Published, in full
What a Microsoft 365 security assessment costs
Fixed fees, banded by which workloads we assess, published before you speak to anyone. Every band is expert-led, CIS-benchmarked and ends with a prioritised roadmap and a debrief. No quote theatre.
Core Tenant
Identity, email and the baseline
REPLACE_WITH_PRICE_BAND_1
one-off, fixed, ex VAT
- Entra ID: roles, accounts, sign-in policies
- Conditional Access and MFA coverage
- Exchange Online and email protection
- Audit logging configuration
- Secure Score, benchmarked
- Prioritised remediation roadmap + debrief
Most assessed
Tenant + Collaboration
Everything in Core, plus your data workloads
REPLACE_WITH_PRICE_BAND_2
one-off, fixed, ex VAT
- Everything in Core Tenant
- SharePoint and OneDrive sharing review
- Teams configuration and guest lifecycle
- External collaboration and anonymous links
- Data exposure walkthrough with your team
Full Estate
The complete Microsoft security stack
REPLACE_WITH_PRICE_BAND_3
one-off, fixed, ex VAT
- Everything in Tenant + Collaboration
- Intune device compliance and policies
- Microsoft Defender suite configuration
- Purview: retention, DLP and sensitivity labels
- Board-ready risk narrative and presentation
Assumptions, stated plainly
Prices are per tenant, exclude VAT and include scoping, the assessment, the report, the debrief and one remediation re-test. Read-only access is required; nothing is changed. The Azure estate is a published add-on to any band. Multi-tenant groups and unusually complex estates are quoted, and we say so rather than stretch a band that does not fit.
The market, for comparison
What this work costs elsewhere
Most UK firms quote this work privately. Where public figures exist, they are day rates on the government's Digital Marketplace: Microsoft 365 assessment listings cluster between £850 and £1,250 per consultant day, with the common productised shape running three to four days. That implies a market price of roughly £2,550 to £5,000 for a comparable engagement, reached only after you ask.
Our view is simpler: the number you would eventually be quoted belongs on the page.
Free scans, plainly placed
Microsoft's Zero Trust assessment, CoreView's scanner and similar free tools compare your settings against a baseline in minutes, and if you want a quick temperature check they are a reasonable place to start. They do not interpret findings in your context, rank them by risk to your business, or help your team fix them in the right order. When the list arrives and the question becomes "which of these forty items matters?", that is the assessment.
Our free-tools comparison, in depthQuick answers
Pricing questions, answered
Why publish prices when nobody else does?
Because the quote-only convention serves sellers, not buyers. An assessment is a well-bounded piece of work: we know what each scope band takes, so you should know what it costs before the first conversation. The same policy runs across every CyPro specialist service.
Why do the bands go by workloads rather than user count?
Because the work does. A 50-user and a 500-user tenant have near-identical configuration surfaces; what changes the effort is which workloads are connected and reviewed. Seat-based pricing is how software is sold, and this is expertise, not software.
Where does the Azure assessment fit?
As a published addition to any band, priced by the size of the Azure estate: REPLACE_WITH_PRICE_AZURE. The identity layer is assessed once and shared, which is why combining them costs less than two separate engagements.
How does this compare to a free assessment tool?
Free scanners are genuinely useful and we say so: they compare settings against a baseline in minutes. What they do not do is interpret findings for your business, rank them by real risk, walk your team through remediation or stand behind the result. The comparison section below is clear about when the free scan is enough.
What do the annual review and re-test cost?
The annual review is priced below the equivalent first assessment because your baseline already exists: REPLACE_WITH_PRICE_REVIEW by band. A remediation re-test after your fixes is included in every band at no charge.
You already know the price
Confirm your band in one call
A free 45 minute scoping call confirms which workloads are in scope and books the assessment at the published fee. No negotiation required, none attempted.