1.0 – 1.9
NOT READY
Critical gaps in DLP, oversharing, or identity will leak sensitive data through Copilot. Do not enable Copilot — even for a pilot — until the Must Do Before Copilot items are resolved.
Copilot Readiness, Power Platform, SharePoint & OneDrive, Teams, M365 Security, plus the cross-cutting Microsoft 365 Complete report. Read-only Microsoft Graph scans that produce a 1.0–4.0 score with prioritized findings. CA$399 per single assessment, CA$1,599 for the bundle of all six with white-label PDF rights. One-time payment, 90-day access, locked to one tenant.
Read-only. No credit card. 1 free snapshot per tenant per month per product.
Example output. Your score will vary by tenant.
The Verdict
Every scan ends with a number between 1.0 and 4.0 and one of four plain-English verdicts. No ambiguity. No "it depends".
Critical gaps in DLP, oversharing, or identity will leak sensitive data through Copilot. Do not enable Copilot — even for a pilot — until the Must Do Before Copilot items are resolved.
Run a tightly scoped pilot with 5–10 hand-picked users on non-sensitive workloads only.
Internal pilot approved for any team. Resolve the remaining Must Do Before Full Rollout items before expanding.
Full Copilot rollout approved. Maintain ongoing monitoring with quarterly assessments.
What We Scan
Each module reads a specific corner of your tenant through Microsoft Graph and contributes to the final 1.0–4.0 score.
Confirms the subscribed SKUs, OneDrive enablement, and M365 service health before anything else runs.
Inventories sensitivity labels, sensitive info types, and DLP policies — including whether Microsoft365Copilot is a protected workload.
Audits CA policies, MFA enforcement, guest ratio, OAuth grants, Global Admins, and PIM coverage.
Checks Office update channel adoption so users actually get Copilot features on the right build.
Per-team lifecycle audit: ownerless teams, single-owner risk, inactive teams, shared channels, guest concentration. Teams is a primary Copilot surface.
Per-account drilldown: orphaned drives, stale 180d+ accounts, oversized drives, external-share exposure, Known Folder Move adoption.
Tenant oversharing posture: default sharing link, Site Access Reviews, Inactive Site policy, Restricted Access Control, Block Download, EEEU posture.
Every other Copilot readiness tool on the market treats DLP as a boolean: "you have DLP policies, you're fine". That is wrong. Microsoft365Copilot is a distinct DLP workload. If your existing DLP policies don't explicitly list it in the workload scope, Copilot can surface labelled and regulated content to any user who can see the underlying file — through a chat response.
PUR-001 inspects every DLP policy in the tenant, parses the workload array, and flags any policy where Microsoft365Copilot is missing. It's the single highest-impact finding in the report — and the one nobody else surfaces.
Trust
Three independent guarantees that mean this scan cannot change anything in your tenant.
Every Graph request goes through a client that rejects PATCH, POST, PUT, and DELETE before the wire. No write is physically possible — not even accidentally.
All findings and raw evidence are encrypted with AES-256-GCM before they touch the database. Keys are managed separately from the data store.
Only .Read.All and equivalent read scopes — admin-consented once. A scope-diff UI shows you exactly what's missing before you run.
How It Works
Paste service-account credentials or use delegated OAuth. About 5 minutes of Azure AD setup the first time.
A scope-diff UI shows exactly which of the 14 read-only Graph permissions are present and which are missing, before anything runs.
All seven modules execute in 3–5 minutes. Read-only Graph calls only — your tenant never notices.
Score banner and module scorecard for all tiers. Insight unlocks the full remediation checklist and JSON / HTML exports. Partner adds CSV export to Microsoft Planner for consulting engagements; the Word and Excel client deliverables are coming in the next release.
Pricing
All prices in CAD. No subscription. Each purchase is locked to one Microsoft 365 tenant at first scan and gives you unlimited re-runs of that assessment for 90 days.
Tenant Suite — M365 Governance Suite
The complete M365 governance lifecycle for one tenant. Six read-only audits, three planning tools (Restructuring, OneDrive Cleanup, Migration Rehearsal — plus Dependency Graph and Modernization Engine), Bulk Provisioning to deploy nav/themes/content types/term sets back into SharePoint, and Continuous Monitoring with monthly auto re-runs. White-label PDFs, commercial redistribution license. Built for teams running readiness engagements at $5K–$50K per tenant.
Consultant Pro — Unlimited M365 Tenants
Annual licence for one named consultant to run the full Governance Suite across UNLIMITED client tenants. The tier MSPs, M&A advisors, and governance consultants actually need — instead of buying $1,599 per client, one $2,499/year licence covers every engagement for the year. White-label PDFs and commercial redistribution license on every report.
CA$399 each · 90-day access · locked to one Microsoft 365 tenant · MigrationFox-branded PDF · internal use license
DLP coverage, oversharing audit, Purview, Teams/OneDrive, SharePoint permissions, identity. 1.0–4.0 score with 4-state pilot verdict. The original assessment.
Read-only · ~5 min scan
Environment inventory, maker concentration, DLP policies on connectors, premium connector usage, on-prem data gateway audit. For tenants with Power Apps and Power Automate sprawl.
Read-only · ~5 min scan
Anyone-link audit across the top 30 SharePoint sites, external sharing posture, ownership gaps, OneDrive Known Folder Move adoption. Catches accidental data exposure.
Read-only · ~5 min scan
Teams lifecycle health, orphaned teams, owner counts, external sharing capability, OneDrive Known Folder Move adoption. The collaboration health check.
Read-only · ~5 min scan
Conditional Access policies, MFA coverage, Global Admin count, guest user ratio, Purview labels, audit log readiness. The security posture review.
Read-only · ~5 min scan
Scan OneDrive accounts for oversized storage, stale content, departed users, and external sharing exposure.
Read-only · ~5 min scan
Free Snapshot
CA$0
View-only sneak peek for any one assessment. 1 per month per tenant. Score + verdict + 1 sample finding. No exports.
Try Free Snapshot →License terms
Single Assessment is licensed for internal use on one Microsoft 365 tenant. The PDF is MigrationFox-branded and cannot be re-delivered to a third party as a paid work product. The Microsoft 365 Complete Bundle includes a commercial redistribution license and a white-label PDF, so the report can be delivered to a paying client as your own engagement deliverable. Each purchase is locked to one Microsoft 365 tenant at first scan and is not transferable.
FAQ
.Read.All or equivalent), admin-consented once. Before any scan runs, the scope-diff UI shows you exactly which are present and which are missing, so you never hit a mid-run permission failure.
404, which is surfaced as "endpoint not available in this tenant" rather than a crash or a scope error — and is itself recorded as a gap in the score.
Free Snapshot. No credit card required. Read-only by design. Nine governance tools, one tenant, one click to start.