1. The Challenge

The organisation — which delivers community, outpatient, and diagnostic services across multiple sites — relied on Microsoft 365 for clinical coordination, document sharing, and operational workflows. As teams expanded and service lines evolved, the environment accumulated legacy settings, inconsistent sharing rules, and identity risks that could compromise sensitive patient data or disrupt service delivery.

Key issues included:

• overly permissive access
• unmanaged external sharing
• legacy authentication still enabled
• inconsistent MFA enforcement
• high-risk tenant-level misconfigurations

With sensitive healthcare data at stake, the organisation needed a clear picture of its risks and practical steps to strengthen Microsoft 365 security.

2. Our Approach

Peritus conducted a comprehensive Microsoft 365 security assessment focused on uncovering misconfigurations and improving identity, collaboration, and data protection controls.

Our work included:

• Full review of identity configuration, MFA, conditional access, and privileged roles
• Assessment of SharePoint, OneDrive, Teams, and external sharing exposure
• Evaluation of Defender for Office 365 and threat protection settings
• Mapping tenant risks against NCSC and NHS security standards
• Prioritised remediation roadmap with clear technical steps
• Guidance on improving ongoing governance and operational maturity

This provided leadership with clarity on where risks existed and what “good” looks like for a secure M365 environment.

3. The Outcome

Peritus delivered a measurable uplift in the organisation’s Microsoft 365 security posture:

• 52% reduction in overall attack surface
• Removal of high-risk misconfigurations affecting identity and data access
• Stronger MFA, conditional access, and identity hygiene
• Reduced exposure caused by legacy authentication and external sharing
• Improved alignment with healthcare regulatory expectations
• A clear, actionable roadmap enabling long-term governance and continuous improvement

The organisation gained both immediate security improvements and a sustainable way to maintain strong controls moving forward.

“Peritus gave us clarity we didn’t have before. Their assessment uncovered critical risks and helped us strengthen our Microsoft 365 environment quickly and effectively. ”    

— Head of IT Security, UK Healthcare Provider

‍