See, prove and fix your Microsoft 365 security.
Griffin31 checks your tenant against 370+ security recommendations, shows the evidence behind every result, and tells you exactly what to fix first — with guidance built by Microsoft security architects.
- Trusted by 100+ customers
- Read-only access
- SOC 2 Type II
- Hosted in the EU
Require phishing-resistant MFA for admin roles
2 of 4 admins meet the requirement
370+ security checks across 10 Microsoft 365 services
Including 60+ checks for Copilot and AI agents: agent identities, Copilot Studio, MCP servers, third-party AI apps and prompt-injection protection.
- Identity115Entra ID
- Devices108Intune · Defender for Endpoint
- Email & collaboration109Exchange · SharePoint · Teams
- Apps, AI & data40Copilot Studio · Power Platform · Defender for Cloud Apps · Purview
AI and agent checks span all four areas.
One checkbox. One breach.
Attackers don’t need a zero-day. A legacy protocol left on, or a gap in a Conditional Access policy, is enough. In Microsoft 365, the difference between secure and breached can be a single setting.
Hard to prioritize
With hundreds of settings, there is no clear way to rank what is critical and what can wait.
Fear of user impact
Security changes can disrupt work. Without impact analysis, teams hesitate to act.
Too many hands
Helpdesk, IT and Security all touch the same settings, with little coordination or oversight.
A year-long backlog
Organizations take more than 12 months to work through their full remediation backlog.
A Microsoft security architect, built into your tools
Guiding every decision and prioritizing every fix — not another list of alerts.
- 01
Know your gaps
Full visibility into every misconfiguration across Microsoft 365: 370+ read-only checks on every scan, mapped to the frameworks you report on.
- 02
Know what to fix first
Expert-curated priorities based on real threat intelligence, impact on your users, and the effort each fix takes.
- 03
Know how to fix it right
Step-by-step remediation built by Microsoft security architects — not generic checklists — with Evidence to prove every change.
Know which attacks your settings would stop
Real-world attacks on Microsoft 365, broken into stages, with the recommendations that block each one. See your exposure in one look, and the fixes that close gaps in several threats at once.
Explore Threats →Self-service password reset abuse to Azure production data theft
THR-14Nothing in this flow is malware. The operator initiates Entra ID self-service password reset on behalf of a targeted user, then uses Graph API and Azure admin rights to reach production data.See more
- Storm-2949, per Microsoft Threat Intelligence, May 2026
- IT staff and senior leadership holding custom Azure RBAC roles
- No malware — SSPR, Graph API and Azure admin primitives only
Sources: Microsoft Security Blog
- Adversary
- Credential Access20%
- Initial Access225%
- Persistence20%
- Privilege Escalation10%
- Collection225%
- Target
Swipe to see the full path →
Band width = how much of the attack still gets through
No more “failed” without an explanation
Every recommendation shows the data behind its result: which users, policies, devices or settings meet the requirement, and which don’t.
- Fix exactly what needs to change, without hunting through admin centers.
- Verify the change on the next scan.
- Prove it to auditors, management or customers.
Start where it counts
Quick wins surface high-impact fixes that are easy to make. Fix These First lists the changes that close gaps in several threats at once.
How priorities work →- FailedDisable SMS sign-in for adminsQuick win
- FailedBlock device code flow4 threats
- PartialRequire compliant devices3 threats
- FailedTurn on Safe Links for TeamsQuick win
Plan the work as projects, not checklists
Stories group focused recommendations by goal — Conditional Access, secure collaboration, Copilot governance — and show how far along you are on each.
Explore Stories →Example progress.
Audit-ready, every day
Recommendations map to the frameworks you report on — CIS, ISO 27001, NIST CSF 2.0, SOC 2, CMMC and more — so every score is backed by checks and Evidence.
How Compliance works →- CIS Microsoft 36571%
- ISO 2700164%
- NIST CSF 2.068%
- SOC 274%
- CMMC58%
Example scores.
Secure Copilot and your AI agents
AI agents now act on your data with their own identities. Griffin31 includes 60+ checks for Microsoft 365 Copilot, Copilot Studio agents and Microsoft Entra agent identities — so AI adoption doesn’t open a new door.
Copilot Studio agents
Require authentication, remove dormant agents, fix overprivileged agents and remove hardcoded secrets.
Agent identities
Every Microsoft Entra agent identity has an owner and a sponsor, behind default-deny Conditional Access.
Copilot data
Retention, communication compliance and insider-risk policies for Copilot interactions.
Copilot access
Phishing-resistant MFA, compliant devices and limits on personal Copilot and third-party integrations.
Every change. Every regression. No blind spots.
Know what changed, who changed it, and why it matters — even when Helpdesk, IT and Security all touch the same settings.
Regression alerts
When a setting drifts from secure, Griffin31 flags it and emails the right people, with what it was before.
Passed → Failed · Block legacy authenticationWho changed what
Sensitive Microsoft Entra changes are recorded with who made them and when, in one timeline.
Conditional Access policy updated · it-ops@contoso.comDecisions on record
Mark checks as reviewed, or exempt them with a reason and an expiry date. Nothing lives in a spreadsheet.
Exempted · Risk accepted by ownerClear ownership
Assign recommendations to the right person and track them in one personal queue.
Assigned · secops@contoso.comMore than a score
Built to the standard we measure you against
Read-only by design, independently audited, and hosted in the EU.
Visit the Trust Center- SOC 2 Type II compliantIndependently audited security controls.
- Read-only accessGriffin31 cannot change anything in your tenant.
- No user contentWe never read or store email, files, chats or documents.
- Hosted in the EUCustomer data stays on Microsoft Azure in North Europe.
Choose your path to a secure Microsoft 365
From a first look to full ongoing protection.
One-Time Assessment
A full snapshot of your Microsoft 365 security posture. For organizations that want to understand their risk before ongoing coverage.
- Full scan of 370+ security checks
- Prioritized list of misconfigurations
- Detailed remediation guidance
- Report delivered by a security architect
Annual Subscription
Continuous monitoring and expert guidance, with a dedicated Microsoft security architect to help you build and keep a true Zero Trust architecture.
- Everything in the One-Time Assessment
- Continuous monitoring and regression alerts
- Recommendations updated with every release
- Dedicated Microsoft security architect
- Quarterly architecture reviews
Subscription + Remediation
The complete Griffin31 experience. We don’t just tell you what’s broken — our experts fix it with you, so nothing stays misconfigured.
- Everything in the Annual Subscription
- Hands-on remediation by Griffin31 experts
- Change management and coordination
- Full audit trail of all fixes
- Priority threat response
- SLA-backed response times
What is SSPM for Microsoft 365?
SaaS Security Posture Management (SSPM) continuously checks the security settings of a SaaS platform against best practice. Griffin31 is SSPM built for Microsoft 365: it checks Entra ID, Intune, Exchange, Defender, SharePoint, Teams, Power Platform, Copilot and Purview, shows the evidence behind each result, and gives step-by-step fixes.
Does Griffin31 cover Copilot and AI agents?
Yes. Griffin31 includes 60+ checks for Microsoft 365 Copilot, Copilot Studio agents and Microsoft Entra agent identities — such as requiring authentication for agents, removing dormant or overprivileged agents, assigning owners and sponsors to agent identities, and protecting Copilot data with Conditional Access, retention and insider-risk policies.
Can Griffin31 change anything in my tenant?
No. Every Microsoft 365 permission Griffin31 uses is read-only, and its directory role is Microsoft’s read-only Global Reader. It cannot change settings and cannot read email, files or chats.
How long does it take to connect?
Minutes. You approve Griffin31 once in Microsoft Entra ID and the first scan starts. There are no agents to install and no app secrets for you to manage.
How current are the checks?
Griffin31 checks your tenant on every scan, and the recommendation catalog is updated with each release to follow Microsoft’s latest features, changes and retirements.
Where is my data stored?
On Microsoft Azure in the EU (North Europe). Griffin31 is SOC 2 Type II compliant.
Can I use it for audits?
Yes. Recommendations map to frameworks such as CIS, ISO 27001, NIST CSF 2.0, SOC 2 and CMMC, and every result comes with Evidence you can show an auditor.
See your Microsoft 365 the way an attacker would — then fix it.
A 30-minute walkthrough on your own priorities.