I built a free, open-source M365 security assessment tool - looking for feedback
I work as an IT consultant, and a good chunk of my time is spent assessing Microsoft 365 environments for small and mid-sized businesses. Every engagement started the same way: connect to five different PowerShell modules, run dozens of commands across Entra ID, Exchange Online, Defender, SharePoint, and Teams, manually compare each setting against CIS benchmarks, then spend hours assembling everything into a report the client could actually read. The tools that automate this either cost thousands per year, require standing up Azure infrastructure just to run, or only cover one service area. I wanted something simpler: one command that connects, assesses, and produces a client-ready deliverable. So I built it. What M365 Assess does https://github.com/Daren9m/M365-Assess is a PowerShell-based security assessment tool that runs against a Microsoft 365 tenant and produces a comprehensive set of reports. Here is what you get from a single run: 57 automated security checks aligned to the CIS Microsoft 365 Foundations Benchmark v6.0.1, covering Entra ID, Exchange Online, Defender for Office 365, SharePoint Online, and Teams 12 compliance frameworks mapped simultaneously -- every finding is cross-referenced against NIST 800-53, NIST CSF 2.0, ISO 27001:2022, SOC 2, HIPAA, PCI DSS v4.0.1, CMMC 2.0, CISA SCuBA, and DISA STIG (plus CIS profiles for E3 L1/L2 and E5 L1/L2) 20+ CSV exports covering users, mailboxes, MFA status, admin roles, conditional access policies, mail flow rules, device compliance, and more A self-contained HTML report with an executive summary, severity badges, sortable tables, and a compliance overview dashboard -- no external dependencies, fully base64-encoded, just open it in any browser or email it directly The entire assessment is read-only. It never modifies tenant settings. Only Get-* cmdlets are used. A few things I'm proud of Real-time progress in the console. As the assessment runs, you see each check complete with live status indicators and timing. No staring at a blank terminal wondering if it hung. The HTML report is a single file. Logos, backgrounds, fonts -- everything is embedded. You can email the report as an attachment and it renders perfectly. It supports dark mode (auto-detects system preference), and all tables are sortable by clicking column headers. Compliance framework mapping. This was the feature that took the most work. The compliance overview shows coverage percentages across all 12 frameworks, with drill-down to individual controls. Each finding links back to its CIS control ID and maps to every applicable framework control. Pass/Fail detail tables. Each security check shows the CIS control reference, what was checked, what the expected value is, what the actual value is, and a clear Pass/Fail/Warning status. Findings include remediation descriptions to help prioritize fixes. Quick start If you want to try it out, it takes about 5 minutes to get running: # Install prerequisites (if you don't have them already) Install-Module Microsoft.Graph, ExchangeOnlineManagement -Scope CurrentUser Clone and run git clone https://github.com/Daren9m/M365-Assess.git cd M365-Assess .\Invoke-M365Assessment.ps1 The interactive wizard walks you through selecting assessment sections, entering your tenant ID, and choosing an authentication method (interactive browser login, certificate-based, or pre-existing connections). Results land in a timestamped folder with all CSVs and the HTML report. Requires PowerShell 7.x and runs on Windows (macOS and Linux are experimental -- I would love help testing those platforms). Cloud support M365 Assess works with: Commercial (global) tenants GCC, GCC High, and DoD environments If you work in government cloud, the tool handles the different endpoint URIs automatically. What is next This is actively maintained and I have a roadmap of improvements: More automated checks -- 140 CIS v6.0.1 controls are tracked in the registry, with 57 automated today. Expanding coverage is the top priority. Remediation commands -- PowerShell snippets and portal steps for each finding, so you can fix issues directly from the report. XLSX compliance matrix -- A spreadsheet export for audit teams who need to work in Excel. Standalone report regeneration -- Re-run the report from existing CSV data without re-assessing the tenant. I would love your feedback I have been building this for my own consulting work, but I think it could be useful to the broader community. If you try it, I would genuinely appreciate hearing: What checks should I prioritize next? Which security controls matter most in your environment? What compliance frameworks are most requested by your clients or auditors? How does the report land with non-technical stakeholders? Is the executive summary useful, or does it need work? macOS/Linux users -- does it run? What breaks? I have tested it on macOS, but not extensively. Bug reports, feature requests, and contributions are all welcome on GitHub. Repository: https://github.com/Daren9m/M365-Assess License: MIT (free for commercial and personal use) Runtime: PowerShell 7.x Thanks for reading. Happy to answer any questions in the comments.
Office365 Autoupdate on Mac
Last week I had an issue with Autoupdate on Microsoft365 where OneNote failed to update, other app were fine. I tried selecting just this app and updating it but got a download error. Autoupdate indicates "some apps have encountered errors" and retrying just repeats the download error. I've tried machine based fixes but none have worked and I suspect it's something else as I have a Mac mini and MacBook doing the same along with my wife who has a Mac desktop. The issue is still the same a week on.
Shortcuts appearing when using Option+arrow in Outlook on Chrome in Mac
luse Outlook on Chrome in my MacBook Pro. While typing an email, though, if I use Option tarrow left or right (to go back or forth between words), after a few words, the shortcut letters for the menus pop up, and stop what I'm doing. (See image.) It doesn't happen in any other window on Chrome. So it's not a Chrome thing. It's only when Outlook 365 is loaded. (Don't know if it happens in other 365 apps, as I only use Outlook, really.) Anyone experienced that? And, if so, is there a solution? I tried Outlook 365's setting, but nothing there. Thanks!Import Contact List
I use Outlook for mac with a 365 email account with my domain name. I am trying to set up a "Contact List". This is not to confused with my list of contacts. The is a distribution list. This feature is only pin New Outlook. I have the names and email addressed in CSV format. I tried to import. The results say "No records imported" or "failed to import". I have tried it with and without column headers. there name format is First Last. Sugestions appreciated.Cannot update M365-Mac to 16.105.1?
Anyone else having an issue with this? Current Channel-Preview update (only 25-30MB per update) is failing with Outlook and Word (previously, PPT and XLS were fine). It takes forever to update ... then fails. Note that another computer which previously (early last week?) was fine. "Solution" is changing to beta channel (which comes with risk) to bypass and go direct to 16.106 (which updates fine/super fast; under 2 minutes). Doesn't matter internet connection and attempted to do this over a period of 4 days - tried hotel (duh), hotspot (less duh - 250-600mbps), Starlink (400+ Mbps) and home fiber (2Gbps).Web-Addins stopped working for Office apps version 16.100 for Mac
Dear experts, Since version 16.100, the web add-in functionality has stopped working with the Office apps for Mac (PowerPoint, Word and Excel). In may case, Templafy web add-in is not being loaded. According to Templafy's support page: https://support.templafy.com/hc/en-us/articles/29028257609501-Templafy-Web-Add-ins-no-longer-accessible-on-Mac-after-Microsoft-Office-update-16-99 this seems to be a bigger issue. Clearing web add-in cache or deleting the WEF folder will not resolve the issue. I have also tried with a full clean uninstallation of Office365 apps and re-installation, same issue. Note that New Outlook for Mac is not affected, just PowerPoint, Excel and Word.Outlook MacOS - Email-section display issue
Since the latest Outlook update for MacOS - Version 16.105 (25120324) - there is a display error in the email-section. There is a large empty space between the "Search"-Header and the "Email"- Header This issue only occurs in the email section. All other areas (Calendar, Contacts, etc.) are looking normal:macOS - duplicate OneDrive file storage
The files in my macOS (Sequoia 15.6.1, M2 MacBook Air, Microsoft 365 Family) OneDrive folder at /Users/XXX/Library/CloudStorage/OneDrive-Personal/ use 111 GB of hard drive space. The exact same files appear in /Users/XXX/Library/Group Containers/UBF8T346G9.OneDriveStandaloneSuite/OneDrive.noindex/OneDrive/, consuming another 111 GB of storage space. Is this really the case, and if so, WHY? Could one set of files just be APFS clones, and if so, how to verify this? The Finder as well as apps GrandPerspective and OmniDiskSweeper seem to suggest that both groups of identical files are consuming real hard drive space. Thoughts?PowerPoint for Mac - Embed font settings in broken if long file name
Dear experts, Since two versions back, the EMBED FONT setting is not shown in the SAVE part of the Preferences window. This is really irritating and the only way to make it show up is to rename files all the time. Before the file name was truncated and after a number of characters, it was just ... (Example: Filename_long...) I hope that Microsoft can fix this ASAP.Outlook for Mac - Upload and Share is not working as access "Recipients of this message" is missing
New Outlook for Mac has since some versions back gotten the feature where the user can upload a file and share it to the recipients of the e-mail. The file will be per default be uploaded to DOWNLOAD folder in OneDrive. Now this is not working on Outlook for Mac as the whole access permission Recipients of this message" is missing. On Windows and Outlook on Web, this is available, but not for New Outlook for Mac. It seems that this feature is not yet fully developed on Outlook for Mac. Any others that see the same and can confirm?
