Your Microsoft 365 and Google Workspace settings, checked every few hours — and fixed with two people agreeing

Contents

1. 1Executive summary
2. 2The challenge
3. 3Architecture
4. 4How it works
5. 5Capabilities in detail
6. 6Security and data handling
7. 7Where it fits
8. 8Deployment and system requirements
9. 9Technical specifications
10. 10Getting started

1Executive summary

SaaSPosture reads the security settings of your Microsoft 365 / Entra ID and Google Workspace tenants with read-only access and checks them continuously: MFA, administrators, legacy authentication, app consent, guests, sharing and third-party apps. Every failing setting comes with the fix; drift raises an alert; and fixes TotalHeal applies need a second person’s approval.

2The challenge

Most breaches of Microsoft 365 and Google Workspace come from settings, not exploits: MFA that is registered but not required, legacy protocols that skip it, an administrator nobody uses, people allowed to grant any app access to their mailbox, files shared with links anyone can open. Settings drift as admins change them, and nobody notices until an attacker does.

The TotalHeal approach. SaaSPosture reads the settings of your Microsoft 365 / Entra ID and Google Workspace tenants through the connectors you already have, with read-only access, and checks them continuously. Each failing setting is a finding with the fix, its MITRE ATT&CK techniques and the compliance controls it maps to. The Professional tier adds the third-party app inventory and drift alerts; the Elite tier applies fixes after a second person approves.

3Architecture

4How it works

1. ConnectUse the Microsoft 365 or Google Workspace connector you already have, with the read permissions listed for each check.
2. ScanSettings, administrators, MFA registration and third-party apps are read and checked; anything unreadable is named with its permission.
3. PrioritiseFindings come worst first, with a score per tenant, the fix and the frameworks they map to.
4. WatchScans repeat; a setting that drifts back raises an alert.
5. FixFix it yourself from the steps, or request a fix that a second person approves before TotalHeal applies it.

5Capabilities in detail

• Microsoft 365 / Entra ID checksMFA enforced for all users (security defaults or Conditional Access), people and administrators without MFA, legacy authentication blocked, Global Administrator count from two to five, user consent to apps, guest invitations, user app registration and tenant creation, SharePoint and OneDrive Anyone links.
• Google Workspace checks2-step verification enforced and enrolled, super administrators without 2-step verification, super administrator count from two to four, super administrators unused for 90 days, third-party apps with high-risk access.
• Read-only by designScans use read permissions only, and every scan request is checked before it leaves TotalHeal: anything that is not a read is refused. A setting the connector may not read is reported as not evaluated with the permission it needs — never guessed.
• A score and a fix for every findingA severity-weighted score per tenant and overall, findings worst first, the steps to fix each one in the admin centre, and a trend. Accept a risk with a reason and an optional end date; it reopens by itself.
• Mapped to frameworksEach check maps to MITRE ATT&CK techniques and to controls of NIST 800-53, NIST CSF, ISO 27001, SOC 2, PCI DSS, CIS v8, DPDP and other packs in TotalHeal Compliance.
• Third-party app inventoryEvery app people granted delegated access (Microsoft 365) or OAuth tokens (Google Workspace): its publisher and whether it is verified, its scopes in plain words, and how many people — or everyone, by administrator consent — granted it. Apps that can read or send mail, read or change every file, or change the directory come first.
• Drift alertsAfter a clean scan, a critical or high setting that starts failing raises an alert in the same incident queue as endpoint, identity and cloud alerts, and goes on to your SIEM, ticketing and playbooks.
• Fixes with four-eyes approvalRequest a fix — stop users consenting to apps, allow only administrators and Guest Inviters to invite guests, revoke an app’s access — and a different person approves it before TotalHeal makes the change with the connector’s credentials. Both decisions are kept in the audit log, and the tenant is scanned again.

6Security and data handling

• Read-only scansEvery scan request is a read; anything else is refused before it leaves TotalHeal.
• Two people for every changeA fix runs only after someone other than the requester approves it, and both are audited.
• Nothing guessedA setting that cannot be read is reported as not evaluated, with the permission it needs.
• Your tenants onlyEach organisation’s findings, apps and fixes are visible to it alone.

7Where it fits

8Deployment and system requirements

9Technical specifications

10Getting started

• A Microsoft Entra ID / Microsoft 365 or Google Workspace connector in TotalHeal with the read permissions above
• For fixes (Elite): the write permissions above, granted to the same app registration or service account

Start a 30 days, up to 50 users trial in the TotalHeal console with a Sttiz account. For a quote, an on-premises installation or the procurement dossier (compliance matrix, bill of materials, architecture and hardening, SLA, OEM authorisation letter), write to business@totalhealsecurity.com.