mlab.sh mlab.sh
v1.30.1
Platform
Free Tools Redkit Ecosystem Pricing Blog Programs
Technical
CLI & Binaries Developer API Integrations MCP Integration Changelog Engineering
Learn
Cheat Sheets Comparisons Glossary
Support
Help Center Contact sales Partners
Terms · Privacy · Sales · DPA
Redkit
Code
Governance
tprm.mlab.sh
Third-party risk management
risk.mlab.sh
EBIOS Risk Manager platform
Detection
ir.mlab.sh
Self-hosted incident response
hunt.mlab.sh
Threat hunting with Sigma & YARA
News & Intel
news.mlab.sh
Curated cyber news & threat intel
Attack Surface
vuln.mlab.sh
CVE intelligence & tracking
actors.mlab.sh
Threat actor database, APTs, groups & TTPs
Training
academy.mlab.sh
Cybersecurity training & courses
kids.mlab.sh
Cyber education for kids
Open Source
postmortem
Supply-chain malware scanner
mcpwn
Security scanner for MCP servers
apex
Android & iOS app analysis
About
Contact
Sign up
Navigation
Terms Privacy About Contact
Redkit · Microsoft 365 tenant check · Free

How hardened is your Microsoft 365 tenant?

A read-only check of your Entra ID tenant against CIRSEC Baselines: consent, app credentials, MFA, privileged roles, guest access. Every failing control comes with what we saw and how to fix it. No account, no card.

35 controls · Baseline profile Read-only Microsoft Graph One free scan per tenant Report kept 7 days
19%
Contoso · Baseline
13 of 16 controls failing
HIGHUsers can consent to any application
HIGHApp passwords allowed on new applications
MEDIUMOnly 1 Global Administrator (2 to 4 expected)
LOWAny user can create security groups
Start · 1 of 4
The report goes to this address only. Before anything is scanned we check that it belongs to one of your tenant's verified domains, then you confirm it from your inbox.

A Global Administrator (or Privileged Role Administrator) of the tenant approves the read-only mlab-scan application on Microsoft's own page. See the privacy policy.

How it works
  1. 01Your work emailWhere the report goes. Nothing else to fill in.
  2. 02Admin consent on MicrosoftYour administrator approves read-only access, on Microsoft's page. That approval is the proof you may check the tenant.
  3. 03Confirm your emailWe check the address is on one of the tenant's domains and send you a link. Nothing runs before you click it.
  4. 04Scan and reportUsually under a minute. The report stays online for 7 days, then it is deleted.
What the check covers
9ApplicationsUser and risky-app consent, admin consent workflow, app passwords, secret and certificate lifetimes, agent blueprints.
15AuthenticationSecurity defaults, MFA for every member, per-user MFA, SMS and voice, Authenticator, Temporary Access Pass, banned passwords, lockout, legacy PowerShell.
7AdministrationCloud-only admins, no guest admins, Global Administrator count, licensed admins, PIM settings.
4Tenant settingsTenant and group creation, self-service sign-up, guest access level.

The 35 controls of the CIRSEC Baselines M365 Baseline profile that can be read through Microsoft Graph. A free account adds the Hardened profile, rescans, history and exports.

The access you approve

Read-only, and only what the controls need

Every permission below is a Microsoft Graph read permission. mlab-scan cannot change a setting, a user or a policy. These are the narrowest permissions Microsoft offers to read those settings; there is no other way to check them.

Policy.Read.AllAuthorization, consent, authentication methods and app management policies.
Directory.Read.AllOrganization, password rules, users, groups and licences of role holders.
Application.Read.AllPermission classifications used to judge user consent.
RoleManagement.Read.DirectoryWho holds which administrator role, and PIM settings.
UserAuthenticationMethod.Read.AllWhether each member has an MFA method registered (never the secrets).
AuditLog.Read.AllThe MFA registration report and role assignments made outside PIM.
SecurityEvents.Read.AllMicrosoft Secure Score, shown next to the CIRSEC results.
Questions
Why is it free?

A read of your tenant costs us very little, and it is the best way to show what Redkit does. If you want more (the Hardened profile, scans on a schedule, history, web and network audits), you create an account.

Who can run it?

Anyone can start, but only an administrator of the tenant can approve the read-only access on Microsoft's page, so a tenant can only be checked with its administrators' approval. The report goes to an address on one of the tenant's own domains.

What do you keep, and for how long?

The report is online for 7 days at a private link, then deleted. We keep the tenant identifier and the date, to allow one free check per tenant, and your email address, to send you the report and, unless you unsubscribe, related information. We never use the addresses the scan reads in your tenant for anything but the report.

Does mlab keep access to my tenant afterwards?

The approval stays in your tenant until you remove it; mlab does not use it again for the free check. The report shows how to remove the mlab-scan application in two clicks (Entra admin center, Enterprise applications). If you later create an account, the same approval lets you run full scans.

Can I scan the same tenant again?

The free check runs once per tenant. To scan it again, follow it over time or use the Hardened profile, create a free account: your first Redkit scan is included.