Six surfaces, one scan.
From the board-level readiness score down to the individual script that fixes a single misconfigured site — every screen, and what it tells you.
Six screens, worst-first by design
The order SafeScan produces them in: score, checks, findings, fix, proof.
The whole posture on one screen
A Copilot Readiness Score out of 100 with a per-domain breakdown, tiles for items at risk and critical findings, a severity donut, and a service-by-service summary across SharePoint, Entra ID, Purview, Teams and Microsoft 365.
- Readiness score, scored per domain
- Items at risk, critical, high and medium counts
- Members, guests and app registrations inventoried
Twenty-three checks, six domains, one verdict each
Exposure, Identity, Compliance, Teams, Licensing and Copilot — every check returns pass, warning or fail with a score and a one-line explanation, so nothing needs interpreting.
- Pass / warning / fail with a numeric score
- Domain-level scores roll up to the total
- Expand any check to see what it found
Every exposed item, worst first
The exact SharePoint path, who can reach it and how — internal, anonymous, external or broken inheritance — plus any sensitive-data matches, a recommended action and a status you can mark resolved.
- Critical to low severity with risk scores
- Audience type per item, including broken inheritance
- Financial, legal and HR sensitivity flags
The admin-centre path, written out
Each failing check comes with numbered steps through the relevant Microsoft admin centre and a link to the official documentation — so the fix is verifiable, not folklore.
- Numbered steps per failing check
- Microsoft documentation linked throughout
- Covers SharePoint, Entra ID, Purview, Teams and M365
Generated for your tenant, ready to run
A commented PowerShell script per failing check, written against your own environment. Copy it, review it, run it in your admin terminal, then rescan to prove the finding is closed.
- PowerShell 5.1 and 7+ compatible
- Commented, with output logging for audit
- Rescan to confirm the fix actually landed
The accounts and apps nobody is watching
Every user with MFA status, department and last sign-in, and every app registration with its secret expiry, permission count and risk flags — the governance gaps that never show up in a file-sharing report.
- Filter by needs attention, disabled or guest
- App secrets with nearest expiry date
- Permission counts and risk flags per registration
Twenty-three checks, six domains
Grouped the way an administrator actually thinks about a tenant — and each domain scored so you can see which one is dragging the total down.
Exposure
SharePoint and OneDrive oversharing, anonymous links, external sharing and sites whose permission inheritance has been broken.
Identity
MFA coverage, dormant and stale admin accounts, guest access and gaps in Conditional Access.
Compliance
DLP policy coverage, audit logging, sensitivity label usage and retention configuration.
Teams
External access settings, anonymous meeting joins, app governance and team sprawl.
Licensing
Unused licences, inactive users and SKU assignments worth revisiting before renewal.
Copilot readiness
The composite score, the oversharing Copilot would inherit, and the governance posture behind it.
Everything else in the workspace
The parts that turn a scan into something you can hand over, act on and repeat.
PDF & Excel exports
Hand the findings to a CISO, an auditor or a client without giving them a licence and a login. PowerPoint export is on the Enterprise and MSP plans.
Multi-tenant management
One dashboard across every client tenant, with each estate’s readiness score side by side — built for MSPs and groups running several tenants.
Rescan and compare
Re-run after remediation to prove the score moved, and keep a record of posture over time that a board will accept as evidence.
Generated PowerShell
A commented script per failing check, written against your own environment, PowerShell 5.1 and 7+ compatible, logging its output for audit.
User inventory
Every user with MFA status, department and last sign-in, filterable by needs-attention, disabled or guest.
App registration review
Every app registration with its secret expiry, permission count and risk flags — the governance gap a file-sharing report never shows.
The half a scanner cannot do
Copilot SafeScan
The technical assessment, automated: what is exposed, how badly, and the exact change that closes it. Repeatable, scored, and finished in minutes.
- 23 checks across six domains
- Ranked findings with severity and risk score
- Admin-centre steps and generated PowerShell
- Rescan to prove the fix landed
AI governance & readiness service
The parts software cannot do: agreeing remediation with data owners, choosing persona use cases, training people and phasing the roll-out so Copilot lands well.
- Remediation agreed with the data owners
- Persona use cases and adoption plan
- Sensitivity labels, DLP and retention design
- Agent lifecycle and approval model
Run the 23 checks on your own tenant.
The free tier runs a real scan on a real tenant — no card, no agents, nothing written. You will have your readiness score in under five minutes.
More on Copilot SafeScan
Every page of the SafeScan sub-site, and the way back to the rest of LogiSam.