// shautech pulse · interactive demo · fictional tenant

Poke the report. Fix the tenant.

A hands-on demo of shautech pulse, our in-house audit engine: 200+ automated checks across identity, mail, endpoints and data, each mapped to the CIS Microsoft 365 Benchmark or a Microsoft security baseline. The tenant below is fictional; the findings are the ones we see in real audits every month.

Open a finding to see the evidence, then apply the fix and watch the score climb.

shautech pulse · report — demo.onmicrosoft.com scan complete

82/100

tenant compliance score

3 critical 7 warnings 204 passed

100/100 — tenant clean. That took you about a minute. On a real tenant this becomes a prioritised fix plan, and we do the heavy lifting with you.

  • what we saw
    Sign-in logs show IMAP and SMTP AUTH successes for 4 accounts in the last 30 days. These protocols bypass MFA entirely.
    why it matters
    Legacy protocols do not support MFA. Attackers use them to password-spray tenants: the front door has a lock, but this window is left open.
    the fix
    Block legacy authentication with a Conditional Access policy; migrate the 2 printers that still use SMTP AUTH to a relay.
    mapped to
    CIS M365 · identity — legacy authentication
  • what we saw
    adm-backup@ and adm-old-it@ sit in the exclusion group of the "Require MFA — admins" policy. One has not signed in for 97 days.
    why it matters
    Admin accounts are the highest-value targets in the tenant. A temporary exclusion from 2023 is exactly what an attacker hopes to find.
    the fix
    Remove both accounts from the exclusion group; disable the dormant account; keep exactly one documented, monitored break-glass account.
    mapped to
    CIS M365 · identity — admin MFA
  • what we saw
    SSPR is set to None. Every forgotten password becomes a helpdesk ticket and a social-engineering opportunity.
    why it matters
    Password resets over the phone are how attackers impersonate employees. SSPR with MFA verification is both safer and cheaper.
    the fix
    Enable SSPR for all users with two verification methods; pair it with password writeback for hybrid accounts.
    mapped to
    Microsoft baseline · identity — SSPR
  • what we saw
    DNS lookup for _dmarc.demo-client.com returns no record. SPF exists; DKIM signs only the onmicrosoft domain.
    why it matters
    Without DMARC, anyone can send mail as your domain: to your customers, your suppliers and your own finance team.
    the fix
    Enable DKIM for the custom domain, publish DMARC at p=none, review reports for 2 weeks, then move to p=quarantine.
    mapped to
    CIS M365 · mail — DMARC / DKIM / SPF
  • what we saw
    12 shared mailboxes created before 2019 have AuditEnabled: false. Actions on them leave no trail.
    why it matters
    When something goes wrong in a mailbox nobody audits, the investigation ends without answers. Auditing is free; hindsight is not.
    the fix
    Re-enable auditing on all 12 mailboxes and confirm the organisation-wide auditing default is on.
    mapped to
    CIS M365 · mail — mailbox auditing
  • what we saw
    The outbound spam policy allows automatic forwarding; 3 mailboxes currently forward to personal gmail.com addresses.
    why it matters
    Auto-forwarding to private mailboxes is the quietest data leak there is, and the first thing attackers configure after a takeover.
    the fix
    Set automatic forwarding to Off in the outbound spam policy; approve legitimate cases per mailbox.
    mapped to
    CIS M365 · mail — external forwarding
  • what we saw
    34 devices have not checked in for 90+ days, including 6 marked compliant that no longer exist.
    why it matters
    Stale devices distort Conditional Access decisions and licensing counts, and a "compliant" ghost laptop is a blind spot.
    the fix
    Run a device clean-up: disable at 90 days of inactivity, delete at 180, and automate it on a schedule.
    mapped to
    Microsoft baseline · endpoints — device hygiene
  • what we saw
    Intune reports 61 of 152 devices where the primary user is a member of the local Administrators group.
    why it matters
    Malware runs with the rights of the user who clicked it. Local admin everywhere turns one bad click into a device rebuild.
    the fix
    Remove standing local admin via Intune policy; use LAPS for the break-glass local account and elevate on demand.
    mapped to
    CIS M365 · endpoints — least privilege
  • what we saw
    3 Teams, including FIN-budget, allow guests with no expiry and no review. 9 guest accounts have never signed in.
    why it matters
    Guests invited for one project in 2022 still read everything today, and nobody remembers who they are.
    the fix
    Enable guest access reviews with automatic removal on denial, and set guest expiry on the sensitive Teams.
    mapped to
    CIS M365 · data — guest access
  • what we saw
    SharePoint sharing is set to Anyone; 214 active anonymous links exist, 17 of them to spreadsheets in the finance site.
    why it matters
    An "Anyone" link does not care who holds it. Forwarded once, it is public, and it never shows up as a breach.
    the fix
    Lower the tenant default to New and existing guests, expire existing anonymous links, and allow exceptions per site.
    mapped to
    CIS M365 · data — sharing links
  • PASS BitLocker enforced on all managed endpoints
  • PASS Security defaults / CA baseline — MFA required for users
  • PASS Versioning enabled on all SharePoint sites
  • PASS Safe Attachments policy active for all mailboxes
214 checks · CIS M365 benchmark · 4m 12s next scan → scheduled monthly

How shautech pulse works

01 · scan — consistent

200+ checks, zero opinions.

pulse reads the actual configuration of your tenant — identity, mail, endpoints, data — and maps every check to a CIS Benchmark or Microsoft baseline control.

02 · fix — evidence-backed

Findings come with fixes.

Every finding links to the exact setting we saw and the exact change that closes it — prioritised, so you fix what attackers try first.

03 · re-scan — re-runnable

The score keeps you honest.

pulse re-runs monthly and alerts on drift. One number your whole business understands, tracked quarter over quarter.

// first scan free · no agents installed · read-only access

Now imagine this on your tenant.

The demo tenant is fictional; yours is not. The first scan is free with the discovery call, and you keep the report either way.

Get your tenant scored → contact@shautech.com Read-only access · nothing installed · report is yours to keep