Free Microsoft 365 security assessment · No signup required
Microsoft 365 security assessment
Answer 15 plain-language questions about sign-in security, email protection, sharing, devices, backup, and response. Get a Wolferdawg diagnostic score, grade, category breakdown, and prioritized action plan in about three minutes.
Free Microsoft 365 security self-assessment
This tool scores the answers you provide across five Microsoft 365 security areas. It does not connect to your tenant or require administrator access. You see the result on the page without creating an account.
- 15 plain-language questions
- About three minutes
- No signup to see results
- Answers scored in your browser
Question loads here
YOUR SCORE
B
73 out of 100
Summary loads here.
Your score by category
Get the full report by email
If you request the report, your name, email address, company, and complete assessment results are submitted to Wolferdawg IT Consulting so the report can be sent. This includes every answer, category score, finding, grade, and overall score. Wolferdawg IT Consulting may retain this information for direct follow-up about your results and related services.
Want help verifying the findings?
Wolferdawg IT Consulting can review the answers in your tenant, identify licensing or configuration issues, and help you turn the result into a practical improvement plan.
Book a free 30-minute reviewThis is a self-reported diagnostic based on selected Microsoft 365 safeguards. It is not a tenant scan, Microsoft Secure Score, vulnerability scan, penetration test, compliance audit, legal opinion, or proof of cyber insurance eligibility.
How the Microsoft 365 security score works
Each answer receives zero to three points. The tool calculates a percentage for each category and averages the five categories equally into a score from zero to 100. The score and grade describe this Wolferdawg diagnostic tool, not Microsoft Secure Score.
| Category | Weight | What it reviews |
|---|---|---|
| Identity and sign-in | 20% | Multifactor authentication, administrator access, and legacy authentication |
| Email protection | 20% | Email authentication, Safe Links and Safe Attachments, and external sender identification |
| Sharing and data | 20% | Sharing links, data loss prevention, and audit-log retention |
| Devices and endpoints | 20% | Device management, monitored endpoint protection, and response to lost devices |
| Recovery and visibility | 20% | Backup and restore, alert review, and incident response planning |
Letter grades
| Score | Grade | Interpretation |
|---|---|---|
| 90 to 100 | A | Most selected safeguards were reported as present. |
| 80 to 89 | B | Several improvements remain. |
| 70 to 79 | C | Material gaps or uncertainties need attention. |
| 60 to 69 | D | Many selected safeguards are missing or uncertain. |
| Below 60 | F | The reported environment needs a prioritized verification and improvement plan. |
Critical-control rule: A missing or uncertain answer for multifactor authentication, email authentication, monitored endpoint protection, or backup and recovery is marked critical. One critical finding caps the grade at C. Two or more critical findings cap it at F.
Privacy and limitations
Your answers are scored in your browser. When the results appear, the usage record includes the request time, IP address and approximate location, grade, score, and critical and warning counts. The usage record does not include your individual answers.
If you request an emailed report, the name, email address, and company you provide are submitted with the complete results, including every answer, category score, finding, grade, and overall score. By requesting the report, you agree that Wolferdawg IT Consulting may retain your contact information and assessment results and contact you directly about your results and related services. You will not be added to a newsletter or bulk marketing list.
This self-check does not connect to Microsoft 365 or verify the answers. It reviews selected settings and operating practices, not every Microsoft or CIS recommendation. For deeper planning, review Microsoft's guidance for Microsoft Secure Score, audit-log retention, Microsoft 365 Backup, and the CIS Microsoft 365 Benchmark.
Reviewed by Dieter Wolf
Founder of Wolferdawg IT Consulting, with more than 27 years of IT experience. Last reviewed August 25, 2026.
What to do after you receive the result
- Verify every critical finding. A not sure answer means the setting needs to be checked in the tenant.
- Confirm licensing. Some controls require Microsoft 365 Business Premium or another eligible subscription or add-on.
- Assign an owner and date. Turn each confirmed gap into a specific configuration or process task.
- Retake the assessment. Use the same answers after changes to document progress within this tool.
More free security tools
Frequently asked questions
Plain answers about what the assessment covers, how the score works, and what happens to the information you provide.
What does the Microsoft 365 security self-check cover?
The self-check reviews 15 reported settings and practices across five areas: identity and sign-in, email protection, sharing and data, devices and endpoints, and recovery and visibility. It is a self-assessment, not a scan of your Microsoft 365 tenant.
How is the Microsoft 365 security score calculated?
Each answer receives zero to three points. The tool calculates a percentage for each of the five areas and averages those equally into a score from zero to 100. The letter grade is A at 90 or higher, B at 80 to 89, C at 70 to 79, D at 60 to 69, and F below 60. One critical gap caps the grade at C, and two or more critical gaps cap it at F.
What does my Microsoft 365 security grade mean?
The grade shows how many of this tool's selected safeguards you reported as present. It is a Wolferdawg diagnostic result, not Microsoft Secure Score, a certification, a tenant audit, or a prediction that an incident will or will not occur. A not sure answer is treated as something to verify.
How is this self-check different from Microsoft Secure Score?
Microsoft Secure Score uses data in Microsoft Defender to measure progress against Microsoft security recommendations. This Wolferdawg self-check does not connect to your tenant or require administrator access. It scores the answers you provide and also asks about practices such as backup, alert review, and incident response. The two scores should not be compared as if they use the same formula.
What information does the Microsoft 365 self-check record?
Your answers are scored in your browser. When results appear, the usage record includes the request time, IP address and approximate location, grade, score, and critical and warning counts. It does not include your individual answers. If you request an emailed report, the name, email address, and company you provide are submitted with the complete results, including every answer and finding. By requesting the emailed report, you agree that Wolferdawg IT Consulting may retain your contact information and assessment results and contact you directly about your results and related services. You will not be added to a newsletter or bulk marketing list.
Can a nontechnical business owner take this self-check?
Yes. The questions are written for business owners and managers. If you do not know an answer, select I am not sure. The result treats that uncertainty as something to verify instead of assuming the safeguard is operating.
Will the self-check work with every Microsoft 365 business plan?
You can take the self-check with any Microsoft 365 business plan, but available controls vary by subscription and add-on licensing. Features such as Conditional Access, Intune, Defender for Business, Safe Links, and Safe Attachments are included with Microsoft 365 Business Premium. Confirm current licensing before planning a change.
What should I address first after the self-check?
Start with findings marked critical. Verify the answer in the Microsoft 365 tenant, assign an owner, and plan the change. Common priorities include multifactor authentication, email authentication, monitored endpoint protection, and a tested backup and recovery process. The correct order depends on your licensing, systems, and business operations.
Review your Microsoft 365 security priorities
Wolferdawg IT Consulting helps small businesses in Southwest Oklahoma and remote clients nationwide verify Microsoft 365 settings, understand licensing choices, and build a practical improvement plan. Founder Dieter Wolf brings more than 27 years of IT experience.
Book a free 30-minute reviewOr call (580) 956-8424 or email hello@wolferdawg.io.