A senior administrator goes through your Microsoft 365 setup (Microsoft calls it your tenant), writes down how it is really set up, and ranks what needs fixing first. We agree the scope and price before anyone signs in. TechTruePoint runs these reviews remotely for businesses in DFW and nationwide that have no Microsoft 365 expert on staff. Request a quote to book yours.
One fixed price, agreed in writing before any access.
The review answers one question: how your Microsoft 365 is really set up right now. Not what was intended when it was set up, and not what the last person to touch it says is there. What Microsoft 365 shows today.
It exists because the same conversation keeps happening. A business of ten to seventy-five people runs on Microsoft 365. Nobody in the building is a senior Microsoft 365 administrator. And the honest answer to "who has admin rights" is that nobody is sure. That is not carelessness. It is what happens when the setup is five years old and everyone has been busy.
The same twelve areas every time, so the report can be compared against itself when you run it again in a year.
A written report you can hand to somebody else, not a slide deck and not a portal login.
Every finding is classified critical, high, medium or informational, with the reasoning attached. Critical means it should be dealt with this week. Informational means it is worth knowing and does not need a decision.
The short list of things that should change now, separated out so they do not get lost behind the longer term work. If anything urgent appears while the review is still running, you hear about it then rather than at the end.
The rest of the work in a sensible order, showing what has to happen first. Some of it is an hour. Some of it needs a conversation with your team about how people actually work before it can be safely changed.
We go through the report together. This is where the "why is that a problem" questions get answered, and where you tell us which of the recommendations do not fit how the business runs.
Optional and priced separately after the review, because pricing the fixes before seeing your setup is guesswork.
What prompted the question, roughly how many people use Microsoft 365, and whether anything specific has already gone wrong. Fifteen minutes is usually enough.
You know what is included and what it costs before anyone signs in to anything.
You create the account, you control it, and you can remove it when the review is delivered.
The twelve areas above, working through your Microsoft 365 and writing down what is there. Anything urgent is reported the day it is found.
The written report, then a conversation about it. You keep the report either way.
Fix it yourself, hand it to your existing IT people, or ask us for a remediation proposal. All three are normal.
If you decide to act on the findings, the same people who wrote them do the work:
This is a sample, not a customer. No business is described here, and nothing on this page is drawn from a real engagement. It is here so you can see the shape of the report before you commit to anything.
Each one names the setting, what it is now, why it matters, and what we would change. For example: Critical. Two accounts hold global administrator and have not signed in for over a year. Both belong to people no longer with the business. Recommendation: block sign-in, revoke sessions, reassign anything owned by those accounts, then remove the roles.
Critical: a former employee who can still sign in, an administrator without MFA, mail forwarding to an outside address that nobody set up deliberately.
High: MFA enforced for most people but excluded for several, anonymous sharing links that never expire, unmanaged laptops holding company data.
Medium: licenses assigned to people who left, a shared mailbox that is really one person's account, application consent nobody remembers granting.
Informational: retention set to the default nobody chose, no written record of who holds what.
Week one: block the two dormant admin accounts and revoke their sessions. Remove the external forwarding rule. Enforce MFA on every administrative account.
Week two: close the MFA exclusions one team at a time, starting with anyone who touches money. Review sharing links older than a year.
Then: release licenses in the safe order, enroll the unmanaged laptops, and write the setup down.
Your report will not look like this one, because your setup is not this one. The structure is what stays the same.
Most findings turn into one of four jobs. Fixing what was found. Taking back control of the account, when ownership turned out to be the real problem. Setting up Intune and Autopilot, when laptops are unmanaged. Or a license audit, done properly so the savings show up on your bill.
If an insurance form prompted the review, the controls insurers ask about covers the answers those forms want. Most of them come down to who owns your admin account.
Agencies, repair shops, phone providers and consultants refer this work in when a customer's tenant is outside what they do. The customer relationship stays with them. How that works is on the partners page.
Read-only access to your Microsoft 365 is enough for most of it. Usually that is a read-only admin role (Global Reader), or a full admin account if some reports need it, plus a short conversation about who works there and what each shared mailbox is for.
The scope and the price are agreed before any access is granted, and the account you create for us can be removed the day the review is delivered. If you would rather we work in a screen share while you hold the keyboard, that also works and takes longer.
The technical work is usually a few days once access is in place. What sets the calendar is the conversation at the end: the findings are worth going through together rather than emailing over and hoping the important parts get read.
If something genuinely urgent turns up on the first day, such as a former employee who can still sign in, you hear about it that day rather than in the report.
No. The findings are yours, written plainly enough that another administrator can act on them. Some businesses hand the report to whoever already looks after their IT, and that is a reasonable outcome.
If you would rather we did the work, the fixes are quoted separately once you have seen what is actually there, which is the only honest moment to price it.
Neither. It is a review of how your Microsoft 365 is set up: who has access, how sign-in is protected, where mail is going, what devices are managed, and what you are paying for.
A penetration test attacks a system to find exploitable weaknesses. A compliance audit measures you against a named standard and is signed by an assessor. If either of those is what you need, you need a different firm, and we will say so rather than sell you this instead.
Sometimes there is not, and that is a fine result to pay for once. The reviews that find least are the ones where somebody senior has been paying attention, and the report then says so in writing, which is useful when an insurer or a customer asks.
The reviews that find most are the ones where Microsoft 365 was set up years ago by somebody who has since left, and nobody has opened the admin center since. If that sounds like yours, the licensing findings alone often cover the cost.
Licenses, accounts, security settings and the day to day of running a tenant.
Review one concern in 15 minutes and leave with up to three prioritized next steps.
The five checks to run before removing a license, and why the order matters.
Tell us roughly how many people use Microsoft 365 and what prompted the question. We will confirm the scope and the price in writing before asking for any access.