Microsoft 365 security, checked every day

What Mito does

Most small businesses run on Microsoft 365, and most Microsoft 365 tenants still have settings left at their defaults: legacy sign-in protocols that skip multi-factor authentication, guest access that is wider than it needs to be, mail that can be spoofed. Mito finds these for you.

• Daily assessment. Every day Mito reads your tenant’s security configuration across Entra ID, Exchange Online, Defender for Office 365, Intune, Purview, SharePoint and Teams, and runs several hundred checks against it.
• Drift tracking. Each run is compared with the previous one, so you see at once when a setting changes, a new admin appears or a protection is switched off.
• Plain-language fixes. Every check has a page on this site explaining what it looks at, why it matters and how to fix it. The Learn more link in your report takes you straight there.
• Recognised frameworks. Many checks map to the CIS Microsoft 365 Foundations Benchmark, the CISA SCuBA baselines and NIST SP 800-53 controls.

Read-only by design

Mito never changes anything in your tenant. It signs in with an app registration that you create and control, which has only read permissions and the Global Reader role. You can see exactly what it can access in Permissions explained, and you can stop the service at any time by deleting the app.

Your data is processed and stored in Microsoft Azure’s UAE North region. See Security and data residency.

How it works

1. You create a read-only app in your Microsoft 365 tenant, either with our setup script or by hand. It takes about 10 minutes.
2. You send us four values (tenant ID, application ID, client secret and its expiry date) over the secure link we give you.
3. You choose who can see the results by assigning them the Mito Reader role in your tenant. See Give your people access.
4. Mito runs every day and shows you the results: what passes, what fails, and what changed.

Built on Maester

Mito’s assessment engine is built on Maester, the open-source Microsoft 365 security test framework (MIT licence), together with checks from CISA’s ScubaGear, the Entra ID Security Config Analyzer (EIDSCA) and the Office 365 Recommended Configuration Analyzer (ORCA). We are grateful to their authors and contributors.