Email & website
Can someone send email that looks like it came from you? Is your website set up safely? This reads the same public records every mail server and browser already sees (SPF, DKIM, DMARC and security headers). No login, nothing installed.
You can paste a full web address or an email address; it will be trimmed to the domain. Only public records are read.
Users & licenses
Add a user export from Microsoft 365 (Entra ID) or Google Workspace. You'll see who has no MFA, which ex-staff accounts are still on, how many people hold admin rights, and what unused licenses cost you.
Where your file goes
Nowhere. The file is read by code running in this browser tab and kept in memory. Nothing is uploaded, saved or logged, and refreshing the page erases it.
You don't have to take my word for it:
- Open your browser's developer tools, go to the Network tab, then add the file. No request is sent.
- Or load this page, turn off Wi-Fi, then add the file. The audit still runs.
What it actually needs
| Email or name | Telling accounts apart and naming them in the ticket | Required |
| MFA status | MFA coverage | Recommended |
| Last sign-in | Finding stale accounts | Recommended |
| Role / admin roles | Counting Global Admins | Recommended |
| Enabled / blocked | Skipping accounts that are already off | Optional |
| Licenses | License waste | Optional |
| Monthly cost | Dollar savings (otherwise $22/mo is assumed) | Optional |
| Account type | Leaving guests and shared mailboxes out of staff counts | Optional |
Delete every other column (phone, address, department, manager) before you add the file. You can also swap real names and emails for placeholders like user01@yourorg.org and match them up yourself afterward. If you do, keep the account type column, or leave shared mailboxes like info@ as they are, so they aren't counted as people.
Just looking? (22 made-up accounts).
Microsoft 365: the standard user download doesn't include MFA or last sign-in. Add it together with Entra admin center → Protection → Authentication methods → User registration details (for MFA) and they're matched up by email. Or ask your MSP for one export with MFA status, last sign-in, roles, and licenses (the blank template shows the columns).
Ask your MSP
Ten controls that separate "keeping the lights on" from actually protecting the organization. Answer what you know today — "Unsure" is an answer, and it becomes a question for Your MSP.
- 1
Phishing-Resistant MFA Enforcement
Why this matters: Microsoft reports that MFA blocks more than 99.9% of automated account-takeover attacks. SMS codes can be stolen through SIM swapping, and a single exempted executive or board account is where attackers aim first.Does your MSP enforce MFA on every account, including executives and board members, using an authenticator app or security key rather than text-message (SMS) codes?
- 2
Help Desk Caller Identity Verification
Why this matters: Attackers routinely phone help desks pretending to be staff; this was the reported entry point in the 2023 MGM Resorts breach. Knowing a name and job title from LinkedIn should never be enough to reset a password or MFA device.If someone calls your MSP help desk claiming to be an employee locked out of their account, does the MSP require technical out-of-band verification (like a push notification or callback to a manager) before resetting a password?
- 3
Immutable 3-2-1 Backups & Restore Drills
Why this matters: Microsoft and Google don't guarantee that you can recover deleted or encrypted data. A backup that has never been test-restored is a hope, not a plan, and ransomware groups go after backups first.Does your MSP back up cloud data (Microsoft 365 SharePoint and OneDrive, or Google Drive, not just servers), and has it shown you proof of a successful test restore in the last 6 months?
- 4
24/7 Endpoint Detection & Response
Why this matters: Traditional antivirus often misses modern ransomware. EDR watches for suspicious behavior and, just as important, someone is responding to its alerts at 2 a.m. on a Saturday.Are all of the organization's laptops running monitored EDR/MDR software (such as Defender for Business, Huntress, or CrowdStrike) rather than traditional antivirus?
- 5
Automated OS & Third-Party Patching
Why this matters: Many breaches exploit vulnerabilities that already had a patch available. Third-party apps such as browsers, Adobe Reader, and Zoom are often left out of basic MSP patching.Does your MSP provide a monthly report showing that Windows, macOS, and third-party apps such as Chrome, Adobe Reader, and Zoom are patched within 14 days of critical updates?
- 6
15-Minute Offboarding Kill-Switch
Why this matters: Former staff and volunteers who keep their access are a common cause of data leaks, and their idle licenses quietly cost money every month.When an employee or volunteer leaves, does your MSP have a documented SLA to revoke all logins, active sessions, OAuth tokens, and email forwarding within 15 minutes of notification?
- 7
Silent Inbox Auto-Forwarding & BEC Monitoring
Why this matters: In business email compromise, attackers secretly forward a finance inbox to themselves and wait for an invoice to hijack. Nonprofits have lost six-figure payments this way.Has your MSP blocked external email auto-forwarding at the tenant level and enabled alerts for suspicious inbox rules or impossible-travel logins?
- 8
Removal of Local Admin Privileges
Why this matters: When a staff member with admin rights clicks a malicious link, the malware gets admin rights too. Removing local admin rights limits the damage from most critical Windows vulnerabilities.Do regular staff members operate as standard users on their laptops (requiring MSP elevation to install software), rather than holding full Local Administrator rights?
- 9
Live Hardware & Shadow IT Asset Inventory
Why this matters: You can't protect what you don't know exists. Grant funders and cyber insurers increasingly require an asset inventory, and forgotten devices are rarely patched.Can your MSP hand you an up-to-date list today of every laptop, mobile device, and third-party cloud app connected to your environment?
- 10
Written Incident Response & Breach Call Tree
Why this matters: After a fraudulent wire transfer, the best chance of getting the money back is in the first 72 hours. Confusion over who to call on a weekend can turn a recoverable incident into a permanent loss.Do you and your MSP have a shared 24/7 emergency call tree defining who to call during a ransomware or wire-fraud incident on a weekend?
Tickets & board brief
Everything from steps 1–3, written up as help desk tickets you can send your MSP as-is, plus a one-page brief your board can read in two minutes.