Miciamo Baseline

Measurement, not impressions.

Microsoft 365 works fine even when it is set up badly. Nothing breaks, nothing lights up. The baseline is the list of settings that have to be right — and the way to verify that they are.

One hundred and eight settings, one number.

Each square is one tenant setting. After the measurement you know how many are compliant — and you can repeat that number in six months.

The baseline draws on Microsoft’s recommendations, recognised security frameworks and practice. It splits into mandatory controls we always apply and recommended ones you decide on.

The process

Measure. Fix. Maintain.

Three steps in this order. We cannot vouch for a state we never configured.

01

Review

We go through 108 settings and compare them with the baseline. Access during the measurement is read-only.

  • A written report
  • The three biggest risks
  • The full list of findings
  • A priced quote for step 02
02

Rollout

We clear the findings in the mandatory set. Recommendations we go through together and you decide. Anything declined is recorded in writing.

  • As-built documentation
  • Exception register
  • Rollback plan
  • Verification measurement
03

Governance

Every month we check what drifted and roll out one improvement. Compliance keeps rising instead of just holding.

  • Drift check
  • One improvement a month
  • Quarterly report
  • Advice on changes

You get the price in writing before we start, not after.

Scope

What exactly we measure.

Eleven areas across the whole environment — from sign-in and email to Copilot and content discoverability.

Tenant & directory13 settings · 11 mandatory
Identity & roles8 settings · 4 mandatory
Sign-in17 settings · 8 mandatory
Applications4 settings · 3 mandatory
Exchange Online19 settings · 17 mandatory
SharePoint & OneDrive14 settings · 7 mandatory
Teams6 settings · 4 mandatory
Devices & Intune8 settings · 0 mandatory
Data & compliance3 settings · 0 mandatory
Copilot & data governance10 settings · 4 mandatory
Monitoring6 settings · 6 mandatory

The full catalogue, with the reasoning for each control and the remediation steps, is an annex to the contract.

In practice

How it runs in practice.

Access during measurement
Read-only. Nothing is changed during a review.
Duration
Ten working days from access being granted
Handover
We walk through the report together on a 30–60 minute call, not by email
Versioning
The baseline is versioned. When it updates you know exactly what changed.

Start with a measurement.

Send us your domain. On an initial 30–60 minute consultation we go through your environment and agree a date and a price. The first step is always the review.

Get in touch