These are the kinds of things the assessment finds, written the way a report would say them. They’re patterns, not results from a real client. If one sounds like your business, that’s worth knowing before the application arrives.
Insurers ask whether admin accounts need more than a password. The report names each account, so you can check which ones matter. Some may be read-only roles.
What the scan reads: Which accounts in an admin role have a second sign-in method registered.
For your IT person: Admin MFA Coverage.
Applications ask whether email needs more than a password. If no sign-in rule or security default asks for it, the report says it can't confirm you have it. Check how else it's set up before you answer.
What the scan reads: Your sign-in rules, and whether Microsoft's security defaults are on.
For your IT person: CA All-Users MFA Coverage, Security Defaults Status.
Applications ask whether every computer runs antivirus. If you use another product, the scan can't see it, and you answer that question on the form instead.
What the scan reads: Whether Microsoft Defender for Endpoint shows up in your Microsoft Secure Score.
For your IT person: Defender Workloads Enabled.
Each always-on admin account can change anything in your Microsoft 365. Fewer is better, and admin rights that are switched on only when needed are better still.
What the scan reads: Who holds Microsoft 365's top admin role, and whether they hold it permanently.
For your IT person: Permanent Global Admin Count, PIM Enabled Roles.
Applications ask how you review the access outside vendors have. The report lists the apps people connected and the guest accounts nobody has used lately, so you can clear out what you don't need.
What the scan reads: Which outside apps people have connected, and which guest accounts haven't signed in for a while.
For your IT person: User-Consented OAuth Grants, Stale Guest Accounts.
Some applications ask how you classify sensitive data. Labels are one way Microsoft 365 does it. The report notes whether you have them, and you answer the rest on the form.
What the scan reads: Whether sensitivity labels exist and how they're organized.
For your IT person: Sensitivity Label Inventory, Label Taxonomy Structure.
Want to know which of these you have?