VizTime finds what's missing in your Microsoft 365 security, explains it in plain English, and turns it on for you.
Founding customer program — limited spots
Every setting we check, grouped by the part of Microsoft 365 it protects. Green is protection that is already on. Red is protection that is required and is off today.
Click any square and you get the same thing in words: what it prevents, where you stand right now, and what changes if you turn it on. No portals, no PowerShell, no reading a baseline document.
Three things for the security of your Microsoft 365. One for your data. And us, by the hour, when you want a person rather than a product.
See what your Microsoft 365 settings are protecting, and what they are leaving open.
We turn the missing protection on, to the level CISA recommends, and show you exactly what changed.
Get told when something risky happens in your tenant, in an email you can act on without calling anyone.
Your numbers live in half a dozen systems and none of them agree. We pull them out of each source and build one place where they do.
Advice by the hour on security and on data, from the people who built the product.
Before (not compliant)—After: Compliant
Phishing-resistant MFA is required for all users
What this prevents
Someone gets your password, then a fake sign-in page collects your code and uses it before you finish typing.
Someone gets your password. That happens through a leak on another site where you reused it, through a convincing email, a text message about a delivery, a fake Teams invite, an ad at the top of a search result, or a phone call from someone claiming to be your IT provider. Whatever the route, it ends in the same place: a sign-in page that looks exactly right and isn't.
You enter your password there, then the code from your authenticator. The fake page passes both to the real Microsoft site within seconds, while you're still typing. When it's done, the person inside your account is the attacker. Your code worked perfectly. It just worked for him.
Where you stand
Passkeys (FIDO2) and certificate sign-in are switched off in your tenant, so nobody could register one today even if they wanted to.
After remediation → Compliant
AADConditionalAccessPolicy · VizTime - Phishing-Resistant MFA
Phishing-resistant MFA is required for all users
What this prevents
Someone gets your password, then a fake sign-in page collects your code and uses it before you finish typing.
Someone gets your password. That happens through a leak on another site where you reused it, through a convincing email, a text message about a delivery, a fake Teams invite, an ad at the top of a search result, or a phone call from someone claiming to be your IT provider. Whatever the route, it ends in the same place: a sign-in page that looks exactly right and isn't.
You enter your password there, then the code from your authenticator. The fake page passes both to the real Microsoft site within seconds, while you're still typing. When it's done, the person inside your account is the attacker. Your code worked perfectly. It just worked for him.
AADConditionalAccessPolicy · VizTime - Phishing-Resistant MFA
Audit report
90 of 90 in-scope controls evaluated
The report lists every control. A sample is shown below.
Where the tenant stands
The same control-by-control list an auditor sees in the audit report.
| Control | What it requires | Level | Status |
|---|---|---|---|
| MS.AAD.3.1v1 | Phishing-resistant MFA is required for all users | Required | Not compliant |
| MS.AAD.1.1v1 | Legacy authentication is blocked for all users | Required | Not compliant |
| MS.EXO.1.1v2 | Automatic forwarding to external domains is disabled | Required | Not compliant |
| MS.AAD.3.2v2 | Require multifactor authentication for everyone | Required | Compliant |
| MS.AAD.3.7v1 | Managed devices (compliant or hybrid joined) are required for authentication | Recommended | Warning |
Showing 5 of 90 · 85 more in the full audit report
Successful sign-in after geographically impossible travel is one of the strongest signals of account compromise or session hijacking.
Detects a successful Entra sign-in after at least five MFA denials or incomplete MFA prompts on the same account within 15 minutes, with the success within five minutes of the last challenge.
Detects when Microsoft Entra directory enrollment data shows an active user account with no multi-factor authentication methods registered.
A person turned off or deleted an email filtering rule (for example a warning on mail from outside the company).
A person changed how widely people may share SharePoint or OneDrive files outside the company.
A person gave another person lasting administrator access — not a short, one-hour session.
This tenant has a single compliance scan. NOT COMPLIANT pressure concentrates in Microsoft Entra ID (13 of 24). The alert queue is still untriaged (all new, with 14 high-severity items), and a SHALL control tied to the Password Spray → Successful Sign-In scenario is NOT COMPLIANT across 4 alerts affecting 4 distinct actors.
This verdict uses today's single-scan posture (no history series), the concentration in Microsoft Entra ID, the untriaged queue (40 open; 14 high), and the featured SHALL control on Password Spray → Successful Sign-In.
Compliant share
69%
60 of 89 evaluated; 2 partially compliant / 3 other
NOT COMPLIANT
24
24 of 89 evaluated
Open alerts
40
New, Open, In review
We look at how your Microsoft 365 is configured and who signed in. Not your email, your files or your chats.
Nothing changes in your tenant unless an administrator of yours approves that change, one batch at a time.
Stored and processed on Azure, in our own subscription.
