Microsoft 365 Authorized • Lenovo 360 2026 • POPIA Section 19 Evidence

The R950 Check That
Finds What Your IT Guy Missed

For Pretoria SMEs 5-50 staff. In 2 hours we run 47 live checks your M365 tenant was never configured to do. Most owners discover 4.2 critical issues that would fail a POPIA audit or ransomware claim.

✕ Owner is Global Admin with no MFA — 61% of audits
✕ Mail forwarding to Gmail active — 18% have data leaving SA
✕ No DMARC/DKIM — your domain is spoofable, 73% fail
✕ OneDrive is NOT a backup — 68% would lose everything
What you actually get
✓ 47 checks✓ 12-page PDF + Loom✓ Pay after visit✓ If <3 critical, you don't pay
📅
Book 2hr Slot
Live • 2 slots left this week
R950 • Worth R2,500
Pick a time that suits you
30 sec • No payment now • Pretoria on-site, remote SA
✓ Pay after • ✓ Cancel anytime • ✓ No fix = No fee
47 audits this quarter • Avg 4.2 critical findings • Pretoria, Centurion, Midrand, JHB + Remote SA
Microsoft 365 AuthorizedLenovo 360 Authorized 2026POPIA Ready

Why this check exists

Microsoft 365 Business Standard at R290 gives you the tools, but leaves them on default. Defaults fail POPIA Section 19 and your cyber insurer's checklist. In SA, M365 is the #1 target — attackers don't brute force, they use legacy auth, inbox rules, and OAuth consent.

POPIA FINE
Up to R10M
Sec 19 requires "appropriate safeguards". Without MFA, audit logs, DLP and immutable backups you can't prove it. Our report is your evidence pack.
RANSOMWARE CLAIM DENIED
68% have no backup
OneDrive recycle bin ≠ backup. Ransomware deletes it. Insurers now ask for 365-day immutable backup proof. We test a live restore.
DOMAIN SPOOF
73% fail DMARC
Clients get fake invoices from your domain. DMARC/DKIM/SPF stops it. We check alignment and publish the fix.

47 live checks — not a questionnaire

We log into Entra ID, Exchange, Purview and run it live. Screenshots in report.

2 HOURS • ON-SITE OR TEAMS
1. IDENTITY & ACCESS — 12 checks
✓
MFA enforced for all — Microsoft Authenticator only, SMS disabled, number matching
✓
Legacy authentication blocked — old mail apps that bypass MFA
✓
Separate admin accounts — no daily email as Global Admin
✓
Conditional Access — block foreign logins, require compliant device
✓
Global Admin sprawl — 61% have 3+ owners
2. EMAIL SECURITY — 10 checks
✓
Auto-forward to external blocked — attacker favorite
✓
Mailbox auditing ON — off by default, required for breach investigation
✓
Safe Links & Safe Attachments — Defender P1 / Business Premium
✓
DMARC / DKIM / SPF alignment — stops domain spoofing
✓
Inbox rules audit — hidden rules forwarding invoices
3. DATA PROTECTION & BACKUP — 10 checks
✓
DLP configured — autoblock ID numbers, bank details
✓
Immutable cloud backup — Exchange, OneDrive, SharePoint, Teams
✓
Live restore test — we restore 1 file, 1 mailbox
✓
Retention 365 days — not 30 days
✓
BitLocker encryption report — POPIA device encryption
4. DEVICE & TENANT HARDENING — 8 checks
✓
OAuth app permissions reviewed — revoke Mail.ReadWrite from dodgy apps
✓
Unified Audit Log 1-year — default 90 days fails POPIA
✓
Alerts: New Global Admin + privilege escalation
✓
Secure Score >80 baseline — Microsoft's own benchmark
COMMON FINDS: MFA disabled owner 61% • Forward to Gmail 18% • No DMARC 73% • OneDrive-only 68%

What you get same day

Not a sales pitch. Evidence you can show your board, auditor, or insurer.

DELIVERABLE 1
12-Page PDF + Screenshots
Risk score (Low/Med/High), failed checks with screenshots, POPIA Section 19 mapping, prioritized fix list: Today / This Week / This Month. Worth R2,500.
ScreenshotsRisk ScorePOPIA Pack
DELIVERABLE 2
10-Min Loom Video
We walk through your tenant live, show the 4.2 critical issues, and what happens if you don't fix them. Send to your partner / IT.
✓ Plain English ✓ No jargon ✓ Shareable link
DELIVERABLE 3
Costed Fix Quote
Fixed ZAR price for each fix. No hourly. Example: MFA rollout R1,200 once-off, Immutable backup R89/user/mo. You pick Quick Wins vs Full Sprint.
Pay afterNo lock-in
RECENT CASE — CENTURION LAW FIRM, 14 USERS
Before: Owner Global Admin, no MFA, auto-forward to personal Gmail, no DMARC. One staff clicked phishing, R45k invoice fraud.

Found in check: 6 critical — legacy auth ON, audit OFF, backup only OneDrive.

After Sprint (3 days): MFA number-matching, Conditional Access, DLP for ID numbers, DMARC p=quarantine, Veeam immutable backup. Secure Score 32 → 87.
Owner said:
“We thought OneDrive was backup. Your Loom showed how ransomware deletes recycle bin. That alone was worth R950.”
— MD, 14-user firm, Centurion • Feb 2026 • Shared with permission
→ Request anonymized sample PDF on WhatsApp

R950 Check vs “Our IT guy checks”

IT GUYNEXTGRID
Live Entra ID audit—✓ Yes
47 checks + screenshotsTop 5✓ 47
POPIA Sec 19 evidence pack—✓ Yes
Live restore test—✓ Yes
12-page PDF + LoomEmail✓ Both

Our guarantee — no fluff

✓Pay after visit. We don't invoice until you see the PDF.
✓If we find <3 critical, you don't pay R950. Average is 4.2 — happens <8% of audits. We show screenshot proof.
✓No fix = No fee. If our Sprint doesn't lift Secure Score >80, refund labor.
✓One ZAR invoice, no lock-in. M365 at R290, backup R89, hardware separate. Month-to-month.
Worth R2,500 in billable time. Launch R950 for first audit per company. Pretoria/Centurion/Midrand/JHB on-site, remote anywhere else in SA.

FAQ — what owners ask before booking

Do you need admin access? Will you break anything?
Read-only Global Reader + Entra ID audit logs. No changes during check. We run Get-* PowerShell, no Set-*. If we need to test restore, we restore to test library, not overwrite.
We already have an IT guy — will this offend him?
No — 70% of our checks are referred by IT guys who don't specialize in M365 security. We give them the fix list with PowerShell commands. Many become our partner for hardening.
How is this different from Microsoft Secure Score?
Secure Score is generic. We check POPIA evidence (audit log retention 1yr, DLP for SA ID numbers, BitLocker report, immutable backup proof) that Secure Score doesn't cover. Plus live forwarding + OAuth app review — the 2 ways SA SMEs get breached.
What if you find nothing?
You don't pay. Happens in ~8% of audits (usually companies already on Business Premium with hardening). You still keep the 12-page PDF as POPIA evidence that you checked — auditors love it.
Remote vs on-site?
Pretoria, Centurion, Midrand, JHB = we come on-site 2hrs. Anywhere else SA = Teams remote, same checks, same PDF + Loom same day.
Avg reply <1hr • WhatsApp question instead?