Framework-driven security
for your M365 tenant
Calibrant's M365 Security Baseline and a November 19, 2024 CISA SCuBA snapshot. Auto-detect from M365. Add manual evidence, including permitted control-specific compensating safeguards. Get a score that reflects your actual posture — not just what Microsoft can see.
The problem
Compliance frameworks in a spreadsheet
Many organizations run compliance from a long spreadsheet, manually checking boxes once a year. The spreadsheet doesn't know your M365 configuration. It doesn't know you use Okta. And it's out of date the moment you close it.
The solution
Living assessments, not annual audits
Calibrant auto-detects what its approved collectors can prove, then guides manual validation with full context. Eligible third-party safeguards record a tool, notes, evidence, and an expiry. The score updates live as you work. Re-scan anytime to refresh the M365-detectable controls. Attestations persist.
PIM assignments, recurring access reviews, and Purview label and DLP coverage now reuse the same read-only relay evidence as Tenant Healthcheck. A hybrid control still asks you to confirm scope, policy quality, or an eligible third-party safeguard; that context can complete partial evidence but cannot erase a machine-confirmed failure.
Protocol
How it works
Assess, scan, attest — continuously.
Choose Framework
Start an M365 Baseline, CISA SCuBA, or Essential Eight assessment. All controls load instantly — pending until evaluated.
Run Scan
The relay auto-detects 94 baseline controls and 68 controls in the bundled SCuBA snapshot directly from your M365 configuration.
Document Manual Evidence
Validate manual controls, and document eligible control-specific third-party safeguards with evidence and a review date.
Supported frameworks
Start one or both. Assessments are independent, controls cross-referenced.
M365 Baseline v1.0
Calibrant M365 Security Baseline
Prescriptive, independently authored guidance — every control is a specific M365 setting, with informational CIS M365 v6 and CISA SCuBA references where Calibrant has mapped an alignment.
140
total controls
94
auto-detected
L1 + L2
levels / tiers
CISA SCuBA
CISA SCuBA M365 Security Baselines
Calibrant's November 19, 2024 snapshot of CISA's Secure Cloud Business Applications baselines for Microsoft 365. Product-specific controls; more are organisational, so more are attested rather than scanned.
134
total controls
68
auto-detected
Per-product
levels / tiers
Essential Eight
ACSC Essential Eight
The Australian Signals Directorate's eight mitigation strategies, tracked to their cumulative maturity levels. Requirements span the whole IT estate, so scans verify the Microsoft slice and attestation covers the rest — the achieved maturity level follows ACSC's own every-strategy rule.
150
total controls
29
auto-detected
ML1–ML3
levels / tiers
Built for real compliance programs
Not a checklist. A working assessment system.
Calibrant M365 Security Baseline
140 controls mapped to M365 security requirements, with informational CIS M365 v6 references where Calibrant has mapped an alignment. Level 1 (minimum recommended) and Level 2 (high-security). 94 controls currently have an automatic check.
CISA SCuBA M365 Baselines
134 controls in Calibrant's November 19, 2024 SCuBA snapshot across M365 products including Entra ID, Defender, Exchange, Power Platform, SharePoint, OneDrive, and Teams. Related baseline references are shown for traceability.
Third-Party Attestation
For an explicitly eligible control, document an equivalent Okta, Duo, CrowdStrike, or other safeguard with evidence. It is shown as compensated, never as a native Microsoft pass, and must be reviewed again before it expires.
Evidence + Context, One Verdict
Calibrant freezes Microsoft evidence and required administrator context together. Each control contributes one verdict; unlicensed controls are excluded, and missing required context never becomes a favorable partial score. Attestations persist without rewriting older audits.
No Stored Microsoft Credentials
M365 collection runs through the relay's Managed Identity. The relay stores a rotatable Calibrant API key, but no Microsoft password, client secret, service account, or tenant OAuth token.
Audit-Ready PDF Export
Download any current assessment as a professionally composed PDF — per-control scan evidence with timestamps, attestation provenance, licensing decisions, and the full change history — on every plan, alongside CSV export. Reports are review aids, not certifications, and always render from the current ruleset.
Every control has a clear status
Score = (Auto Pass + Attested) / (Total − N/A) × 100
Your MFA might be Okta. We know.
Baseline control CAL-IDN-022 requires MFA enforced for all users via Conditional Access. But if your MFA runs through Okta or Duo, the M365 check fails — even though your posture is fine.
When that exact control is marked as eligible for compensation, Security Baseline can record “MFA enforced by Okta SSO — all users enrolled”with the tool, evidence reference, reviewer, and expiry. The Microsoft check still shows its native result; the audit export labels the overall credit as compensated.
Ready to know where you stand?
Pick a framework, review its license and integration prerequisites, run a scan, and document the manual controls that apply to your organization.