Everything we check in your Microsoft 365.
Our free check looks at your email domain's public records in seconds. The Aster Cloud scan goes much further: your admin signs in once, read only, and we check the settings behind most Microsoft 365 break ins. What no scan can read, we check by hand. Here is all of it, in plain English. The list grows as we add new checks.
- 32
- individual checks
- 9
- must haves in our minimum standard
- 1 min
- for the scan, read only
Email domain protection
The public records that stop people sending email pretending to be you. Anyone can run this part free, no sign in needed.
-
SPF
The list of servers allowed to send email for your domain, checked for mistakes and the lookup limit that quietly breaks it.
Free domain check and Aster Cloud -
DKIM
Whether Microsoft 365 is signing your email, so receivers can tell it really came from you.
Free domain check and Aster Cloud -
DMARC
The policy telling the world what to do with fakes, and whether it actually blocks them or only reports.
Free domain check and Aster Cloud -
MTA-STS
Makes sure email to you is always encrypted on the way in.
Free domain check and Aster Cloud -
DNSSEC
Protects your domain records from being tampered with.
Free domain check and Aster Cloud -
Email domain in your security score
The scan runs the domain check on your main domain and counts it in your overall score.
Aster Cloud scan
Signing in
Stolen and guessed passwords are behind most Microsoft 365 break ins. These checks make sure a password alone is never enough.
-
Multi factor sign in enforced
Security defaults or a Conditional Access policy making everyone use a second step, not just admins, and not stuck in report only mode.
Aster Cloud scan -
Old style sign ins blocked
POP, IMAP, SMTP and older Outlook versions skip multi factor sign in completely. We check they're blocked.
Aster Cloud scan -
Old style sign ins actually used
Every sign in through those old doors in the last 30 days, successful or failed, so we know what still relies on them and who is trying passwords.
Needs Business Premium. Without it, the report says so rather than guessing. Aster Cloud scan -
Who has set up multi factor
Every member of staff counted, with admins who haven't set it up flagged first.
Aster Cloud scan -
Strength of the second step
Text message and phone call codes can be intercepted. We spot anyone relying on them instead of the Authenticator app or a passkey.
Aster Cloud scan -
Self service password reset
Whether people can safely reset their own password, so "IT, I'm locked out" calls can't be faked by scammers.
Aster Cloud scan -
Password protection and lockout
Banned password words like your business name, and how many wrong tries lock an account.
Aster Cloud scan
Admin accounts
An admin account can do anything, so attackers go for them first.
-
Global Administrators
Two to four is right: enough never to be locked out, few enough to protect properly.
Aster Cloud scan -
Every admin role
Exchange, SharePoint, User and Security admins too, and admin rights sitting on everyday accounts that read email and browse the web.
Aster Cloud scan -
Emergency access account
A break glass account kept out of Conditional Access, so a broken policy can't lock you out of your own Microsoft 365.
Aster Cloud scan
Apps and guests
Who and what outside the business can get at your email, files and directory.
-
Who can let apps in
Whether any member of staff can approve an app reading their email and files. That's how consent phishing works.
Aster Cloud scan -
Outside apps with access
Every app already given access to mail, files or the directory, with unverified publishers flagged.
Aster Cloud scan -
App registration and new tenants
Whether ordinary staff can create apps or whole new tenants under your name.
Aster Cloud scan -
Guest access
How many guests you have, who can invite more, and whether guests can browse your whole directory.
Aster Cloud scan
Accounts, devices and sharing
Forgotten accounts, risky sign ins, unmanaged laptops and files shared too widely.
-
Unused accounts
Enabled accounts nobody has signed in to for 90 days, and any still costing you a licence.
Needs Business Premium. Without it, the report says so rather than guessing. Aster Cloud scan -
Accounts Microsoft flags as risky
Leaked passwords, impossible journeys and other signs an account may already be compromised.
Needs Microsoft 365 E5 or Entra ID P2. Without it, the report says so rather than guessing. Aster Cloud scan -
Managed laptops and phones
Whether devices are managed, compliant and encrypted, so a lost laptop can be locked or wiped.
Needs Intune, included in Business Premium. Without it, the report says so rather than guessing. Aster Cloud scan -
Sharing outside the business
Whether files can be shared with "anyone with the link", which gets forwarded and never expires.
Aster Cloud scan
Email settings we check by hand
These live inside Exchange, where no scan can read them. We check them ourselves, and the sign in logs show whether anyone is using or attacking them.
-
POP and IMAP switched off
Old ways of collecting email that attackers use to try passwords. Should be off on every mailbox unless someone needs them.
Checked by Aster IT -
SMTP sign in switched off
Lets anything with a password send email as that person. Should be off, with scanners moved to a relay.
Checked by Aster IT -
Other old mail protocols unused
ActiveSync from old phones, EWS, MAPI and Outlook Anywhere using just a password.
Checked by Aster IT -
Automatic forwarding to outside addresses blocked
The first thing an attacker sets up in a mailbox. Should be blocked, with existing inbox rules checked.
Checked by Aster IT -
Mailbox and audit logging on
A record of who opened, sent and deleted what, which you need if anything goes wrong.
Checked by Aster IT -
Email threat protection policies applied
Microsoft's recommended anti phishing, anti spam and anti malware settings, kept up to date.
Checked by Aster IT
The Aster IT minimum standard
Nine must haves every Microsoft 365 we look after meets. Your report shows how many you have, like "7 of 9".
-
Multi factor sign in enforced for everyone
Turn on security defaults, or with Business Premium a Conditional Access policy requiring multi factor sign in for all users.
Aster Cloud scan -
Old style sign ins (POP, IMAP, SMTP) blocked
Block legacy authentication with security defaults or a Conditional Access policy, after moving any scanners to a relay.
Aster Cloud scan -
Every admin uses a strong second sign in step
Every admin sets up the Microsoft Authenticator app, a passkey or a security key. Text message alone isn't enough for admins.
Aster Cloud scan -
Two to four Global Administrators
Keep two to four Global Administrators and give everyone else the smallest admin role that does the job.
Aster Cloud scan -
Staff can't let apps into company data
Enterprise applications, Consent and permissions: allow user consent only for verified publishers with low risk permissions, or not at all.
Aster Cloud scan -
Guests can't browse the directory
External collaboration settings: set guest user access to limited or most restrictive.
Aster Cloud scan -
No "anyone with the link" file sharing
SharePoint admin centre, Policies, Sharing: choose "New and existing guests" so people outside sign in to open what you share.
Aster Cloud scan -
Self service password reset switched on
Entra, Password reset, Properties: switch it on for all users, requiring two methods.
Aster Cloud scan -
Email domain has SPF, DKIM and DMARC (quarantine or reject)
Publish SPF, switch on DKIM signing in Microsoft Defender, and set DMARC to p=quarantine or p=reject once reports look clean.
Aster Cloud scan
Reports and tracking
What you get from Aster Cloud, and how you see it improve.
-
Microsoft Secure Score
Microsoft's own measure, plus its top recommended actions ranked by the points still on the table.
Aster Cloud scan -
Score, grade and plain English fixes
One score out of 100 and a grade, with what each finding means and exactly how to fix it.
Aster Cloud scan -
Recommendations in order
What to tackle first: the minimum standard, then anything the logs show being attacked, then the rest.
Aster Cloud scan -
Before Aster IT and now
Every check side by side with the scan from before we started, so you can see what changed.
Aster Cloud scan -
Score over time
Every scan kept in Aster Cloud, with a chart of your score and Secure Score moving.
Aster Cloud scan -
PDF report
A branded report to download, print or send to your board or insurer.
Aster Cloud scan -
Read only, no standing access
You sign in on Microsoft's own page and we use that access once, during the scan. We never see email, files, chats or passwords.
Aster Cloud scan
See how your Microsoft 365 does
Check your email domain free in seconds, no sign up needed. For the full scan, the minimum standard and the before and after report, we'll set you up on Aster Cloud and run the first scan with you.
The scan is read only. Your admin signs in on Microsoft's own page, we read security settings once during the scan, and we keep no access afterwards. We never see email, files, chats or passwords. Some checks need particular Microsoft licences; when one isn't there, the report says we couldn't check rather than guessing.