Establish applicability
Confirm licenses, enabled services, tenant relationships, business requirements, known exceptions, and assessment boundaries.
Transparent methodology
A repeatable control review with human judgment where it matters.
TenantShield combines a structured Microsoft 365 control library, collected evidence, analyst validation, and business context to produce priorities—not just check results.
Five stages
From environment context to owned action.
Evaluate controls
Collect and review the configuration and operational evidence available for each applicable control.
Resolve context
Check material observations against compensating controls, dependencies, stakeholder intent, and evidence quality.
Rank real work
Consider likely impact, exposure, exploitability, breadth, business dependency, change risk, and effort.
Build the action register
Connect each priority to evidence, an accountable owner, recommended action, dependency, and validation step.
Control domains
Coverage follows the Microsoft 365 services in use.
The library contains more than 400 controls, but a larger raw count is not the objective. Applicability and evidence quality are recorded so excluded controls do not distort the result.
Identity
Microsoft Entra authentication, Conditional Access, privileged roles, guest users, and user and sign-in risk.
Messaging
Exchange Online, built-in security features for cloud mailboxes, Microsoft Defender for Office 365 where licensed, mail flow, auditing, forwarding, and email authentication.
Collaboration
Microsoft Teams, SharePoint Online, OneDrive, sharing, guest users, and governance settings.
Applications
Consent, permissions, enterprise applications, and service principals.
Devices
Microsoft Intune device management, configuration, and compliance signals where applicable.
Data protection
Relevant Microsoft Purview retention, sensitivity labeling, and data loss prevention controls where licensed.
Audit & detection
Microsoft Defender XDR alerts where licensed, audit availability, logging, and investigation readiness.
Operations
Ownership, exception handling, access lifecycle, change control, and evidence of review.
Executable evidence
Where Maester fits in the methodology.
Maester can turn Microsoft security guidance and customer policy into repeatable PowerShell/Pester tests using Microsoft Graph and supported service modules. TenantShield can use that output alongside direct configuration review, operational records, stakeholder evidence, and other approved sources.
Approve access and suites
Confirm the services, permissions, identities, test packages, execution location, output handling, and exclusions before connection.
Capture reproducible results
Record the Maester and test versions, selected suites, timestamps, skipped tests, errors, and exported evidence needed for repeatability.
Validate against context
Check applicability, licensing, configuration state, policy intent, exceptions, compensating controls, duplicates, and evidence confidence.
Publish supported findings
Use analyst judgment to determine severity, business impact, recommendation, ownership, sequence, and validation—not the raw test status alone.
Read Maester's installation and execution documentation or inspect the MIT-licensed source repository.
Tool boundary: Maester is one possible evidence source. The engagement scope—not the tool's total test count—defines coverage, and a raw Maester report is not represented as an independent TenantShield assessment.
Risk rating
Severity is not based on a failed setting alone.
A recommendation is prioritized using the evidence available at the time of review and the organization’s context.
| Factor | Question |
|---|---|
| Impact | What could happen to identities, data, operations, customers, or regulatory obligations? |
| Exposure | How broadly is the condition exposed, and which users, administrators, data, or workloads are affected? |
| Likelihood | How plausible is misuse or failure given current controls and common attack paths? |
| Compensation | Do other technical or operational controls materially reduce the risk? |
| Change risk | What user impact, dependency, or service disruption could remediation create? |
| Evidence confidence | Is the conclusion supported directly, partially, or dependent on stakeholder confirmation? |
Microsoft-aligned language
Product names follow current Microsoft documentation.
TenantShield uses Microsoft’s current names for the services and signals being evaluated. Microsoft Secure Score is referenced as a Microsoft posture measurement; it is not relabeled as a TenantShield grade.
What it is
A configuration and control assessment.
- Point-in-time evidence review
- Structured control coverage
- Analyst validation
- Contextual prioritization
- Decision and action support
What it is not
Clear limits matter.
- Not a penetration test
- Not continuous threat monitoring
- Not a legal opinion
- Not a compliance certification
- Not a guarantee against compromise
See the methodology in a practical deliverable.
The sample report shows how evidence, context, priority, and action are connected.