Your clients' Microsoft 365 tenants, watched like an endpoint.
An agent tells you what is happening on a device. It can tell you nothing about the tenant your client actually works in. Secuno reads every connected Microsoft 365 and Entra ID tenant on a schedule, watches who signs in from where, and reports what changed since the last scan, not just what is wrong today.
- Legacy auth blocked
- +12 pts
- Guest invites relaxed
- new
- New OAuth grants
- 0
The endpoint agent is blind to the tenant. That is where the account lives.
Credential theft does not need malware on a laptop. It needs one account with weak second factor, one permission granted a year ago and never reviewed, or one administrator who quietly stopped using their authenticator. None of that shows up on the device, and none of it shows up in a monthly export either.
Agentless, and read-only by default
Secuno connects to each tenant with read-only Graph permissions and installs nothing. Acting on an account is a separate opt-in per tenant, described below. Without it, the console tells you what to change and cannot change it for you.
Configured per tenant, not per platform
Every client declares its own expectations, because they are genuinely different. A customer with a Dutch back office and an Indian development team is not an exception to be worked around.
Unknown is never reported as a pass
A check whose data Graph refused is recorded as unknown, with the reason. A permissions gap that renders as a clean tenant is worse than no answer, because it is the answer you would have acted on.
Detections Secuno raises itself, without waiting for Microsoft.
Microsoft's own sign-in risk needs Entra ID P2, which a Business Premium tenant, the most common kind in SMB, does not have. Three of the four detections Secuno raises itself need no P2, and they run on Secuno's own schedule.
- The endpoint contradicts the sign-in: the user's own laptop was demonstrably in another country within fifteen minutes. That opens a HIGH case carrying device response actions and, where the tenant opted in, account ones. When the laptop agrees, impossible travel is downgraded, never below LOW.
- A learned country baseline, per tenant and per person. A country nobody in the tenant has signed in from is HIGH, one this person has not is MEDIUM. It learns for fourteen days before it alerts, with no country list to fill in.
- Password spray or targeted guessing followed by a successful sign-in, written as two narrow rules so a phone still holding last month's password does not fire.
- With P2, a detection dismissed in Entra resolves its finding here, and an account moved to confirmed compromised opens a case within one poll interval.
- Impossible travel is measured against the fastest plausible journey. A declared country list and time-boxed vacation windows still apply where a tenant wants them, and a holiday never switches impossible travel off.
Allowed sign-in countries
A successful sign-in from anywhere else raises a HIGH risk. Empty allows every country. Attempts already blocked by conditional access never appear here.
Sign-ins from the countries you name stop raising findings for the dates you choose, then the fence closes again on its own. Impossible travel keeps running throughout.
| User | Countries | Dates | Status |
|---|---|---|---|
| M. Alvarez[email protected] | SpainES | Sep 12 – Sep 20 | Active |
| S. Novak[email protected] | United StatesUS | Oct 02 – Oct 09 | Scheduled |
A bare percentage is not a conversation with a client.
Microsoft gives you a number. On its own nobody knows whether 58% is good, or what to fix first.
- Set against the industry average and against tenants of a similar seat count, so the number has a frame.
- Recommendations ranked by the points still on the table, which is effort-to-impact order and the order the score will actually move in.
- Not labelled remediate: Secuno holds no write access to these settings, and a button that promises a fix but opens documentation is a promise the product does not keep.
Thirty-nine finding types, each able to open a risk unattended.
Secuno reads MFA status per method, privileged roles with standing and PIM-eligible assignments told apart, Conditional Access and Security Defaults, legacy authentication, risky users, SharePoint and guest sharing, OAuth applications with their permissions, consent type and publisher verification, app secrets and certificates, and SPF, DKIM and DMARC for mail. Where a combination is dangerous on its own, it becomes a risk with an owner and a due date. Eighteen posture metrics are kept per tenant with eight baseline sub-signals beneath them, and nine drift types are compared on every scan.
The forwarding, mail-flow, audit logging and delegation rows come from the Exchange Online checks, which are opt-in per tenant and off by default. Every finding is keyed to the tenant and the subject it concerns, so a rescan updates it in place rather than opening a second copy. Findings can be excepted for a fixed window, with both an expiry and a reason required: an exception with no expiry is a permanent mute, and one with no reason cannot be reviewed six months later.
Twenty-seven controls, and an answer for every one.
Findings say what is wrong. Controls also say what is right. Every full scan marks 27 controls in eight sections, from identity and privileged access to mail, sharing, applications and hybrid sync, as pass, fail, unknown or not applicable. Each control carries its CIS Microsoft 365 Foundations v4 and CISA SCuBA references, so a client conversation or an audit can start from a benchmark rather than a list of problems.
A clean tenant leaves evidence
A correctly configured tenant used to leave no trace, because only defects were recorded. Now it can show how many of its 27 controls pass, the Tenant Baseline view shows what has been failing since when, and compliance frameworks read the same results.
Unknown is never counted as a pass
A control whose data could not be read is unknown and names the dataset. A check that is switched off is not applicable. Fail beats unknown, and neither unknown nor not applicable is ever counted as a pass.
Break-glass accounts, declared properly
Emergency-access accounts are declared by object id and exempted from the privileged MFA checks only. They are still inventoried, still counted, and a declared account that no longer holds a privileged role raises its own finding.
When the account is the incident, act on the account.
Read-only is the default. A tenant can opt in to three actions: revoke every sign-in session for a user, disable the account, and enable it again. Once switched on they are offered on the user list and inside any investigation about that account, and automation rules can revoke sessions or disable an account.
- Opt-in per tenant, and off until someone switches it on. The permissions are proven from the token itself before the switch turns on, turning it on needs an explicit acknowledgement, and it can be switched off again at any time.
- Disabling the last Global Administrator is refused, and actions only reach users seen in the last scan.
- A case that groups alerts about more than one account refuses identity actions and says why, rather than guessing whose account to lock.
- Switching it on or off, and every action taken, is written to the audit log. An automation rule acts on the case's own subject and can never name its own target.
What connecting a tenant actually involves.
What is ITDR, and how is it different from what my RMM already shows me?
Identity Threat Detection and Response is the practice of watching the identity layer itself: who can sign in, from where, with what second factor, holding which roles, and which applications they have consented to. An RMM manages devices and an antivirus watches processes. Neither can see that an administrator stopped using their authenticator last Tuesday, or that an OAuth application granted broad mailbox access two years ago is still holding it.
Does Secuno need write access to my client's tenant?
Not for monitoring. Posture, controls and sign-in detection use read-only Graph permissions, and nothing is installed in the tenant. The only writes Secuno can ever make are the three account actions, and only on a tenant that has opted in. Recommendations still open the relevant Microsoft admin screen rather than claiming to apply a configuration fix.
Do my client's tenants need Entra ID P2?
Not for most of this. Three of Secuno's four sign-in detections run without it, and so do most posture checks, which matters because Business Premium includes P1 and not P2. Microsoft's own risky users and risk detections are a P2 dataset, and on a tenant without it that is recorded as a plan limit, not shown as a warning the customer cannot fix.
What does a risky sign-in alert actually tell me?
What signed in, not only who. Each risky sign-in shows whether MFA was satisfied, the application, the device, operating system and browser, and which Conditional Access policies applied, with No CA policy applied marked in amber and a link to the sign-in in Entra. The sign-in log lags the detection, so the lookup retries rather than guessing, and a match it cannot make with certainty is stored as ambiguous.
What happens if a permission is missing or the plan does not include a dataset?
The dataset is recorded as unknown with a classified reason, both on the connection and on that individual scan, so you can answer later when a dataset started failing and what Graph actually said. Plan limits are stated as plan limits. A tenant below the premium identity plan does not get a permanent warning banner for something the customer cannot fix.
Will impossible travel fire every time someone uses a VPN?
Sign-ins whose location cannot be resolved, or resolves too coarsely, are skipped rather than guessed at. That is the specific case a naive distance check gets wrong, since VPN egress often resolves to a datacentre with no meaningful country attached.
How does this reach my team rather than sitting in another console?
Every finding becomes a scored risk on the same queue as everything else, with an owner, a due date and an audit trail, and it can be routed to Slack, Teams, Jira, ServiceNow or your PSA through the same connectors as any other risk. Sign-in detections open an investigation instead, beside the endpoint cases, because a sign-in that happened does not stop having happened.
How is Managed ITDR priced?
€1.70 per licensed identity per month, excluding VAT, for everything on this page. A licensed identity is an account in the tenant with a Microsoft 365 licence assigned; accounts without a licence are not counted. It is a module on top of the Standard platform. MSPs and MSSPs get partner pricing on request.
Connect one tenant and see what a scan finds.
A 30-minute walkthrough against a real tenant, from consent to the first scored finding. Bring the client environment you are least sure about.
Not ready for a demo? Scan a client's domain with the free Microsoft 365 check