--- title: Microsoft 365 & Endpoint Security Review | BorderHawk description: BorderHawk's Microsoft 365 and endpoint review uncovers hidden threats and misconfigurations before they become security incidents. --- [Skip to content](https://www.borderhawk.com/microsoft-cloud-and-endpoint-review#main-content) [![BorderHawk Logo in White.](https://www.borderhawk.com/hs-fs/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png?width=3050&height=975&name=BorderHawk%20Logo%20in%20White..png) ![BorderHawk LLC Logo Transparent Background](https://www.borderhawk.com/hs-fs/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20LLC%20Logo%20Transparent%20Background.png?width=3050&height=975&name=BorderHawk%20LLC%20Logo%20Transparent%20Background.png)](https://www.borderhawk.com?hsLang=en) [Contact Us](https://www.borderhawk.com/contact-us?hsLang=en) - [Home](https://www.borderhawk.com) - Solutions - [Cybersecurity Consulting](https://www.borderhawk.com/cybersecurity-consulting) - [Assessments](https://www.borderhawk.com/risk-assessments) - [Overwatch](https://www.borderhawk.com/overwatch-framework) - [M365/Endpoint Review](https://www.borderhawk.com/microsoft-cloud-and-endpoint-review) - [IR/BCDR Program Development](https://www.borderhawk.com/ir-bcdr-program-development) - Requirements - [CMMC](https://www.borderhawk.com/cmmc-consulting) - [BEAD / E-ACAM](https://www.borderhawk.com/bead-and-e-acam-consulting) - [HIPAA](https://www.borderhawk.com/hipaa-consulting) - [SOC](https://www.borderhawk.com/soc-2-consulting) - [PCI-DSS](https://www.borderhawk.com/pci-dss-consulting) - [About Us](https://www.borderhawk.com/about-us) - (470) 945-1979 # Microsoft 365 and Endpoint Security Review Your organization relies on Microsoft 365, endpoints, and connected systems to support operations, communication, and secure information access. However, when suspicious activity occurs, such as an unusual sign-in, configuration change, lateral movement, malicious process, or unexplained endpoint behavior, it can be challenging to determine if it is a minor issue or the start of a serious security event. BorderHawk's Microsoft Cloud and Endpoint Review provides organizations with a unified view of Microsoft 365 activity and endpoint behavior. This enables faster identification, confident investigation, and effective containment of potential threats before they impact operations, compliance, or security. ##### Whether You Need a One-Time Check or Ongoing Monitoring ###### Get Visibility Into Hidden Microsoft Activity [![Talk to an Expert](https://no-cache.hubspot.com/cta/default/22562447/interactive-192914496395.png)](https://www.borderhawk.com/hs/cta/wi/redirect?encryptedPayload=AVxigLI10B01vSGnLlqRBhPHgEtmqJSqN2H6wQMm%2FjElWIR%2FGhrNYU5BpdZmvGsYFYNDpYvu9h6BxsfWcZRANropMMu8RUwyrtRc69T4ORIS4d%2FCTUHbzGJWIsiObfXaeqV8PI8NyamqZJ43MSJnzDEZiJpAp0VlSSPT%2BMApFxh1kzahiLqY%2BXKvuL5iNHVfBYcg%2BQlVub9YuLozt2Jyj%2Fn7sliXJxeThFJ11fssk9snrCCVJKMsN8Hc1iw6t%2Fvx6DQbUXxj3ZEKAA%3D%3D&webInteractiveContentId=192914496395&portalId=22562447&hsLang=en) ## When Something Seems Wrong, Rely on More Than Guesswork IT teams must protect customer and personnel information, maintain system availability, support users, address security concerns, and meet regulatory requirements, often without a dedicated security team. As a result, when suspicious activity occurs, there may not be sufficient time, tools, or forensic visibility to determine the cause. The Endpoint and Microsoft Review addresses this challenge. It enables your team to move from uncertainty to evidence by analyzing Microsoft 365 activity and endpoint behavior together. - #### You Need Confidence, Not Assumptions Unusual logins, suspicious emails, or abnormal device behavior can quickly create uncertainty. This review helps determine whether activity is harmless, suspicious, or part of a broader threat by correlating Microsoft 365 and endpoint findings. - #### Your Team May Not Have Time to Investigate Everything Limited IT teams often have a full range of duties including managing systems, users, vendors, and operations. This service reduces investigation time by combining Microsoft 365 and endpoint intelligence into a unified view of potential threats. - #### Patient Trust Depends on Early Action Organizations cannot afford delays in recognizing suspicious activity. Early risk identification enables leadership to make timely decisions about containment, remediation, documentation, and communication. - #### Incidents Require Evidence If a security concern escalates to a compliance issue, it is not enough to say someone “looked into it.” Organizations need verifiable evidence of what was reviewed, what was found, and how risks were addressed. This service supports documentation of security measures, evaluation, audit trails, record retention, and incident response. ## Don't wait until uncertainty becomes an incident ## How the Review Supports Security and Compliance Expectations The Endpoint and Microsoft Review enhances security and compliance by improving visibility, investigation, mitigation, and documentation in Microsoft 365 and endpoint environments. The service aligns with Access Control, Audit Controls, Integrity Controls, Transmission Security, Security Incident Procedures, Risk Analysis and Management, Evaluation, Technical Safeguards, Documentation of Security Measures, and Record Retention.  ### Access Control #### Identify Signs That Access May Not Be Appropriate ![Access Control Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Access%20Control%20Icon.png?width=125&height=133&name=Access%20Control%20Icon.png) Access Control requirements ensure that systems with sensitive information are accessed appropriately. Access issues often start with minor activities, such as unusual sign-ins, unexpected account behavior, or configuration changes that increase exposure. The Endpoint and Microsoft Review supports Access Control by monitoring Microsoft 365 activity for indicators of compromise, such as unusual sign-ins and configuration changes. Microsoft 365 is often central to communication, file sharing, scheduling, administration, and patient workflows. A single compromised account can quickly affect email, files, permissions, and connected systems. This review helps your organization determine whether there are signs of unauthorized access to your environment.  Audit Controls require organizations to record and review activity in systems with electronic protected health information. However, logs alone are not sufficient; timely interpretation is essential to identify what requires attention. The Endpoint and Microsoft Review collects and analyzes Microsoft 365 audit data for anomalies and potential indicators of compromise. It also correlates findings from Microsoft 365 and endpoint systems to provide a comprehensive threat overview. This is especially important for organizations where staff may lack time to manually review complex Microsoft 365 activity or endpoint telemetry. Without timely interpretation, critical suspicious activity may go unnoticed. This service consolidates technical signals to provide a clearer investigation, helping your team understand incidents, assess risks, and determine next steps.  ### Audit Controls #### Make Security Activity Reviewable and Actionable ![Audit Controls Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Audit%20Controls%20Icon.png?width=125&height=126&name=Audit%20Controls%20Icon.png) ### Integrity Controls #### Protect Trust in Systems, Devices, and Data ![Integrity Controls Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Integrity%20Controls%20Icon.png?width=125&height=107&name=Integrity%20Controls%20Icon.png) Integrity Controls protect sensitive information from improper alteration or destruction. In modern systems, integrity risks may arise from suspicious endpoint behavior, malicious processes, persistence mechanisms, or lateral movement. The Endpoint and Microsoft Review provides endpoint monitoring and forensic visibility into suspicious behaviors, including malicious processes, lateral movement, and persistence mechanisms. This risk extends beyond data alteration to system trustworthiness. A compromised endpoint can serve as a foothold, persistence mechanisms can allow threats to remain, and lateral movement can escalate a single device issue into a broader security event. This review identifies behaviors that could undermine confidence in the systems your staff rely on daily.  Transmission Security focuses on protecting sensitive information during electronic transmission.  Activity, configuration changes, endpoint behavior, or lateral movement may suggest that sensitive information pathways require closer review. Looking only at Microsoft 365 or only at endpoints may leave the organization with an incomplete view. The Endpoint and Microsoft Review connects activity across cloud and endpoint environments, providing a coordinated understanding of security concerns.  If your organization uses Microsoft 365 for healthcare communication and operations, it is essential to know whether suspicious activity could put sensitive information at risk.  ### Transmission Security #### Understand Whether Activity Could Indicate Exposure ![Transmission Security Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Transmission%20Security%20Icon.png?width=125&height=169&name=Transmission%20Security%20Icon.png) ### Security Incident Procedures #### Respond Faster and With Better Information ![Security Incident Procedures Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Security%20Incident%20Procedures%20Icon.png?width=125&height=99&name=Security%20Incident%20Procedures%20Icon.png) Access Control requirements ensure that systems with sensitive information are accessed appropriately. Access issues often start with minor activities, such as unusual sign-ins, unexpected account behavior, or configuration changes that increase exposure. The Endpoint and Microsoft Review supports Access Control by monitoring Microsoft 365 activity for indicators of compromise, such as unusual sign-ins and configuration changes. Microsoft 365 is often central to communication, file sharing, scheduling, administration, and patient workflows. A single compromised account can quickly affect email, files, permissions, and connected systems. This review helps your organization determine whether there are signs of unauthorized access to your environment.   Compliance requirements often involve not only implementing safeguards but also demonstrating that risks are identified, evaluated, managed, and documented. The Endpoint and Microsoft Review supports Risk Analysis and Management, Evaluation, Documentation of Security Measures, Audit Controls, Record Retention, and Technical Safeguards. If suspicious activity is found, the organization needs more than informal notes or fragmented screenshots. It needs a defensible record of what was reviewed, what was identified, how findings were interpreted, and what remediation decisions were supported. According to the process overview, analysts correlate findings from both platforms, build a comprehensive threat picture across cloud and endpoint environments, reduce false positives, and support remediation decisions. The review provides the evidence healthcare organizations need when leadership, auditors, cyber insurers, business associates, or regulators request information on how security risks were evaluated and addressed.  ### Risk Analysis, Management, Evaluation, and Documentation #### Build Defensible Evidence ![Risk Management Icon](https://www.borderhawk.com/hs-fs/hubfs/Icons/Risk%20Management%20Icon.png?width=125&height=124&name=Risk%20Management%20Icon.png) ## What Could Be Happening Right Now Without Anyone Realizing? The most serious security threats are often subtle. In rural healthcare settings, suspicious activity may start quietly and appear across multiple systems, such as unusual Microsoft 365 sign-ins, configuration changes, suspicious endpoint behavior, lateral movement, malicious processes, or persistence mechanisms. The Endpoint and Microsoft Review is designed to detect these issues through Microsoft 365 activity analysis and endpoint monitoring. Without a unified approach, these signals can be overlooked, delayed, or mistaken for isolated technical problems. ### Hidden activity may already include: - A compromised Microsoft 365 account being used in ways that look routine. - A suspicious configuration change that quietly increases exposure. - A malicious process running on an endpoint. - Lateral movement from one device or account to another. - A persistence mechanism that allows an attacker to return. - Endpoint and cloud signals that only become meaningful when reviewed together. ###### The question is not only whether something is happening. ###### The question is whether your organization would know soon enough to respond. ### Add a Microsoft Tenant Baseline Review for a Clearer View of Your Microsoft 365 Security Posture Suspicious activity is not the only reason to review your Microsoft 365 environment. Sometimes the bigger issue is uncertainty about whether the tenant is configured securely in the first place.   A Microsoft 365 tenant can support daily business operations, email, file sharing, collaboration, identity, remote access, and sensitive workflows. But over time, settings can drift, exceptions can accumulate, mailbox rules can appear, guest access can expand, and configurations may no longer match security best practices. That is why BorderHawk can include a **Microsoft Tenant Baseline Review** as part of the Endpoint and Microsoft Review, or provide it as a separate standalone review. The Microsoft Tenant Baseline Review evaluates the security posture of a Microsoft 365 tenant by identifying misconfigurations, vulnerabilities, suspicious mailbox rules, unusual configurations, and other risk indicators. The review analyzes the Microsoft 365 environment and compare tenant settings against best-practice security configurations. #### Why Add a Tenant Baseline Review? The Endpoint and Microsoft Review helps identify suspicious activity across Microsoft 365 and endpoints. The Tenant Baseline Review adds another layer of value by helping your organization understand whether the Microsoft 365 environment itself is configured in a way that supports stronger security. This can help your organization identify: - Microsoft 365 security settings that may not align with best-practice baselines. - Suspicious mailbox rules or indicators of compromise. - Tenant-level vulnerabilities or unusual configurations. - Obvious configuration outliers that may increase risk. - Practical recommendations for strengthening Microsoft 365 defenses. The goal is to provide a clear baseline of tenant security health and actionable recommendations for reducing exposure to common attack vectors. ## You Do Not Need to Build a Full Security Operations Team to Get Better Visibility The Endpoint and Microsoft Review gives your organization a practical way to improve visibility across Microsoft 365 and endpoints, investigate suspicious activity, and support [HIPAA-aligned security decision-making](https://hipaa-consulting). If your team needs clarity, evidence, and a more complete view of potential threats, this review is a practical next step. [![Talk to an Expert](https://no-cache.hubspot.com/cta/default/22562447/interactive-192914496395.png)](https://www.borderhawk.com/hs/cta/wi/redirect?encryptedPayload=AVxigLI10B01vSGnLlqRBhPHgEtmqJSqN2H6wQMm%2FjElWIR%2FGhrNYU5BpdZmvGsYFYNDpYvu9h6BxsfWcZRANropMMu8RUwyrtRc69T4ORIS4d%2FCTUHbzGJWIsiObfXaeqV8PI8NyamqZJ43MSJnzDEZiJpAp0VlSSPT%2BMApFxh1kzahiLqY%2BXKvuL5iNHVfBYcg%2BQlVub9YuLozt2Jyj%2Fn7sliXJxeThFJ11fssk9snrCCVJKMsN8Hc1iw6t%2Fvx6DQbUXxj3ZEKAA%3D%3D&webInteractiveContentId=192914496395&portalId=22562447&hsLang=en)   ## FAQs ### Q1: What does a Microsoft 365 and endpoint review check for? The review looks for suspicious sign-ins, risky mailbox rules and forwarding, misconfigured conditional access and MFA policies, and endpoint activity that could indicate a compromise already in progress — before it becomes a full incident. ### Q2: How is this different from a general cybersecurity risk assessment? A risk assessment looks broadly across your organization's people, process, and technology; the M365/Endpoint review is a focused, technical audit of your specific Microsoft 365 tenant and endpoint configuration and activity. ### Q3: Do we need this if we already have an MSP managing our M365 environment? Yes — an MSP typically manages day-to-day M365 administration, while this review is an independent, security-focused audit of that environment, which can surface gaps or misconfigurations that day-to-day management doesn't always catch. ### Q4: How long does an M365/endpoint review take? Most reviews can be completed within a few weeks, depending on tenant size and the number of endpoints in scope, since the process relies on log and configuration review rather than lengthy interviews. ### Q5: Is this review relevant to HIPAA compliance? Yes — for healthcare organizations, this review can directly support HIPAA Security Rule requirements, since M365 email and endpoints are common places where protected health information is created, stored, or transmitted. ### Q6: What kind of threats does this review typically uncover? Common findings include unauthorized inbox forwarding rules, legacy authentication protocols left enabled, missing or misconfigured MFA, unusual sign-in locations, and endpoint devices without current security baselines applied. ### Q7: Do you need administrative access to our tenant to perform this review? Yes, BorderHawk requires appropriate administrative access to your Microsoft 365 tenant to review configurations, sign-in logs, and security settings directly. ### Q8: What do we receive at the end of the review? You receive a findings report identifying specific threats, misconfigurations, or suspicious activity discovered during the review, along with prioritized remediation recommendations. ### Q9: Can this review be repeated on a recurring basis? Many organizations either use this review continuously to identify problems as they happen, or schedule the review periodically (quarterly or semi-annually) as an ongoing check, since new threats, forwarding rules, and configuration drift can appear between larger risk assessment cycles. ### Q10: Is this review only for organizations using Microsoft 365, or does it cover other cloud platforms too? The review is specifically built around Microsoft 365 and connected endpoints, we do not currently support alternatives such as Google. ##### Who We Are Who We Are - [Home](https://www.borderhawk.com) - [About Us](https://www.borderhawk.com/about-us) - [Contact Us](https://www.borderhawk.com/contact-us) ##### What We Do What We Do - [Consulting](https://www.borderhawk.com/cybersecurity-consulting) - [Assessments](https://www.borderhawk.com/risk-assessments) - [Program Development](https://www.borderhawk.com/overwatch-framework) - [M365 Review](https://www.borderhawk.com/microsoft-cloud-and-endpoint-review) ##### Why Do We Do It Why Do We Do It - [BEAD/E-ACAM](https://www.borderhawk.com/bead-and-e-acam-consulting) - [CMMC](https://www.borderhawk.com/cmmc-consulting) - [HIPAA](https://www.borderhawk.com/hipaa-consulting) - [SOC](https://www.borderhawk.com/soc-2-consulting) - [PCI-DSS](https://www.borderhawk.com/pci-dss-consulting) [![BorderHawk Logo in White.](https://www.borderhawk.com/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png)](https://www.borderhawk.com?hsLang=en) - [Privacy Policy](https://www.borderhawk.com/privacy-policy) - [Community Terms of Use](https://www.borderhawk.com/community-terms-of-use) © 2026 BorderHawk, LLC ```json { "@context" : "https://schema.org", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "US", "addressLocality" : "Cartersville", "addressRegion" : "GA" }, "areaServed" : "US", "description" : "BorderHawk delivers tailored cybersecurity compliance, risk assessments, and Overwatch consulting for critical infrastructure, defense, healthcare, and enterprise sectors.", "logo" : "https://www.borderhawk.com/hubfs/BorderHawk%20Logos%20and%20Images/BorderHawk%20Logo%20in%20White..png", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Developing a cybersecurity program requires more than the technology used to manage the business. Focused on the management of cybersecurity, ensuring leadership has an accurate picture of IT and OT operations.", "name" : "Management Consulting | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Management Consulting", "url" : "https://www.borderhawk.com/cybersecurity-consulting" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Evaluate your organization's current controls and risk posture, whether for the organization or specific assets, through analysis of technology, documentation, processes, and conversations with personnel.", "name" : "Security Assessments | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Security Assessments", "url" : "https://www.borderhawk.com/risk-assessments" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "Tabletop exercises with leadership and operations, Risk Assessment Workshops that teach personnel to conduct risk assessments, and incident-response training built into the broader consulting engagement.", "name" : "Cybersecurity Training | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Cybersecurity Training", "url" : "https://www.borderhawk.com/cybersecurity-consulting" } ``` ```json { "@context" : "https://schema.org", "@type" : "Service", "areaServed" : "US", "audience" : { "@type" : "Audience", "audienceType" : "Critical infrastructure organizations (Communications, Defense Industrial Base, Healthcare, Oil & Gas, Transportation, Manufacturing, Local Government, Data Centers, Law Practices)" }, "description" : "BorderHawk's industry-leading cybersecurity compliance framework and premier consulting package — takes an organization from its current state to an audit-defensible position, and helps maintain audit readiness through changes in requirements and the business itself.", "name" : "Overwatch | BorderHawk, LLC", "provider" : { "@type" : "Organization", "name" : "BorderHawk, LLC", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "telephone" : "+1-470-945-1979", "url" : "https://www.borderhawk.com/" }, "serviceType" : "Overwatch", "url" : "https://www.borderhawk.com/overwatch-framework" } ``` ```json { "@context" : "https://schema.org", "@type" : "Person", "description" : "CEO and Managing Director of BorderHawk, LLC with 25+ years of experience developing strategic business and technology solutions. Focused on Information Risk Management & Cybersecurity programs for critical infrastructure, including DoD vendors (CMMC), healthcare (HIPAA), and state and local governments (ISO 27001 / NIST).", "jobTitle" : "CEO and Managing Director", "knowsAbout" : [ "CMMC", "NIST 800-171", "HIPAA", "ISO 27001", "NIST Cybersecurity Framework", "Cybersecurity Compliance" ], "name" : "Jay Harmon", "sameAs" : [ "https://www.linkedin.com/company/borderhawk-llc" ], "url" : "https://www.borderhawk.com/about-us", "worksFor" : { "@type" : "Organization", "foundingDate" : "2008", "name" : "BorderHawk, LLC", "url" : "https://www.borderhawk.com/" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The review looks for suspicious sign-ins, risky mailbox rules and forwarding, misconfigured conditional access and MFA policies, and endpoint activity that could indicate a compromise already in progress — before it becomes a full incident." }, "name" : "What does a Microsoft 365 and endpoint review check for?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "A risk assessment looks broadly across your organization's people, process, and technology; the M365/Endpoint review is a focused, technical audit of your specific Microsoft 365 tenant and endpoint configuration and activity." }, "name" : "How is this different from a general cybersecurity risk assessment?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes — an MSP typically manages day-to-day M365 administration, while this review is an independent, security-focused audit of that environment, which can surface gaps or misconfigurations that day-to-day management doesn't always catch." }, "name" : "Do we need this if we already have an MSP managing our M365 environment?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Most reviews can be completed within a few weeks, depending on tenant size and the number of endpoints in scope, since the process relies on log and configuration review rather than lengthy interviews." }, "name" : "How long does an M365/endpoint review take?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes — for healthcare organizations, this review can directly support HIPAA Security Rule requirements, since M365 email and endpoints are common places where protected health information is created, stored, or transmitted." }, "name" : "Is this review relevant to HIPAA compliance?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Common findings include unauthorized inbox forwarding rules, legacy authentication protocols left enabled, missing or misconfigured MFA, unusual sign-in locations, and endpoint devices without current security baselines applied." }, "name" : "What kind of threats does this review typically uncover?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, BorderHawk requires appropriate administrative access to your Microsoft 365 tenant to review configurations, sign-in logs, and security settings directly." }, "name" : "Do you need administrative access to our tenant to perform this review?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "You receive a findings report identifying specific threats, misconfigurations, or suspicious activity discovered during the review, along with prioritized remediation recommendations." }, "name" : "What do we receive at the end of the review?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Many organizations either use this review continuously to identify problems as they happen, or schedule the review periodically (quarterly or semi-annually) as an ongoing check, since new threats, forwarding rules, and configuration drift can appear between larger risk assessment cycles." }, "name" : "Can this review be repeated on a recurring basis?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The review is specifically built around Microsoft 365 and connected endpoints, we do not currently support alternatives such as Google." }, "name" : "Is this review only for organizations using Microsoft 365, or does it cover other cloud platforms too?" } ] } ```