Graph-backed controls work on any tenant. Exchange Online controls add mail-flow coverage where a PowerShell connection is available, and degrade independently—no sidecar still means every Graph control runs.
MFA-capable users, enforcement for administrators, and coverage for everyone else—including Security Defaults as a legitimate alternative way to satisfy the control, rather than marking a secure tenant as failing.
How many Global Admins you have, whether they're cloud-only, the licence surface they carry, and whether break-glass emergency-access accounts exist.
Basic auth is how password spraying still works in 2026. We check it's blocked—by Conditional Access or Security Defaults.
Every service principal and OAuth2 permission grant in the tenant, with risk from the scopes held, plus whether users can consent to apps on their own.
What guests can see of your directory, and whether external collaboration is scoped or wide open.
Mail forwarding to external addresses, mailbox auditing, and the transport settings attackers use to quietly exfiltrate a compromised inbox.
SPF, DKIM and DMARC verified live over DNS—the same checks as the Google side, because the records are yours, not the platform's.
Unused accounts holding licences and tokens, with last-sign-in evidence from the audit log.
Google exposes no write API for app access, so blocking there means revoking tokens and hoping nobody re-authorises before the next scan. Graph lets us delete the permission grant and disable the service principal—which stops future sign-in outright and covers tenant-wide admin-consented grants too. It's genuine prevention, not cleanup.
How app control works →A connection carries its platform; everything downstream is shared. The same score, findings, daily diff, trend, compliance packs, alerts and reports—whether the tenant is Google or Microsoft. For an MSP running both across a client base, it's one fleet view and one consolidated bill instead of two tools and two invoices.