I built a free, open-source M365 security assessment tool - looking for feedback
I work as an IT consultant, and a good chunk of my time is spent assessing Microsoft 365 environments for small and mid-sized businesses. Every engagement started the same way: connect to five different PowerShell modules, run dozens of commands across Entra ID, Exchange Online, Defender, SharePoint, and Teams, manually compare each setting against CIS benchmarks, then spend hours assembling everything into a report the client could actually read. The tools that automate this either cost thousands per year, require standing up Azure infrastructure just to run, or only cover one service area. I wanted something simpler: one command that connects, assesses, and produces a client-ready deliverable. So I built it. What M365 Assess does https://github.com/Daren9m/M365-Assess is a PowerShell-based security assessment tool that runs against a Microsoft 365 tenant and produces a comprehensive set of reports. Here is what you get from a single run: 57 automated security checks aligned to the CIS Microsoft 365 Foundations Benchmark v6.0.1, covering Entra ID, Exchange Online, Defender for Office 365, SharePoint Online, and Teams 12 compliance frameworks mapped simultaneously -- every finding is cross-referenced against NIST 800-53, NIST CSF 2.0, ISO 27001:2022, SOC 2, HIPAA, PCI DSS v4.0.1, CMMC 2.0, CISA SCuBA, and DISA STIG (plus CIS profiles for E3 L1/L2 and E5 L1/L2) 20+ CSV exports covering users, mailboxes, MFA status, admin roles, conditional access policies, mail flow rules, device compliance, and more A self-contained HTML report with an executive summary, severity badges, sortable tables, and a compliance overview dashboard -- no external dependencies, fully base64-encoded, just open it in any browser or email it directly The entire assessment is read-only. It never modifies tenant settings. Only Get-* cmdlets are used. A few things I'm proud of Real-time progress in the console. As the assessment runs, you see each check complete with live status indicators and timing. No staring at a blank terminal wondering if it hung. The HTML report is a single file. Logos, backgrounds, fonts -- everything is embedded. You can email the report as an attachment and it renders perfectly. It supports dark mode (auto-detects system preference), and all tables are sortable by clicking column headers. Compliance framework mapping. This was the feature that took the most work. The compliance overview shows coverage percentages across all 12 frameworks, with drill-down to individual controls. Each finding links back to its CIS control ID and maps to every applicable framework control. Pass/Fail detail tables. Each security check shows the CIS control reference, what was checked, what the expected value is, what the actual value is, and a clear Pass/Fail/Warning status. Findings include remediation descriptions to help prioritize fixes. Quick start If you want to try it out, it takes about 5 minutes to get running: # Install prerequisites (if you don't have them already) Install-Module Microsoft.Graph, ExchangeOnlineManagement -Scope CurrentUser Clone and run git clone https://github.com/Daren9m/M365-Assess.git cd M365-Assess .\Invoke-M365Assessment.ps1 The interactive wizard walks you through selecting assessment sections, entering your tenant ID, and choosing an authentication method (interactive browser login, certificate-based, or pre-existing connections). Results land in a timestamped folder with all CSVs and the HTML report. Requires PowerShell 7.x and runs on Windows (macOS and Linux are experimental -- I would love help testing those platforms). Cloud support M365 Assess works with: Commercial (global) tenants GCC, GCC High, and DoD environments If you work in government cloud, the tool handles the different endpoint URIs automatically. What is next This is actively maintained and I have a roadmap of improvements: More automated checks -- 140 CIS v6.0.1 controls are tracked in the registry, with 57 automated today. Expanding coverage is the top priority. Remediation commands -- PowerShell snippets and portal steps for each finding, so you can fix issues directly from the report. XLSX compliance matrix -- A spreadsheet export for audit teams who need to work in Excel. Standalone report regeneration -- Re-run the report from existing CSV data without re-assessing the tenant. I would love your feedback I have been building this for my own consulting work, but I think it could be useful to the broader community. If you try it, I would genuinely appreciate hearing: What checks should I prioritize next? Which security controls matter most in your environment? What compliance frameworks are most requested by your clients or auditors? How does the report land with non-technical stakeholders? Is the executive summary useful, or does it need work? macOS/Linux users -- does it run? What breaks? I have tested it on macOS, but not extensively. Bug reports, feature requests, and contributions are all welcome on GitHub. Repository: https://github.com/Daren9m/M365-Assess License: MIT (free for commercial and personal use) Runtime: PowerShell 7.x Thanks for reading. Happy to answer any questions in the comments.
Unable to Open an Old OST File After Outlook Profile or Mailbox Changes
Hi everyone, I am looking for suggestions on handling an old OST file where the original Outlook profile or mailbox is no longer available. The situation is that an OST file contains important mailbox data, but Outlook cannot open it normally after changes to the user account or profile. This can happen after a Microsoft 365 mailbox change, Exchange migration, user account removal, or when an OST file becomes damaged. Since OST files are linked to the Outlook profile and mailbox that created them, simply moving the file to another system does not always make the data accessible. Before attempting any recovery approach, I would like to understand the recommended steps: Is there any Microsoft-recommended method to access an orphaned OST file? What checks should be performed before trying to recover data from the OST? How do administrators usually handle old OST files when the original mailbox is no longer available? What is the best way to validate recovered mailbox data? I would appreciate feedback from anyone who has handled similar Outlook OST recovery scenarios after Microsoft 365 or Exchange changes.
Outlook Android/iOS app - send as distribution group
Hi there, I have a question. Is there somewere on the Internet Android/iOS application that can send emails as distribution group ? We tried mobile Outlook app - doesn't allow it, we tried OWA - MS cancelede it. We just want to send emails from phones and tablets as distribution group, like send mail as "info@company.com" u know. Any answer helps. Thanks, - M
Help me recover my account.
Hi, My other Microsoft account was recently compromised but it was compromised before as well. When it was compromised before, the hacker added a recovery email for verification and to remove that I added my another email and the request was sent and it was supposed to change in October and I was not able to change the password or use other features of Microsoft because at some point it keep redirecting me to the page that I have sent a request but during that time period, my account was compromised again and I keep receiving emails of unusual sign-in activity by the hacker and I wanted to change the password but I couldn't because of that request so I was being patient. Now I received an email that someone accessed my Microsoft account and now I have to verify my identity to log in and to log in it ask me to type the email that the hacker set up because it's not changed and since I don't know what that is it takes me to the account recovery page where I put all the information that I know, I write in my postal code, my old and current passwords, date of birth etc. I have never used skype, Hotmail or outlook and Xbox so I just uncheck those boxes and then it asks me if I have ever bought any product but since I didn't so I uncheck that as well but then I just receive the email that the information I provided is nonsufficient even thou I provided all the information that is correct. Unfortunately Sign-in helper didn't work. Kindly help me resolve the issue. Looking forward to your positive response. Yours sincerely.
Online Archive Not Working for One User
Hi, I am experiencing an issue with the online archive for one of my users. The online archive has been working correctly for this user for years, but it has not archived any emails for the past six months. I have checked the licensing, retention tags, and retention policy, and everything appears to be correctly configured. I have also tried running the Start-ManagedFolderAssistant cmdlet multiple times, but it has not resolved the issue. Other users in my organization have the same retention policy and their online archives are working correctly. I have also tried changing the retention policy for the affected user to one that is known to work for other users, but this did not resolve the issue. I have tried running several cmdlets to gather more information about the issue, including Get-Mailbox | FL RetentionPolicy, Export-MailboxDiagnosticLogs -Identity -ExtendedProperties, Get-RetentionPolicy | FL Name, Get-RetentionPolicyTag, Get-ComplianceTag, Get-Mailbox | fl *hold*, Get-MailboxStatistics | fl ManagedFolderAssistantLastRunTime, Get-Mailbox -Archive | fl *, and Get-MailboxFolderStatistics -Archive | fl *. However, none of these cmdlets have helped me identify the cause of the issue. The output from these cmdlets appears to be normal and does not indicate any issues with the mailbox or the archive mailbox. One thing I noticed is that the Get-MailboxStatistics | fl ManagedFolderAssistantLastRunTime cmdlet does not return any output for any of my users, even though I have run the Start-ManagedFolderAssistant cmdlet multiple times. I am at a loss as to what could be causing this issue and would appreciate any suggestions or guidance on how to troubleshoot it further. Thank you
Microsoft 365 Outlook Classic Latest Update Copilot issues
Hello to all, we are currently using the Microsoft 365 Outlook Classic, using version Version 2604 Build 16.0.19929.20172 (Current Channel) Copilot works as expected; However ever since the next update was released (Version 2605 (Build 20026.20076)) some users including me, have been getting the below error: I have tried uninstalling and installing the latest version directly, with the same issue. Scanned for any corrupted system files with no issues,but still get the error; I have tried the update Licence from the Outlook application, with no issues but the copilot something went wrong error keeps on persisting. Internet searches are very vague and the I have found some registry suggestions which I have also tried with no solution. The only way to get Copilot working on Outlook Classic was to revert to a previous working version, only then Copilot works as expected. This only happens in Outlook Classic; Copilot works fine on the latest version of Microsoft Office 365 with Word, Excel, etc. For those that maybe might ask why not switch to the New Outlook, we have had issues with it and it has been recommended to use the Classic Outlook for the time being. Has anyone been experiencing such issues please? Thanks for any help.
Can't sign in to microsoft account
I'm locked out of my microsoft account simply because I don't have access to the Authenticator App. I recently performed a factory reset on my phone with the Authenticator App on and now I can't sign in to my account. I have tried the self help forums and I got a response email saying: "It looks like you just used the Microsoft account recovery form (account.live.com) to request a password reset for e**************email address removed for privacy reasons. Because you've turned on two-step verification for your account, we ignore these requests but wanted to let you know. If you're having trouble signing in, go to (account.live.com/ResetPassword) and reset your password using security info such as your phone, alternate email address, or authenticator app." It won't let me use my phone number when I select it as a sign in option. I have tried the recovery forms to no avail.
Google Workspace sender stuck at SCL=5 to all Microsoft-hosted recipients
Sending email from a new domain via Google Workspace. All mail to Microsoft-hosted recipients (both Outlook.com consumer accounts and Microsoft 365 Exchange Online tenants) is being routed to junk. Authentication passes perfectly on every message. This appears to be a domain reputation cold-start issue and I am looking for guidance on how to resolve it without waiting 2-4 weeks. Affected recipients are all Microsoft-hosted recipients tested (Outlook.com consumer + Microsoft 365 Exchange Online tenants). Please help me!!! Confirmed via X-MS-Exchange-Organization-SCL: 5 and delivery header dest:J;OFR:SpamFilterAuthJ;RF:JunkEmail on all test emails including ones with normal subject lines and body text. Content makes zero difference to the score. What has already been done: SPF hardened from ~all to -all DMARC upgraded from p=none to p=quarantine IP confirmed not listed on Microsoft's delist portal (sender.office.com) Domain confirmed not listed on Spamhaus DBL or SURBL Domain registered with Google Postmaster Tools JMRP enrollment attempted — not available to Google Workspace senders as SNDS requires IP ownership Outlook.com Postmaster support request submittedPrevent Microsoft 365 meeting invites from automatically appearing in users’ calendars
Hi All, We are trying to prevent Microsoft 365 meeting invites from automatically appearing in users’ calendars as Tentative until the user explicitly accepts the invite. Setting for Outlook Classic, New Outlook and Windows or Outlook Web. Need Microsoft recommendation on this one.Has anyone migrated from one Google Workspace to another after a company merger?
Hi all, Our company recently went through a merger and we now have two separate Google Workspace accounts that need to be consolidated into one. I need to move everything across, emails, contacts, calendars and tasks, for all users without anything getting lost in the process. Honestly not sure where to begin. Google's native tools seem limited for something like this and I don't want to start without a solid plan. Has anyone gone through a similar consolidation? How did you handle it and is there anything you wish you had known before starting?
