Assigned, active and licensed are different states
A license assignment does not prove use. An unlicensed-use finding needs supported activity and entitlement evidence for the same application; an unread source cannot establish it.
MSP BUYER GUIDE
Microsoft 365 Security Assessment Tool for MSPs
The first decision is which access, application or lifecycle condition needs attention—not which dashboard to open. SCOUTz helps MSPs interpret supported Microsoft 365 evidence, scope the work and retain the proof behind each recommendation.
EVIDENCE · INSIGHT · PROOF
What you can know before they let you in, and after.
01
Before consent
Published domain, DNS, email authentication, certificates and external evidence.
02
With read-only consent
Supported Microsoft 365 identity, app, permission, licensing and configuration evidence.
03
Never inferred
No message bodies, private files, chats or prompts. Unread is not clean.
EVIDENCE · INSIGHT · PROOF
Answer the insurer with evidence—not a blanket verdict.
01
Observed
What does the supported source show?
02
Confirm
Which operational answers need the customer or MSP?
03
Gap
What remains unresolved or untested?
04
Next step
Document the owner and obtain appropriate insurance advice.
EVIDENCE · INSIGHT · PROOF
What the client reads. What you work from.
01
Client copy
Plain-language findings, scope, unknowns and the next decision.
02
Operator copy
Evidence references, investigation steps, prerequisites, LOE and validation.
By Steve Copeland · Reviewed October 18, 2026. New guide; source article publication dates remain in their archived records.
Short answer
The first decision is which access, application or lifecycle condition needs attention—not which dashboard to open. SCOUTz helps MSPs interpret supported Microsoft 365 evidence, scope the work and retain the proof behind each recommendation.
Find access that outlived the person
Departed-staff accounts, forwarding and unreclaimed licenses can raise different questions. Confirm employment status, retention needs, delegated responsibilities and the authorized offboarding process before recommending removal.
A lifecycle finding is evidence for investigation, not permission to disable an account. The MSP reviews the technical steps, customer approval, rollback and verification with the responsible owner.
Review standing application access and Shadow AI
Applications Center and AI Center help examine returned application inventory, permissions, consent, ownership and credential lifecycle metadata. An app permission may allow mailbox or file access even when the assessment does not read that content.
Inventory does not prove actual use or compromise. Supported managed-device evidence does not cover every unmanaged device, embedded agent or private prompt. Present observed evidence, customer-confirmed context, gaps and not-assessed areas separately for Copilot preparation.
Separate a registered method from enforced sign-in
MFA registration, Conditional Access configuration and effective coverage answer different questions. Exceptions, excluded accounts and unread sources can limit a conclusion. Confirm the relevant people and sign-in paths before calling a policy effective.
Device configuration and available Intune metadata add context, not a claim that an agent inspected every endpoint. A missing backup signal cannot establish recoverability; restore tests and operational records remain separate evidence.
Make insurance and license questions actionable
The cyber-insurance tally organizes 19 questions into met, partial, open and needs confirmation. It is preparation for discussion, not an underwriting decision, promise of cover or certification of complete readiness.
License right-sizing and recoverable-spend estimates use the stated pricing basis. Confirm actual contracts, prepaid commitments and the user’s work before presenting an estimate as a saving. A disabled or inactive account still requires context.
Build the plan, then verify comparable evidence
The owner report explains priorities in plain language. The operator version retains checks, technical guidance and verification. The phased work plan supplies hour and dollar ranges; Studio proposals use the MSP’s configured rates and catalog.
A rescan compares the new state to a baseline, with dates and check identities. Permission changes must remain visible so reduced coverage does not masquerade as a resolved condition. Microsoft Secure Score stays separate.
Security review is not the SharePoint retirement tool
Microsoft’s open-source Microsoft 365 Assessment tool for SharePoint retirement scenarios is a different tool. This guide concerns customer-approved security configuration and metadata review.
Access must be agreed before collection. Review the current trust documentation for permission, revocation and retention details; this page does not invent a fixed consent window or guarantee that every source will be readable.
Turn approved tenant evidence into better discovery.
Review supported configuration and metadata with customer-approved, read-only access.
Use application inventory, ownership, permissions and credential metadata to establish what the source returned—not to assume active use, misuse or complete readiness.
SCOUTz does not read private message bodies, files, chats, documents or prompts. Unread evidence remains unknown. The review does not change the tenant.
WHAT'S NEW IN SCOUTz · OPEN BETA
Microsoft 365 license review: assignment is not use
See application assignments and compare supported usage and entitlement evidence. Review Microsoft licenses on disabled, guest or inactive accounts, with the source and available activity window kept visible.
A license finding starts a review
Confirm the account's business purpose, licensing rules and the client's intended policy before recommending a change. SCOUTz's read-only review does not revoke access or remove a license.
Honest by design: every count names its source. A check SCOUTz could not read stays “Not read”—not “none” or “all clear”. Microsoft 365 reviews use client-consented, read-only access and do not read message bodies, files, chats, documents or prompts.
We want the configuration evidence—not your client’s conversations.
Customer-approved, read-only access covers supported configuration and metadata, not message bodies, files, chats, documents or prompts.
Can access be revoked?
The tenant administrator controls authorization through Microsoft. Revocation can reduce or end what future collection can read.
RELATED SCOUTz INSIGHTS
Compare the job and current terms
Source review: October 18, 2026. This is a scope comparison, not hands-on testing or an overall ranking. Unavailable measurements remain unverified. Earlier comparison-page review notes are retained separately.
| Product | Decision or workflow | Commercial scope | Source |
|---|---|---|---|
| CloudCapsule | Microsoft 365 assessment; Analyze and Manage have different permissions. | Analyze $250/month; tenants under 1,000 users. | CloudCapsule vendor information |
| M365Assessments | Evaluate the current Microsoft 365 assessment scope with the vendor. | Pricing not verified: source unavailable during this review. | M365Assessments vendor information |
| ConfigCheckup | Evaluate the current multi-tenant assessment coverage. | Pricing not verified in this review. | ConfigCheckup vendor information |
| Syncro Snapshot | Evaluate the supported Microsoft 365 tenant assessment. | Confirm current availability and terms. | Syncro Snapshot vendor information |
| SCOUTz | Evidence-led preparation, work planning and dated verification. | $279/month; unlimited users, fair use. | SCOUTz vendor information |
The evidence behind the decision
35 public sources for a domain scan; 92 sources with read-only Microsoft 365 consent. Every report counts its checks and shows anything it couldn't read as unread, never as clean.
Microsoft 365 reviews require customer approval and read-only access. SCOUTz does not read mail, files, chats, documents or prompts, install an agent, or make changes.
In one example scan, the domain review read 17 checks; in one Microsoft 365 example, it read 174. Those are example results, not fixed coverage promises. Availability, permissions and source readability affect each run.
Deterministic checks decide findings, AI writes explanations and a human signs off. The MSP approves changes, performs delivery and determines whether the verification evidence is sufficient.
Frequently asked questions
What does the assessment add beyond Microsoft Secure Score?
It connects supported findings to MSP priorities, explanation, work planning and dated verification. Microsoft Secure Score remains its own separate measure.
Does it show former employees who still have access?
Returned lifecycle and forwarding evidence can identify accounts worth reviewing. The customer must confirm employment and legitimate business exceptions before changes.
Does it find Shadow AI and apps that can read company mail?
Supported inventory and permission evidence can reveal AI-related apps and standing access. Permissions are not proof of actual content access, and coverage is not complete Shadow IT discovery.
Is the review read-only, and what does it never read?
Yes: customer-approved collection is read-only. SCOUTz does not read mail, files, documents, chats or prompts, install an agent or make configuration changes.
Can it answer the whole cyber-insurance questionnaire?
No. The 19-question tally separates supported answers from gaps and confirmation needs. Recovery, staffing and procedures may require customer or MSP evidence outside the scan.
How do I turn findings into a priced proposal?
Validate the priorities and dependencies first. Use the work plan’s estimates and your own configured rates and catalog; review scope and obtain customer approval before delivery.
Related guides and next steps
- Trust and access boundaries
- AI governance
- Application governance
- Microsoft Secure Score
- Sample security report
- Pricing
Start with a free public-domain score or discuss an authorized scenario in a demo. Open Beta applications remain human-reviewed; current commercial terms are on the pricing page.
Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.