Benchmark.
Request access or a licence, or ask Innogen to walk you through a sample report before deployment.
m365cis is an independent product of Innogen Technologies.
CIS® and CIS Benchmarks® are registered trademarks of the Center for Internet Security, Inc. m365cis is not affiliated with, endorsed by or certified by the Center for Internet Security. Microsoft, Microsoft 365, Entra, Exchange, SharePoint, Teams and Defender are trademarks of the Microsoft group of companies.