See, prove and fix your Microsoft 365 security.
Griffin31 checks your tenant against 350+ security recommendations, shows the evidence behind every result, and tells you exactly what to fix first — with guidance built by Microsoft security architects.
30-min demo, no tenant access needed · or a free 2-week pilot, read-only
- Trusted by 100+ customers
- SOC 2 Type II
- Built by OnCloud
Require phishing-resistant MFA for admin roles
2 of 4 admins meet the requirement
One checkbox. One breach.
Attackers don’t need a zero-day. A legacy protocol left on, or a gap in a Conditional Access policy, is enough. In Microsoft 365, the difference between secure and breached can be a single setting.
Hard to prioritize
With hundreds of settings, there is no clear way to rank what is critical and what can wait.
Fear of user impact
Security changes can disrupt work. Without impact analysis, teams hesitate to act.
Too many hands
Helpdesk, IT and Security all touch the same settings, with little coordination or oversight.
A year-long backlog
Organizations take more than 12 months to work through their full remediation backlog.
A Microsoft security architect, built into your tools
Guiding every decision and prioritizing every fix — not another list of alerts.
- 01
Know your gaps
Full visibility into every misconfiguration across Microsoft 365: 350+ read-only checks on every scan, mapped to the frameworks you report on.
- 02
Know what to fix first
Expert-curated priorities based on real threat intelligence, impact on your users, and the effort each fix takes.
- 03
Know how to fix it right
Step-by-step remediation built by Microsoft security architects — not generic checklists — with Evidence to prove every change.
350+ security checks across 10 Microsoft 365 services
Including 60+ checks for Copilot and AI agents: agent identities, Copilot Studio, MCP servers, third-party AI apps and prompt-injection protection.
- Identity115Entra ID
- Devices108Intune · Defender for Endpoint
- Email & collaboration109Exchange · SharePoint · Teams
- Apps, AI & data40Copilot Studio · Power Platform · Defender for Cloud Apps · Purview
AI and agent checks span all four areas. Every release adds new checks and updates existing ones.
Know which attacks your settings would stop
Real-world attacks on Microsoft 365, broken into stages, with the recommendations that block each one. See your exposure in one look, and the fixes that close gaps in several threats at once.
Self-service password reset abuse to Azure production data theft
THR-14Nothing in this flow is malware. The operator initiates Entra ID self-service password reset on behalf of a targeted user, then uses Graph API and Azure admin rights to reach production data.See more
- Storm-2949, per Microsoft Threat Intelligence, May 2026
- IT staff and senior leadership holding custom Azure RBAC roles
- No malware — SSPR, Graph API and Azure admin primitives only
Sources: Microsoft Security Blog
- Adversary
- Credential Access20%
- Initial Access225%
- Persistence20%
- Privilege Escalation10%
- Collection225%
- Target
Swipe to see the full path →
Band width = how much of the attack still gets through
Start where it counts
Quick wins surface high-impact fixes that are easy to make. Fix These First lists the changes that close gaps in several threats at once.
- FailedDisable SMS sign-in for adminsQuick win
- FailedBlock device code flow4 threats
- PartialRequire compliant devices3 threats
- FailedTurn on Safe Links for TeamsQuick win
No more “failed” without an explanation
Every recommendation shows the data behind its result: which users, policies, devices or settings meet the requirement, and which don’t.
- Fix exactly what needs to change, without hunting through admin centers.
- Verify the change on the next scan.
- Prove it to auditors, management or customers.
- Exempt a finding on purpose, with a reason and an expiry date.
Secure Copilot and your AI agents
AI agents now act on your data with their own identities. Griffin31 includes 60+ checks for Microsoft 365 Copilot, Copilot Studio agents and Microsoft Entra agent identities — so AI adoption doesn’t open a new door.
Copilot Studio agents
Require authentication, remove dormant agents, fix overprivileged agents and remove hardcoded secrets.
Agent identities
Every Microsoft Entra agent identity has an owner and a sponsor, behind default-deny Conditional Access.
Copilot data
Retention, communication compliance and insider-risk policies for Copilot interactions.
Copilot access
Phishing-resistant MFA, compliant devices and limits on personal Copilot and third-party integrations.
Everything you need to manage security over time
Work plans
Recommendations grouped by goal, with progress on each.
Audit-ready, every day
Mapped to CIS, ISO 27001, NIST and SOC 2, with Evidence behind every score.
Change monitoring
An alert when a setting slips back, with who changed it and what it was.
Want to see this on your tenant?
A free two-week, read-only pilot, with a security architect who walks you through the findings.
Built to the standard we measure you against
Read-only by design, independently audited, and hosted in the EU.
Visit the Trust Center- SOC 2 Type II compliantIndependently audited security controls.
- Read-only accessGriffin31 cannot change anything in your tenant.
- No user contentWe never read or store email, files, chats or documents.
- Hosted in the EUCustomer data stays on Microsoft Azure in North Europe.
Choose your path to a secure Microsoft 365
From a first look to full ongoing protection.
One-Time Assessment
A full snapshot of your Microsoft 365 security posture. For organizations that want to understand their risk before ongoing coverage.
- Full scan of 350+ security checks
- Prioritized list of misconfigurations
- Detailed remediation guidance
- Report delivered by a security architect
Annual Subscription
Continuous monitoring and expert guidance, with a dedicated Microsoft security architect to help you build and keep a true Zero Trust architecture.
- Everything in the One-Time Assessment
- Continuous monitoring and regression alerts
- Recommendations updated with every release
- Dedicated Microsoft security architect
- Quarterly architecture reviews
Subscription + Remediation
Beyond the report and recommendations, our experts fix the findings with you and document every change, so nothing stays misconfigured.
- Everything in the Annual Subscription
- Hands-on remediation by Griffin31 experts
- Change management and coordination
- Full audit trail of all fixes
- Priority threat response
- SLA-backed response times
What does Griffin31 check?
Griffin31 continuously checks the security settings in Microsoft 365: Entra ID, Intune, Exchange, Defender, SharePoint, Teams, Power Platform, Copilot and Purview, shows the evidence behind each result, and gives step-by-step fixes.
Does Griffin31 cover Copilot and AI agents?
Yes. Griffin31 includes 60+ checks for Microsoft 365 Copilot, Copilot Studio agents and Microsoft Entra agent identities — such as requiring authentication for agents, removing dormant or overprivileged agents, assigning owners and sponsors to agent identities, and protecting Copilot data with Conditional Access, retention and insider-risk policies.
Can Griffin31 change anything in my tenant?
No. Every Microsoft 365 permission Griffin31 uses is read-only, and its directory role is Microsoft’s read-only Global Reader. It cannot change settings and cannot read email, files or chats.
How long does it take to connect?
Minutes. You approve Griffin31 once in Microsoft Entra ID and the first scan starts. There are no agents to install and no app secrets for you to manage.
How current are the checks?
Griffin31 checks your tenant on every scan, and the recommendation catalog is updated with each release to follow Microsoft’s latest features, changes and retirements.
Where is my data stored?
On Microsoft Azure in the EU (North Europe). Griffin31 is SOC 2 Type II compliant.
Can I use it for audits?
Yes. Recommendations map to frameworks such as CIS, ISO 27001, NIST CSF 2.0, SOC 2 and CMMC, and every result comes with Evidence you can show an auditor.
See your Microsoft 365 the way an attacker would — then fix it.
A free 2-week pilot on your own tenant, with a security architect who walks you through the findings.
Read-only · no access to email, files or chats