Microsoft 365 guest & sharing lockdown
Know who outside your business can reach your data.
Most Microsoft 365 tenants have never had their guest access reviewed: open links, guests who can invite guests, old accounts nobody remembers. We find it and close it in a day, without breaking client access or contract signing.
What we check
Every way outsiders reach your Microsoft 365
Sharing links
Whether anyone with a link can open your files, what new links default to, and whether old Anyone links ever expire.
Guest accounts
Every outside account in your tenant: who is active, who hasn’t signed in for months, and who must be protected.
Who can invite guests
Whether staff, admins or even guests themselves can bring new outsiders in, and whether that still lets your team work.
What guests can see
Whether a guest can browse your staff list and groups, or only what was shared with them.
Site-by-site sharing
Every SharePoint site’s sharing level, so internal sites stay internal and client spaces stay open to the right people.
Email leaving the business
Mailboxes that forward automatically to outside addresses, and whether your tenant allows it at all.
Guest sign-in rules
Whether guests must use multi-factor authentication, and whether any policy is quietly locking out signers and clients.
Built not to break what works
Tighter security that your clients won’t notice
The usual way to lock down Microsoft 365 also locks out the people you work with. Ours is designed around your client portals, shared sites and contract signing, and the protections are built into our tooling, not left to memory on the day.
- Nothing changes without your written approval
- Sharing is never set below what eSignature needs
- Your staff can still invite new client contacts
- Client portal guests keep their access, with no expiry timers
- Recent signers and client portal members are never removed
- Every change is recorded, and can be undone
How it works
One day, four steps
Read-only audit
We sign in with read-only access and assess your tenant. Nothing is changed. You receive a branded findings report.
Review call
A 30-minute walkthrough. You choose which fixes to make; anything that depends on how you work, we confirm with you first.
Fix session
We apply only the approved changes, one at a time, checking client access and contract signing straight after the sensitive ones.
After report and handover
A second audit shows the result, alongside a record of every setting changed. Our temporary access is removed.
We ran it on ourselves first
Our own tenant, before and after
Before: four recommended fixes and three sites open to external sharing. After: none, with client portal access and contract signing tested and working throughout. You get the same two reports for your business.
Lockdown questions
Will our clients lose access to anything?
No. Client portals, shared sites and signing are protected by design: the recommendations never lower sharing below what they need, and before any internal site is closed we check it has no guest users. We test client access during the fix session.
Do you need admin access to our tenant?
The audit only needs read-only access (Global Reader). The fix session needs temporary admin roles, or your admin can drive while we guide on a screen-share. We don’t install apps in your tenant, and our access is removed at the end.
Do you delete guest accounts?
Only the ones you approve, and only after checking they have no open signing request. Removed accounts are soft-deleted, so they can be restored for 30 days.
What if we don’t have Microsoft 365 Business Premium?
The audit still works. Without Business Premium, Microsoft doesn’t provide guest sign-in dates, so we judge activity from invitation status and account age, and the report says so.
Can a change be undone?
Yes. Every change records its previous value, who made it and when, and each one can be reversed from that record.
How is this different from your Cloud Security service?
The lockdown is a narrow, one-day fix for external access. Cloud Security ($1,200) is broader: Conditional Access, admin roles, legacy sign-in and a full security baseline. The lockdown report is often where that conversation starts.
Find out who else can see your files
Book a free 30-minute call. We’ll talk through how you share with clients and partners, and give you a fixed quote for the lockdown.
Book a free call →From $590 · Brisbane QLD · Serving all of Australia