Free · read-only · before Copilot

See what your Microsoft 365 is set up to expose.

Before you switch Copilot on, a free read-only scan of the settings that decide what it can surface to your staff: whether anonymous links and new guests are allowed, whether guests can reshare and whether their access ever expires, which sites have gone inactive, your Copilot licences, and the labelling steps to take first. You get a clear score across SharePoint sharing, site lifecycle and Copilot readiness, measured against the Glow Cloud M365 Security Framework, plus the findings that matter most. Your Global Administrator approves our read-only assessment application and gives it Microsoft's read-only Global Reader role for a scheduled window, and we run the scan from our own machine. Nothing is installed in your tenant; the only command anyone runs is the one short command, in Microsoft's own PowerShell module, that assigns that role.

Temporary read-only access
A scheduled window; data held only by us, never in a third-party assessment product
Report and readout within a few working days

Request your health-check

No cost. No sales call required.

Or see a sample health-check first, no email needed.

Beyond the free check

Go deeper with the paid assessment.

Full security assessment

Every control scored across the Glow Cloud M365 Security Framework and 6 platforms, with evidence and a recommended fix.

Sharing deep-dive

Every site ranked by exposure, then every link drilled down to who can reach it and whether it expires.

See the paid assessment → See a sample →

Three areas we assess

Distilled to what matters, not a settings dump

SharePoint & sharing

Anonymous links & new guests · Allowed domains · Link expiry · Guest resharing · Unmanaged-device sync

Site lifecycle & backup

Inactive sites · Microsoft 365 Backup

Copilot readiness

What Copilot can surface · Guest access expiry · Restricted SharePoint Search · Copilot licences · Label coverage

Where it leads

The settings first. Then, if you want it, every site.

The free check rates the tenant-wide sharing settings behind oversharing: whether anonymous links and new guests are allowed, whether guests can reshare, and whether their access ever expires - the settings that decide what Copilot can surface. It does not list individual sites or links. Want every site ranked by exposure and every link mapped to who can reach it, as in this sample? That is the full assessment. See what the full assessment adds →

Sharing report · Tier 1 · per-site read-only

Melbrooke Ltd · 40 sites · SharePoint & OneDrive

Where the exposure is

109

Sharing links

Anyone (anon)

External / guest links

Sites w/ anon

All sites Has anonymous Has external Tier 1 · per site

SiteAnyoneOrgSpecificGuest

Finance 2 0 0 1

HR Team 2 0 1 0

Warranty 2 0 1 0

Executive Team 2 0 0 0

Stanmore Service 1 5 0 0

Prepared by Glow CloudTier 1 · per-site exposure

Why it's different

Most security reviews cost thousands, or want standing access to everything.

There are really three ways to find this out today: run a free script and interpret it yourself, pay for a governance platform that connects to your tenant and keeps your data in its cloud, or buy a Microsoft add-on and read the dashboards yourself. Ours is the missing fourth: free, focused on what Copilot will expose, and actually delivered. Your Global Administrator gives our read-only assessment application Microsoft's read-only Global Reader role for a scheduled window; we hand you an interactive report of where you stand and what to harden, then you remove our access. It reads the settings about your tenant, never the files, mail or messages inside it. The working data stays on our own assessment machine in Microsoft Azure (UK South), which accepts no inbound connections, and never in a portal you have to sign in to. The delivered report is held in our own Microsoft 365 tenant, not in any third-party assessment product or shared platform, and no copy of your run data is kept on any other machine once it is delivered; our scheduled sweep removes the delivered copy once it is more than thirty days old (by default), or at once on request, and we delete everything for you on request, in writing, at any time. Every sign-in by our application appears in your own Entra sign-in logs.

Free

Not a paid platform, an E5 add-on, or a consultancy day rate.

Read-only, and revocable

It reads settings about the tenant, never your files or mail. Access is temporary, you can revoke it any time, and every sign-in by our application shows in your own Entra sign-in logs.

Interactive, and explained

A live report you filter and drill into, by platform, domain and severity, plus a readout. Not a static PDF or a raw script to decode.

The report

Not another raw score dump.

A raw native score buries the signal under hundreds of granular toggles. Ours surfaces the security-critical configurations, their current state, and what to harden first, so you see your posture in minutes, not a spreadsheet to wade through.

Only the configurations that actually move your security posture
Each shown with its state: solid, or needs hardening
Prioritised High → Low, so you know what to fix first
Plain English. Readable in minutes, by humans.

Copilot readiness check read-only

Melbrooke Ltd · June 2026

High Risk · Not Ready

High-risk sharing settings are in place. Remediate the High-priority items before enabling Copilot.

Assessed

Passing

High

Medium

Top findings

Content-exposure surface for Copilot High

No domain-based external sharing restriction Med

No expiration on external sharing Med

Prepared by Glow CloudCopilot readiness · read-only

“No expiration on external sharing.” One of the first things the free check reports.

Open the free health-check sample →

Questions, answered

The bits people ask first.

Is the Microsoft 365 health-check really free? +

Yes. It is a free, no-obligation assessment. You keep the report whether or not you go on to work with us.

How do you access my tenant? +

A Global Administrator approves our read-only assessment application and runs one short command, in Microsoft's own PowerShell module, that gives it Microsoft's read-only Global Reader role for a scheduled window. You can remove both at any time. Nothing is installed, and you stay in control throughout.

What does the assessment cover? +

Three areas: SharePoint and external sharing (anonymous links and new guests, allowed domains, link expiry, guest resharing and sync from unmanaged devices), site lifecycle and backup (inactive sites and Microsoft 365 Backup) and Copilot readiness (what Copilot can surface, guest access expiry, Restricted SharePoint Search, your Copilot licences and label coverage). Findings are scored against the Glow Cloud M365 Security Framework. The free check rates settings; identity, devices, email and data protection are covered by the paid assessment.

Will it tell me if we are ready for Microsoft 365 Copilot? +

Yes. We rate the sharing settings that decide what Copilot can surface to users - whether anonymous links and new guests are allowed, whether guests can reshare and whether their access ever expires - check your Copilot licences, and list the labelling and data-governance steps to take first, so you can fix them before you switch Copilot on. The free check rates settings; naming the individual sites and files shared with everyone is part of the paid assessment.

Do I have to buy anything afterwards? +

No. There is no obligation. If you want help fixing what we find, we can quote a remediation sprint, but the report and the priorities are yours to keep.