Microsoft 365 / Entra ID
Conditional Access, MFA, Privileged Identity Management, DLP, Defender, SharePoint/OneDrive sharing, legacy protocols.
M365 · AWS · Azure · GCP · CIS Benchmarks v3.0
Request baseline →
Cloud security · CIS Benchmarks · M365 · AWS · Azure
Cloud security: misconfiguration, not exotic exploits.
Almost every cloud breach starts with something that should have been closed. A bucket, a role, a missing conditional access policy. We review the full configuration set against CIS Benchmarks — not just what Secure Score surfaces. And we close first what actually matters first.
Most cloud breaches start with a misconfiguration, not an exotic exploit. KodeX GRC reviews Microsoft 365, AWS, Azure and GCP against the CIS Benchmarks, delivers quick wins within 48 hours and a full report with remediation in 3–4 weeks.
What it covers
Six control categories. We don't do "cloud security" in general — we review specific settings with specific evidence, mapped to CIS Benchmarks.
Amazon Web Services
IAM policies, S3, CloudTrail, GuardDuty, Security Hub, VPC networking, KMS, Organizations, SCPs.
Microsoft Azure
Entra ID, RBAC, Key Vault, NSGs, Defender for Cloud, Azure Policy, logging, subscription governance.
Identity & access
Federation, SSO, privileged roles, service accounts, break-glass accounts, credential lifetimes.
Data & encryption
Classification, encryption at rest and in transit, key management, external sharing.
Logging & detection
What logs, how long they're kept, who can view them, alerting rules, SIEM integration, retention policy.
Who it's for
For organisations that have moved to the cloud — or are mid-migration — and have not verified whether their security settings match their real exposure.
The rule: if you haven't reviewed your cloud settings since the day you enabled them, there are deviations from baseline. This isn't a capability issue for your team — it's a scale issue. M365 has over 3,000 security settings. AWS has more.
Microsoft Secure Score is a useful starting point but not sufficient. It covers around 60% of CIS controls, with varying depth, and doesn't examine settings outside your tenant at all.
M365-heavy organisations — email, SharePoint, Teams, OneDrive
AWS or Azure with production workloads
Migration in progress — before the production environment goes live
Hybrid with on-prem to cloud connectivity via Entra Connect
Anyone with an audit finding on A.8 cloud controls or NIS2 Art. 21.2.e
How we work
Four phases. Scoping includes read-only access to all tenants and subscriptions — without it, the review is superficial.
Discovery
What you have and what's exposed
Inventory of tenants, subscriptions, roles, service principals, exposed resources. Mapping the real footprint — not what the CMDB claims.
3 daysCIS-based review
Not just Secure Score
Every CIS Benchmark control reviewed per platform. Gap analysis with owners, justification, and exposure level per finding.
1–2 weeksPrioritisation
What to fix first
By exposure and effort. Quick wins (48 hours) separated from structural changes (4 weeks). Every finding has a specific action.
2 daysRemediation support
Not just a report
We sit with you and fix it, or we give you step-by-step instructions — your choice. Either way, we don't hand over a PDF and walk out.
OptionalShared responsibility model
Where the provider's responsibility ends and yours begins. It's the most frequently misunderstood point in the cloud — and where most breaches live.
Layer
SaaS · M365
PaaS · Azure App Service
IaaS · AWS EC2 / Azure VM
Data & identitiesClassification · Permissions · MFA
You
You
You
ApplicationCode · Configuration · Vulnerabilities
You
You
You
Runtime & middlewareFrameworks · Containers · Hosting
Provider
Shared
You
Operating systemPatching · Hardening · Antivirus
Provider
Provider
You
NetworkFirewalls · NSGs · Segmentation
Provider
Shared
Shared
Physical securityDatacenters · Hardware · Perimeter
Provider
Provider
Provider
Why this matters: in SaaS you own 100% of identity and data controls —
that's 80% of your exposure. In IaaS you add the operating system. Either way,
the provider does not secure your data — it secures the infrastructure
you place it on.
Sample finding
Two real findings from one of our reports — anonymised. One closes in 48 hours, the other requires structural change. Both have a specific action.
- Description
- The tenant has active Conditional Access policies requiring MFA — but
AllowLegacyAuthis still enabled at the tenant level and on 3 mailbox policies. Legacy authentication does not support MFA and bypasses all policies. Result: a credential stuffing attack with a stolen password succeeds without a second factor. - Evidence
- Sign-in logs show 247 successful sign-ins via IMAP/POP3 over the last 90 days from 14 different IPs — none with an MFA challenge. The IPs do not belong to the organisation.
- Impact
- Complete MFA bypass. Any stolen credential — from phishing, credential stuffing, or a third-party leak — gives immediate access to email, SharePoint, Teams. Triggers a GDPR notification obligation if it has already happened.
- Remediation
- Quick win · 48h Disable legacy authentication at tenant level, update the 3 mailbox policies, enable Authentication Policy in Entra ID. Check for active clients still using IMAP/POP3 — usually old scanners or scripts that get replaced with modern auth.
- References
- CIS Microsoft 365 v3.1 · 5.2.2 · Microsoft Entra ID · CA-EX-001
- Description
- Service principal
sp-deploy-prodhas Owner role on the production subscription and a client secret expiring in 2 years. The secret is stored in an Azure DevOps variable group with access for 14 people. There is no rotation policy. - Impact
- One leaked secret = full control of the production subscription. No exploit required — just use the secret. This is the most common cloud breach pattern: identity compromise, not software exploit.
- Remediation
- Structural · 3 wks Migrate to workload identity federation (OIDC) instead of a client secret — eliminates the secret entirely. If not feasible, least privilege (Contributor on a resource group, not Owner on a subscription), monthly rotation, Key Vault instead of DevOps variables, break-glass monitoring on every use.
- References
- CIS Microsoft Azure Foundations v2.0 · 1.21 · 1.22 · Microsoft Cloud Security Benchmark IM-3
What you get
Six deliverables covering remediation, not just the report. None of them are documents you'll have to write yourself afterwards.
CIS gap analysis reportEvery CIS control with status, exposure level, justification and recommended action.
Prioritised remediation listQuick wins (48 hours), mid-term (2 weeks), structural (4 weeks) — with time and risk estimates.
Architecture recommendationWhere there's a fundamental flaw, not just a setting — e.g. a subscription that needs to be split.
Policies & baselinesReady to apply to new subscriptions/tenants — so the same exposure doesn't reappear.
Tracking dashboardWhich findings close, which stay open, assigned to whom — with SLA per exposure level.
Technical team debriefNot just a PDF — walkthrough, Q&A, discussion of the remediations.
Timeline — 3 to 4 weeks
Typical engagement for one M365 tenant plus one AWS or Azure subscription. Multiple tenants or larger footprints add time proportionally.
WK 01
Discovery
Inventory, read-only access, mapping of tenants/subscriptions/roles.
WK 02–03
CIS review
Every control per platform, finding documentation, exposure assessment.
WK 03
Prioritisation
Ranking, action plan, quick wins separated from structural, debrief.
+2–4 wks
Support
Optional — fix with you, verification, settings retest.
Frequently asked
The questions we hear before taking on a cloud settings review.
We already have Microsoft Secure Score. Do we still need a CIS review?
Secure Score is a useful starting point, but it doesn't cover everything. It covers roughly 60% of CIS controls, with varying depth, and doesn't examine settings outside your tenant at all (for example, third-party SaaS apps with access to M365 data). It also doesn't tell you which findings represent real exposure — that's the triage we do.
How much access do you need for a cloud review?
Read-only at tenant/subscription level for the review. For M365: Global Reader role. For AWS/Azure: SecurityAudit or an equivalent custom role with read-only permissions. If we take on remediations, we discuss a specific scope separately — usually these are done by you with our instructions. We never ask for more than what's required.
Will applying the remediations break anything?
Not if done in sequence. The quick wins are safe — disable legacy auth, enable logging, MFA on privileged accounts. The structural ones change behaviour and need testing — which is why we separate them. And for each finding we give a specific action and expected impact, not a general recommendation.
Is a cloud review covered by ISO 27001?
Partly. A.8.1 (user endpoint devices) and A.8.9 (configuration management) cover configuration review at a principle level, but in practice auditors ask for specific cloud configuration evidence. The CIS report is the ideal evidence — it shows measurement, deviation, corrective action. If you have ISO 27001, the cloud assessment fills a gap that often stays open.
How much does a cloud configuration review cost?
It depends on the number of tenants/subscriptions and scope (M365 only, or also AWS/Azure). A typical M365 plus one cloud subscription engagement is a fixed price after scoping. Larger footprints are priced per subscription. We don't quote before seeing the actual footprint — because "cloud assessment" can mean five hours or fifty hours of work.
Related services
A cloud assessment rarely stands alone. It usually combines with the following, because they share findings, evidence and technical depth.
05 · Pentest
Cloud pentest
A cloud pentest examines configuration from the attacker's viewpoint — with attempted exploitation, not theory.
06 · VAContinuous monitoring
After remediation, continuous scanning maintains the state — and exploitability-based prioritisation sets the order.
01 · ISO 27001A.8.1 · A.8.9
The configuration evidence auditors ask for — measurement, deviation, remediation, verification.
Get started
Tell us your cloud footprint.
In one short call — 10 minutes — we define the scope together: which tenants and subscriptions enter the review, and the timeline. You get a baseline exposure report with quick wins in 48 hours after completion of the review. No commitment.
No commitment
Confidential
Read-only access