TotalHealSaaSPosture

How it works

1. ConnectUse the Microsoft 365 or Google Workspace connector you already have, with the read permissions listed for each check.
2. ScanSettings, administrators, MFA registration and third-party apps are read and checked; anything unreadable is named with its permission.
3. PrioritiseFindings come worst first, with a score per tenant, the fix and the frameworks they map to.
4. WatchScans repeat; a setting that drifts back raises an alert.
5. FixFix it yourself from the steps, or request a fix that a second person approves before TotalHeal applies it.

Reference architecture

Key capabilities

• Microsoft 365 / Entra ID checksMFA enforced for all users (security defaults or Conditional Access), people and administrators without MFA, legacy authentication blocked, Global Administrator count from two to five, user consent to apps, guest invitations, user app registration and tenant creation, SharePoint and OneDrive Anyone links.
• Google Workspace checks2-step verification enforced and enrolled, super administrators without 2-step verification, super administrator count from two to four, super administrators unused for 90 days, third-party apps with high-risk access.
• Read-only by designScans use read permissions only, and every scan request is checked before it leaves TotalHeal: anything that is not a read is refused. A setting the connector may not read is reported as not evaluated with the permission it needs — never guessed.
• A score and a fix for every findingA severity-weighted score per tenant and overall, findings worst first, the steps to fix each one in the admin centre, and a trend. Accept a risk with a reason and an optional end date; it reopens by itself.
• Mapped to frameworksEach check maps to MITRE ATT&CK techniques and to controls of NIST 800-53, NIST CSF, ISO 27001, SOC 2, PCI DSS, CIS v8, DPDP and other packs in TotalHeal Compliance.
• Third-party app inventoryEvery app people granted delegated access (Microsoft 365) or OAuth tokens (Google Workspace): its publisher and whether it is verified, its scopes in plain words, and how many people — or everyone, by administrator consent — granted it. Apps that can read or send mail, read or change every file, or change the directory come first.
• Drift alertsAfter a clean scan, a critical or high setting that starts failing raises an alert in the same incident queue as endpoint, identity and cloud alerts, and goes on to your SIEM, ticketing and playbooks.
• Fixes with four-eyes approvalRequest a fix — stop users consenting to apps, allow only administrators and Guest Inviters to invite guests, revoke an app’s access — and a different person approves it before TotalHeal makes the change with the connector’s credentials. Both decisions are kept in the audit log, and the tenant is scanned again.

In the console

Deployment options

System requirements

Technical specifications