"Security assessment" is one of those phrases that can mean anything from a five minute automated score to a week of real work. Before you pay for one, it is worth knowing what a proper one actually looks at, so you can tell a real assessment from a glorified sales report. Here is what ours covers and what you walk away with.
Why the phrase means little on its own
Plenty of "free security assessments" are a tool that reads your Secure Score, dumps it into a template, and ends with a quote. That is not an assessment, it is a lead form. A real one is someone who knows the product going through your actual tenant and telling you where the holes are in plain words. The difference is whether a human looked.
What actually gets checked
A proper Microsoft 365 assessment goes through the areas that get firms breached. Identity, so who can sign in, whether MFA is truly enforced for everyone, and whether legacy authentication is still open. Access, so Conditional Access and what happens on an unmanaged device. Devices, so what is enrolled, encrypted and patched, and what is not. Data, so sharing, external access and where it can leak. Email, so the anti phishing and anti spoofing settings. And the admin side, so who holds privileged roles and whether there is a break glass account. Each one checked against what good looks like, not just a number.
What you get at the end
A plain written report you are allowed to read and keep. Not a score with a sales pitch. It says what is fine, what is at risk, and what to fix first, ranked by how much it matters and how hard it is. You should be able to hand it to anyone and have them understand where you stand, whether or not you then hire anyone to fix it.
What it is not
It is not a penetration test, which is a different thing that attacks your systems to prove a point. And it is not a tool score dressed up. It is an honest read of your Microsoft 365 setup by someone who configures these tenants for a living, written so you can act on it.