Text version of this page. The interactive version needs JavaScript.
You don't know if your Microsoft 365 is secure — and that's the real problem.
Microsoft 365 security for small & mid-sized business
If your insurer, client or bank asked tomorrow, could you answer? One plain-English page: the verdict, this week's fix list, proof it's done. It only looks at your settings, changes nothing, and keeps no copy of your data.
- No IT team needed
- Can't change anything
- Keeps none of your data
- Nothing to install
- Plain English, no jargon
- Reply within one business day
Risk
What one missed setting could cost you
Canada is the second most targeted country for ransomware in the world. One in five businesses gets hit every year.
- Admin without MFA — One compromised admin account can lock you out of everything. This is the most common entry point.
- Public anyone link — One file shared with the whole internet is one file you no longer control.
- A back door around your phone check — Your sign-in rules have gaps. Old sign-in methods are still allowed, so a password alone gets in and the phone check never happens.
Why
Security made for the way you work
No jargon. No endless dashboards. Just a clear answer and a short list of fixes.
- Right-sized for you — Everyone gets the same checks. Only the pass mark moves with your size, from 5 people to 300 and beyond. A 10-person shop isn't held to a bank's standard.
- Plain English — One verdict. Each fix is one email you can forward to IT.
- Proof over time — Watch the score climb and gaps close. See if your IT is doing the work.
Views
The owner sees a verdict. IT sees the work.
One page, two ways to read it. You get the answer. Your IT gets the list.
- Owner view — Score 68. Protected, yes. Two decisions this week. Save $210 a month.
- IT view — Identity and MFA 47 of 52. Two public links. Four policies, two gaps.
Findings
The answer you would need to give
No mystery. Each finding is a single line you can read, understand, and forward to whoever fixes things.
- Logins protected — Multi-factor authentication is on for every account. The front door is locked.
- Public links exposed — Two files are shared with anyone who has the link. The fix is to turn off public links.
- Unused licences found — You pay for three accounts nobody uses. Remove the licences in two clicks and save about $210 a month.
Process
Set up once. Answered in 60 seconds.
Three steps. No install. No waiting. No IT project.
- Step 1 — Give it a view-only pass — Ten minutes, guided, nothing to install. You stay in control.
- Step 2 — Get your verdict — One plain-English score. You know where you stand.
- Step 3 — Forward the fixes — One-line instructions. Watch the score climb as gaps close.
Safety
You hold the key and can take it back
ClearTenant can see your Microsoft 365 but never change it, and never keeps a copy. You stay in control from the first click to the last.
- You open the door — You give ClearTenant a view-only guest pass from your own Microsoft account. We never see or ask for a password.
- You can close it anytime — Remove the guest pass in your Microsoft settings and access ends that second. No call to us needed.
- It looks, it never touches — ClearTenant can see whether you're protected. It cannot change a single setting, file or email.
- We keep no copy — Nothing is stored on our side: no database, no copy of your files or mail. It reads live, shows you, and forgets — there's nothing on our side to lose or leak.
Readiness
When someone asks you to prove it
Your insurer at renewal. A client's procurement team. Your bank. At any size, someone eventually asks for proof, not promises. ClearTenant maps what it sees to the checklists they actually use, so you have the answer before the meeting.
- Insurance — Cyber-insurance checklist — The 13 controls most insurers ask about at renewal: MFA on every account, admin protection, backups, email filtering, no public shares. Today you meet 10 of 13, and the report shows exactly which three are missing. Whether you have 8 people or 300, this is the questionnaire you'll get.
- CIS v8 — CIS Controls v8 — The most widely used security baseline for small and mid-sized businesses, written by the Center for Internet Security. Every ClearTenant finding is tagged with its CIS control (e.g. 6.5 for admin MFA), so your IT knows precisely what to do and you can show a 71% coverage figure that means something.
- NIST CSF — NIST Cybersecurity Framework 2.0 — The framework most larger clients and auditors speak. Findings map to its six functions: Govern, Identify, Protect, Detect, Respond, Recover. Useful when a client questionnaire arrives written in NIST terms.
- ISO 27001 — ISO/IEC 27001 — The international standard enterprise clients cite in vendor reviews. ClearTenant shows which Annex A controls your Microsoft 365 setup already satisfies and which don't, an indicative head start if you ever pursue certification. It is not an audit.
- SOC 2 — SOC 2 readiness — What SaaS and US clients often ask for. ClearTenant gives a partial mapping to the Security trust criteria, enough to answer "do you have MFA, access reviews and logging" with evidence rather than a promise.
- CyberSecure — CyberSecure Canada — Canada's national certification for small and medium businesses, built on 13 baseline controls. ClearTenant walks the self-assessment for you: in the sample tenant, 8 of the 13 controls are already met, 3 are partially in place, and 2 remain, each with the fix spelled out.
- AI readiness — Ready for Copilot and AI tools? — AI assistants like Microsoft 365 Copilot can surface anything a person already has access to, including files shared too widely years ago. Before you switch one on, ClearTenant shows what would be exposed: public links, over-shared sites, guests with lingering access, admin accounts without protection. Fix those first and AI becomes an asset instead of a leak.
Pricing
One plan
Everything included. No tiers. No surprises.
Save 20% with the annual plan
- Owner and IT views
- Insurance readiness evidence
- CIS, NIST, ISO mapping
- Licence savings finder
- Digests and fix tracking
FAQs
Straight answers to the questions every owner asks before they connect.
Is ClearTenant for government?
No. ClearTenant is built for small and mid-sized businesses — typically 5 to 300 seats — running Microsoft 365 without an in-house security team. It is not a public-sector product and has nothing to do with FedRAMP, CMMC, or government cloud programs.
What can ClearTenant see?
It reads your Microsoft 365 settings, licences, and security posture. It looks at configuration, not your emails or files. The connection is read-only.
Can I revoke access?
Yes. You can switch off the connection yourself at any moment. The access dies instantly and nothing is left behind.
Do I need Business Premium?
No. ClearTenant works with any Microsoft 365 business plan, from Business Basic up to E5. It reads what you have and reports on it. Some sections depend on features Microsoft only includes in certain plans or add-ons: for example, sign-in risk detection and device compliance need Entra ID P1/P2 or Intune, which come with Business Premium and E3/E5. If your plan doesn't include a feature, that section simply shows as “not available on your plan” rather than as a gap, and we tell you what the add-on would cost before you decide.
Does it replace IT?
No. It gives you and your IT provider a clear list of work. You stay in charge of who fixes what.
Will this get me through my cyber-insurance renewal?
It shows you the controls insurers commonly ask about and which ones you already meet, so you can fix gaps before the renewal form arrives. It is an indicator to prepare you, not a guarantee. Insurers make their own decisions, and ClearTenant never communicates with them on your behalf.
What are the “controls” it checks?
Concrete settings in your Microsoft 365: is the phone check on for every account, are admin accounts protected, are any files shared publicly, are old sign-in methods blocked, are unused licences being paid for. Each one is mapped to the checklists insurers, clients and auditors use (cyber-insurance, CIS v8, NIST CSF, ISO 27001, SOC 2, CyberSecure Canada) so you can show where you stand.
We're thinking about Microsoft Copilot. Does this help?
Yes. Copilot and similar AI tools can only show people what they already have access to, but in most businesses that is far more than anyone realizes: old public links, sites shared with everyone, former guests. ClearTenant lists those exposures so you can close them before turning AI on, and shows you're clean afterwards.
Who fixes what ClearTenant finds?
Whoever you already trust with IT. Every finding comes with a one-line fix written so it can be handed off as-is: forward it to your MSP or IT provider, to the person in the office who looks after the computers, or to the nephew who set up your email. If you're comfortable doing it yourself, the instruction tells you exactly where to click. ClearTenant never makes the change for you; you stay in control of who touches your Microsoft 365, and the score shows when it's done.
Is it a certification or an audit?
No. The framework mappings are indicative cross-references to help you focus effort. A formal audit or certification can only be issued by a qualified assessor.
Still have questions?
Send us a note. We reply within one business day.
About
Built in Montréal by people who run Microsoft 365 for a living
We have spent years managing Microsoft 365 for organizations of every size, from a handful of people to thousands. We built ClearTenant because owners deserve a straight answer about their security, without needing to become IT experts.
- Why it exists — Most businesses find out they were exposed only after something breaks.
- The work — One page that only looks, never changes anything, and keeps nothing. It tells you the truth.
- Every size — built on experience with tenants from 5 people to thousands
- Montréal — built and supported in Québec, EN / FR
- View-only — it can see your settings, never change them
- No copy kept — your data stays in Microsoft — nothing on our side to lose or leak
- See it working — A full sample dashboard. No form. No credit card. Nothing to install. — Enter the live demo
- Not sure yet? — Open a pre-written email. We reply within one business day. — Open the email
Get started
See it working, before you decide anything.
A live demo on a sample company, or a real person by email. Either way, nothing to install and nothing to give us.
- Opens instantly — No form, no card, no sign-up
- Reply within one business day — No call, no obligation
Explore the live demo · Privacy policy