MICROSOFT 365 SECURITY & Copilot Readiness · UNDER 60 MINUTES
Copilot Safe Scan connects to Microsoft Graph with read-only access and inspects six layers of your tenant — data exposure, identity, compliance, Teams, licensing and Copilot readiness — in a single pass. No agents to install, nothing changed in your environment, and not a single byte kept once your session ends.
Full-tenant scan
Scan domains
Security checks
Bytes stored
Safe Scan signs in through Microsoft Graph using read-only delegated permissions and never writes back to your tenant. Every scan is ephemeral — the insights are yours, and we keep nothing once the session ends. Your security team can review every permission requested before they approve a thing.
Every layer of your Microsoft 365 posture — scored, explained in plain English, and prioritised so you know exactly what to fix first.
Every scan is stored with a risk score out of 100, the number of items examined and a severity breakdown — so you can benchmark before a remediation project and prove the improvement after.
Risk score /100
Full history
Status badges
The checkpoints view shows every check across all six domains at once. Each is scored out of 100 with a clear Passed, Warning or Failed badge and a one-line summary of what was found.
20+ checks
Filter by domain
Score & status
Open any check to see exactly what was found. A DLP score of 0/100 Failed, for example, means no Data Loss Prevention policies exist — and Safe Scan spells out the risk in plain English, no security background required.
What was found
Plain-English risk
Severity scored
The remediation tab turns each finding into action: numbered steps through the Microsoft admin centres, the exact settings to change and links to official Microsoft documentation so your team can verify every recommendation.
Numbered steps
Admin centre
Microsoft docs
No black box. Every checkpoint exposes the exact Microsoft Graph JSON used to calculate its score, so auditors and engineers can verify findings at the source or export them for deeper analysis.
JSON response
Fully auditable
Exportable
Each check ships with a ready-to-run, fully commented PowerShell script that queries the same Graph data. Reproduce a finding, schedule a recurring compliance check, or automate remediation at scale.
Ready-to-run
Schedule it
Docs included
Safe Scan runs all of these automatically — each one scored, explained and ready to act on.
No agents, no installs, no lengthy onboarding. Connect, scan, act.
Sign in through Microsoft Graph with read-only permissions. Your IT team can review every scope before granting access.
Choose the domains to scan — or run all six — and hit launch. Most tenants finish in under five minutes.
Work through a scored report with plain-English findings, admin-centre fix paths and PowerShell scripts. Re-scan anytime.
Connect in under a minute and surface every data exposure, identity risk and compliance gap — read-only, nothing installed, nothing stored.
Yes. Safe Scan uses read-only Microsoft Graph permissions and never writes, modifies or stores anything from your tenant. The scan runs within your session, permissions are granted temporarily, and you can revoke them instantly from Microsoft Entra ID.
Six areas: data exposure across SharePoint and OneDrive, identity and access risks such as missing MFA and stale admins, compliance gaps like DLP and sensitivity labels, Teams configuration, licensing waste, and overall Microsoft 365 Copilot readiness.
Under five minutes for most tenants. Very large organisations (10,000+ users) may take up to ten. Results stream in progressively, so you see findings as they appear.
A prioritised report with a risk score per domain, a plain-English explanation of every finding, step-by-step remediation guidance and ready-to-run PowerShell. Export it as needed or share it with your team.
No. Safe Scan requests specific read-only Microsoft Graph scopes, not full admin rights. Your security team can review the exact permission list before granting consent, and access can be revoked at any time from Microsoft Entra ID.
Both. Run it before deployment to fix oversharing and access risks first, or run it on an existing Copilot rollout to see what agents and users are already exposing.
No. It is a fast, automated posture check across six domains, built to surface the issues most relevant to Copilot exposure. It is a strong starting point, not a substitute for a full manual security assessment.
Yes. Every scan is stored with its own risk score, so you can benchmark before a remediation project and prove improvement afterwards.
Yes. Every finding comes with a plain-English explanation of the risk and step-by-step remediation guidance through the Microsoft admin centres, so no security background is required to act on results.
