What a Microsoft 365 security engagement includes
A Microsoft 365 security consulting engagement with EPC Group covers three layers, worked in a fixed order: identity controls in Microsoft Entra ID, threat protection in Microsoft Defender XDR, and data protection in Microsoft Purview. Microsoft Secure Score is the instrument that ties them together, because it is Microsoft's own measurement of an organization's security posture across identities, apps, devices and data, read from a single dashboard in the Microsoft Defender portal (Microsoft Learn, Microsoft Secure Score, accessed 2026-10-20). The order is deliberate. Identity is first because every Defender and Purview control assumes the person signing in is who they claim to be; data protection is last because labels and DLP only hold if access to the tenant is already controlled.
What a Microsoft 365 security assessment should include
An assessment that stops at a Secure Score screenshot is not an assessment. EPC Group's assessment phase produces five artifacts:
- Secure Score baseline. The current score, the recommended-action list with status, and the point breakdown by Identity, Device, Apps and Data. Microsoft ranks recommended actions by points remaining, implementation difficulty, user impact and complexity (Microsoft Learn, Assess your security posture with Microsoft Secure Score, accessed 2026-10-20), and that ranking becomes the first draft of the remediation order.
- Conditional Access coverage. Which applications have policy coverage and which do not. The Conditional Access overview in the Microsoft Entra admin center shows enabled versus report-only policies and a Coverage tab for applications with and without policy over the past seven days (Microsoft Learn, What is Conditional Access?, accessed 2026-10-20).
- Defender product inventory. Which of Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and Defender Vulnerability Management the tenant is licensed for, since Defender XDR correlates signals only from the products the organization has licensed and provisioned (Microsoft Learn, What is Microsoft Defender XDR?, accessed 2026-10-20).
- Purview state. Whether sensitivity labels exist and are published, whether any DLP policies are active, and what audit retention is in effect. Audit (Standard) retains records for 180 days; Audit (Premium) retains Exchange, SharePoint, OneDrive and Entra records for one year for licensed users (Microsoft Learn, Manage audit log retention policies, accessed 2026-10-20).
- Risk register. Findings that cannot be fixed by configuration alone, such as legacy applications that require basic authentication, written up with an owner and a decision date.
Scope of the Entra, Defender and Purview work
Entra ID. EPC Group enforces multifactor authentication for administrators and users, blocks legacy authentication, and builds Conditional Access policies that require compliant or hybrid-joined devices for sensitive applications. Microsoft lists these among the policies organizations commonly apply and notes that Conditional Access requires a Microsoft Entra ID P1 license, with risk-based policies requiring Entra ID P2 (Microsoft Learn, What is Conditional Access?, accessed 2026-10-20). Standing administrator assignments are then moved into Privileged Identity Management for time-bound activation.
Defender XDR. Defender XDR is a unified pre- and post-breach suite that coordinates detection, prevention, investigation and response across endpoints, identities, email and applications, with a combined incidents queue, automatic attack disruption, self-healing for compromised assets, and query access to 30 days of raw signal data for hunting (Microsoft Learn, What is Microsoft Defender XDR?, accessed 2026-10-20). EPC Group configures each licensed product, then tests the cross-product behavior, for example that a file blocked on an endpoint is also removed from mailboxes, rather than assuming the integration is on.
Purview. The data layer starts with a sensitivity label taxonomy. Microsoft's guidance is to keep the label set small, noting that effectiveness drops when users face more than five main labels or more than five sublabels per label (Microsoft Learn, Learn about sensitivity labels, accessed 2026-10-20). DLP policies are then designed from a policy intent statement and deployed in simulation mode, where actions are not applied, before moving to restrictive modes (Microsoft Learn, Learn about data loss prevention, accessed 2026-10-20). EPC Group's Microsoft 365 consulting practice runs this work; where the estate extends into Azure workloads, the Azure consulting practice brings Defender for Cloud into the same incident queue.
What the first 30 days deliver
- Secure Score baseline and a written target with the actions chosen to reach it.
- Conditional Access policy set in effect, with report-only policies converted after review and a coverage report.
- Defender products configured, with cross-product actions verified and the incidents queue reviewed daily.
- Sensitivity label taxonomy published and DLP policies running in simulation mode with first results.
- Audit retention set to the period the organization's regulators require, not left at default.
- A change log listing every configuration change, its date and the Secure Score movement that followed; Microsoft notes points generally take about 24 hours to update after an action is completed (Microsoft Learn, Assess your security posture with Microsoft Secure Score, accessed 2026-10-20).
Choosing a Microsoft 365 security consulting firm
Microsoft does not certify consulting firms for security outcomes, so the evaluation falls to the buyer. EPC Group suggests asking any candidate, EPC Group included, for three things: a sample 30-day change log from a prior engagement with client identity removed, the names of the Defender and Purview products the firm has configured in production rather than in a demo tenant, and a plain statement of what the firm will not do, such as recommending license upgrades as a precondition of the assessment.
Documented work
ANON-CASES: EPC Group engagement data in financial services and healthcare covers mid-size and large regulated organizations whose Microsoft 365 tenants EPC Group has assessed and hardened across Entra ID, Defender and Purview. Client names are not published here, and engagements are described by industry and organization size only. No outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- What is Conditional Access? — Microsoft Learn, accessed 2026-10-20
- Microsoft Secure Score — Microsoft Learn, accessed 2026-10-20
- What is Microsoft Defender XDR? — Microsoft Learn, accessed 2026-10-20
- Learn about sensitivity labels — Microsoft Learn, accessed 2026-10-20
- Learn about data loss prevention — Microsoft Learn, accessed 2026-10-20
- Assess your security posture with Microsoft Secure Score — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What is Microsoft Secure Score and how is it used in an assessment?
Microsoft Secure Score is a measurement of an organization’s security posture; a higher number means more recommended actions taken. Each recommended action is worth 10 points or less, and the recommendations are grouped into Identity, Device, Apps and Data (Microsoft Learn, Microsoft Secure Score; Assess your security posture with Microsoft Secure Score; both accessed 2026-10-20). EPC Group records the score and the full recommended-action list on day one as the baseline, then uses the ranking of remaining points, difficulty and user impact to order the remediation plan.
Which Entra ID controls come first (MFA, Conditional Access, PIM)?
Multifactor authentication for administrators and all users comes first, followed by Conditional Access policies that block legacy authentication and require compliant devices for specific applications; Microsoft lists these among the commonly applied policies, and Conditional Access requires a Microsoft Entra ID P1 license (Microsoft Learn, What is Conditional Access?, accessed 2026-10-20). Secure Score awards points for MFA for all users, MFA for administrative roles and blocking legacy authentication (Microsoft Learn, Microsoft Secure Score, accessed 2026-10-20). EPC Group then moves standing administrator assignments into Microsoft Entra Privileged Identity Management.
How do Defender for Office 365 and Defender for Endpoint divide responsibilities?
Microsoft describes Defender for Office 365 as safeguarding the organization against malicious threats posed by email messages, links and collaboration tools, and Defender for Endpoint as a unified endpoint platform for preventative protection, post-breach detection, automated investigation and response (Microsoft Learn, What is Microsoft Defender XDR?, accessed 2026-10-20). Defender XDR sits above both: when a malicious file is detected on an endpoint, it can instruct Defender for Office 365 to remove that file from all email messages (same source). EPC Group configures each product, then verifies the cross-product actions fire.
Where does Purview fit in a security program?
Purview is the data layer. Sensitivity labels classify and protect content with encryption and content markings that persist in file metadata, and they can also protect containers such as Teams and SharePoint sites (Microsoft Learn, Learn about sensitivity labels, accessed 2026-10-20). Purview Data Loss Prevention monitors Exchange, SharePoint, OneDrive, Teams, devices and other locations and can block or quarantine sensitive items, with every monitored activity written to the audit log (Microsoft Learn, Learn about data loss prevention, accessed 2026-10-20). Secure Score includes Purview Information Protection recommendations.
How is a security engagement scoped and what are its deliverables?
EPC Group scopes by layer and by license: identity controls in Entra ID, threat protection in the Defender products the client actually holds, and data protection in Purview. Deliverables are a Secure Score baseline and target, a Conditional Access policy set with a coverage report, Defender configuration with verified cross-product actions, a sensitivity label taxonomy and DLP policies deployed first in simulation mode (Microsoft Learn, Learn about data loss prevention, accessed 2026-10-20), and a 30-day report that lists every change, its date and the score movement it produced.
Talk to a senior architect
If you want a Microsoft 365 security assessment that ends in a change log rather than a slide deck, a 30-minute discovery call with a senior EPC Group architect will cover your current Secure Score, your Defender and Purview licensing, and the order of work. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.