Amalfi Outsourcing — Microsoft 365 Tenant Audit

35.6%

Microsoft Secure Score

8%

Users with MFA

0

Conditional Access Policies

8

P0 Critical Findings

9

P1 High Findings

15

Domains No DMARC/DKIM

18

Domains in Tenant

635

Total Users

Summary

This assessment reveals a Microsoft 365 tenant operating at critical risk. Of 583 enabled users, only 47 (8%) have MFA registered. There are zero Conditional Access policies in place. The Azure AD Premium P2 licence — which enables Conditional Access, Privileged Identity Management, and Identity Protection — is assigned to only 1 user. With 1 P2 licence for 635 users, per-user security features including Identity Protection, PIM, and advanced Conditional Access are effectively unavailable at scale. This directly explains the absence of enforcement controls across the tenant.

A significant architectural finding: 18 domains across approximately 12 separate business entities share one Microsoft tenant. This includes UK gambling operators (onlybets.uk, winnersweekly.co.uk, bet7.co.za, superlottos.com), insurance (choiceinsurance.co.za), legal services (eazylifelegal.com), broadband (oceannetbroadband.co.uk), and property management (harbour-management.co.uk). All 635 users share a single security boundary with no data segregation.

Of 18 domains, 15 have no DMARC policy and 14 have no DKIM configured. Any of these domains can be impersonated for phishing with no technical barrier. The UK gambling entities are subject to UKGC licence conditions requiring adequate data security — the current posture is materially non-compliant.

This report identifies risk exposure. The remediation programme is available as a managed engagement — contact The Fourths to commence within 30 days.

P0 Critical Findings — Act Within 48 Hours

ID	Finding	Impact	Severity	Remediation Status
P0-1	MFA: 47/583 users enrolled (8%) — 536 accounts accessible with password alone	Credential breach, data exposure, ransomware entry	P0	Requires managed specialist intervention
P0-2	0 Conditional Access policies — No MFA enforcement, no device compliance, no legacy auth block	No protection layer. Any credential = full access.	P0	Requires managed specialist intervention
P0-3	AAD P2: 1 licence assigned for 635 users — Identity Protection, PIM, and Conditional Access P2 features require a licence per user. With 1 P2 licence, these capabilities are unavailable for 634 users (99.8% of the org).	Root cause of near-zero security posture. Per-user licensing required.	P0	Requires managed specialist intervention
P0-4	DMARC missing on primary domains — amalficompany.com, amalfioutsourcing.com, amalfiagents.com all fully spoofable	Phishing, brand impersonation, BEC fraud	P0	Requires managed specialist intervention
P0-5	DKIM not configured on any primary Amalfi domain	Email unverifiable. Deliverability risk, phishing risk.	P0	Requires managed specialist intervention
P0-6	52 disabled accounts remain in tenant with potential active licences — 52 member accounts are disabled but not deleted. Disabled accounts can retain paid licence assignments.	Direct billing waste. Licence hygiene audit required to recover seats.	P0	Requires managed specialist intervention
P0-7	UK gambling entities in shared tenant with no controls — onlybets.uk, bet7.co.za, winnersweekly.co.uk, superlottos.com, 777admin.com share tenant with 0 CA, 8% MFA	UKGC licence condition breach. ICO enforcement risk.	P0	Requires legal and compliance expertise — beyond internal IT scope
P0-8	DMARC/DKIM missing on 15/18 domains including all gambling and insurance brands	All brands spoofable. UKGC/FCA/ICO risk.	P0	Requires managed specialist intervention

P1 High Findings — Act Within 2 Weeks

ID	Finding	Severity	Remediation Status
P1-1	4 permanent Global Administrators — should be max 2 with PIM just-in-time activation	P1	Requires managed specialist intervention
P1-2	PIM status unverified — permission not granted. With only 1 AAD P2 licence for 635 users, PIM is effectively unlicensed for all but 1 account.	P1	Requires managed specialist intervention
P1-3	Secure Score 35.6% — 37 of 72 controls scoring zero	P1	Requires managed specialist intervention
P1-4	Excessive role sprawl: 7 Exchange Admins, 7 User Admins, 7 Helpdesk Admins, 5 Teams Admins, 4 SharePoint Admins	P1	Requires managed specialist intervention
P1-5	3 expired app registration secrets — oldest expired Jan 2025 (16+ months)	P1	Requires managed specialist intervention
P1-6	113 OAuth2 permission grants — 19 with broad write scopes (Mail.ReadWrite, Files.ReadWrite.All)	P1	Requires managed specialist intervention
P1-7	8 pending admin consent requests — unauthorised app access requests unreviewed	P1	Requires managed specialist intervention
P1-8	Password policy: never expires (2,147,483,647 days) — no compensating MFA control in place	P1	Requires managed specialist intervention
P1-9	Hybrid AD security issues flagged by Secure Score: unsafe Entra Connect permissions, reversible passwords in GPOs, DnsAdmins group exposure	P1	Requires managed specialist intervention

47

MFA Registered (of 583)

4

Global Admins

?

CA Policies (unverified)

?

PIM Status (unverified)

40+

Privileged Role Holders

0

Named Locations Defined

MFA Status

Check	Result	Status
Total enabled users	583	INFO
MFA registered	47 (8%)	CRITICAL
MFA not registered	536 (92%)	CRITICAL
Conditional Access enforcing MFA	None	MISSING
Security Defaults (fallback MFA enforcement)	Unknown — Policy.Read.All permission not granted to audit app	UNVERIFIED
Per-user MFA (legacy method)	Likely in use for 47 enrolled	LEGACY

Global Administrator Accounts

Display Name	UPN	Role	Risk
Michael Schaller	mike@amalficompany.com	Global Administrator	PERMANENT — no PIM
Michael Esteves	mike.e@amalficompany.com	Global Administrator	PERMANENT — no PIM
Dillan Govender	Dillan@amalficompany.com	Global Administrator	PERMANENT — no PIM
Gregory Moschides	greg@amalficompany.com	Global Administrator	PERMANENT — no PIM

Best practice: max 2 cloud-only break-glass GA accounts + PIM just-in-time activation for all privileged roles. Four permanent GAs is double the recommended maximum.

Privileged Role Assignments

Role	Members	Risk Level
Global Administrator	4	CRITICAL
Exchange Administrator	7	HIGH — over-assigned
User Administrator	7	HIGH — over-assigned
Helpdesk Administrator	7	MEDIUM
Teams Administrator	5	MEDIUM
SharePoint Administrator	4	MEDIUM
Billing Administrator	2	MEDIUM
Intune Administrator	1	LOW
Global Reader	4	LOW
AI Administrator	2	LOW

Conditional Access & Authentication Policy

Check	Result	Status
Conditional Access policies	Unable to verify — Policy.Read.All permission not granted to audit app. Admin consent required to complete this check.	UNVERIFIED
Legacy authentication block (CA)	Unable to verify — requires Conditional Access query permission	UNVERIFIED
Device compliance enforcement	Unable to verify — requires Conditional Access query permission	UNVERIFIED
Named locations (trusted IPs)	Unable to verify — Policy.Read.All permission not granted	UNVERIFIED
PIM eligible assignments	Unable to verify — permission not granted. AAD P2 is licensed for 1 user only; PIM at scale requires per-user P2 licensing.	UNVERIFIED
Password expiry policy	Never expires (2,147,483,647 days)	REVIEW
Guest users	51 in tenant	REVIEW

0/3

Primary Domains with DMARC

0/3

Primary Domains with DKIM

1

Defender for O365 Licences

✓

SPF Configured (all domains)

DMARC / DKIM / SPF — Primary Amalfi Domains

Domain	DMARC	DKIM	SPF	Risk
amalficompany.com	MISSING	MISSING	-all ✓	FULLY SPOOFABLE
amalfioutsourcing.com	MISSING	MISSING	-all ✓	FULLY SPOOFABLE
amalfiagents.com (default)	MISSING	MISSING	-all ✓	FULLY SPOOFABLE

Microsoft Defender for Office 365

Check	Result	Status
Defender for Office 365 plan	F2 — 1 licence only	INSUFFICIENT COVERAGE
Safe Attachments	Cannot verify (insufficient permissions)	UNVERIFIED
Safe Links	Cannot verify (insufficient permissions)	UNVERIFIED
Anti-phishing policies	Cannot verify (insufficient permissions)	UNVERIFIED
Mailbox audit logging	Cannot verify (insufficient permissions)	UNVERIFIED
Security alerts (last 20)	0 alerts — no monitoring active	REVIEW

⚠ Multi-Entity Tenant Architecture Discovered

18 domains spanning approximately 12 separate business entities are registered in a single Microsoft 365 tenant. All 635 users share one security boundary, one set of admin controls, and one compliance perimeter. A breach of any account provides potential lateral access across all entities. UK gambling operations in particular carry elevated regulatory risk in this configuration.

All 18 Verified Domains — Security Posture

Domain	Inferred Entity	DMARC	DKIM	SPF	Risk
amalfiagents.com *	Amalfi Outsourcing (BPO)	MISSING	MISSING	✓	P0
amalficompany.com	Amalfi Outsourcing (BPO)	MISSING	MISSING	✓	P0
amalfioutsourcing.com	Amalfi Outsourcing (BPO)	MISSING	MISSING	✓	P0
amalfiaffiliates.com	Amalfi Affiliates	MISSING	MISSING	✓	P0
choiceinsurance.co.za	Choice Insurance	MISSING	MISSING	✓	P0
eazylifelegal.com	Eazy Life Legal	MISSING	MISSING	✓	P0
solistrading.co	Solis Trading	MISSING	MISSING	✓	P0
superlottos.com	SuperLottos (Gambling)	MISSING	MISSING	✓	P0
777admin.com	777 Admin (Gambling)	MISSING	MISSING	✓	P0
bet7.co.za	Bet7 (Gambling SA)	MISSING	MISSING	✓	P0
onlybets.uk	OnlyBets (UK Gambling)	MISSING	MISSING	MISSING	P0
winnersweekly.co.uk	Winners Weekly (UK Gambling)	quarantine	✓	✓	P1
harbour-management.co.uk	Harbour Management (UK Property)	quarantine	MISSING	✓	P1
oceannetbroadband.co.uk	Ocean Net Broadband (UK)	reject ✓	MISSING	✓	P2
eazygrants.co.uk	Eazy Grants (UK)	quarantine	MISSING	✓	P1
Amalfiagents365.onmicrosoft.com	M365 system domain	N/A	N/A	N/A	SYSTEM
amalficompanyptyltd.onmicrosoft.com	M365 system domain	N/A	N/A	N/A	SYSTEM
amalficompanyltd.onmicrosoft.com	M365 system domain	N/A	N/A	N/A	SYSTEM

* Default domain

35.6%

Secure Score

37

Controls at Zero

0

Active Security Alerts

19

Broad OAuth Grants

Microsoft Secure Score — Top 10 Failures by Points Lost

Points Available	Control	Status
10.0	Ensure MFA is enabled for all users in administrative roles	NOT IMPLEMENTED
9.0	Remove unsafe permissions on sensitive Entra Connect accounts	NOT IMPLEMENTED
9.0	Identify Entra ID privileged accounts that are also privileged in Active Directory	NOT IMPLEMENTED
8.0	Locate accounts in built-in Operator Groups	NOT IMPLEMENTED
8.0	Unsafe permissions on the DnsAdmins group	NOT IMPLEMENTED
8.0	Remove unnecessary replication permissions for Entra Connect AD DS Connector Account	NOT IMPLEMENTED
8.0	Remove discoverable passwords in Active Directory account attributes	NOT IMPLEMENTED
8.0	Reversible passwords found in GPOs	NOT IMPLEMENTED
8.0	Enable Conditional Access policies to block legacy authentication	NOT IMPLEMENTED
7.0	Ensure phishing-resistant MFA strength is required for Administrators	NOT IMPLEMENTED

OAuth & App Consent

Check	Result	Status
Total OAuth2 permission grants	113	REVIEW
Grants with broad write scopes	19 (Mail.ReadWrite, Files.ReadWrite.All, etc.)	HIGH RISK
Pending admin consent requests	8 unreviewed	ACTION REQUIRED
Total enterprise applications	100	INFO

⚠ Critical: Multiple Licence Plans Suspended

5 licence plans are currently suspended. Azure AD Premium P2 — required for Conditional Access, PIM, and Identity Protection — is suspended. This is the direct root cause of 0 CA policies and 8% MFA enrollment. Business Premium and Business Essentials plans covering 386 users are also suspended, indicating a billing issue that may result in user access loss.

Licence Inventory

Licence	Assigned	Available	Status
Microsoft 365 Business Premium	261	274	SUSPENDED
Microsoft 365 Business Essentials	125	125	SUSPENDED
Exchange Enterprise (Plan 2)	18	18	SUSPENDED
Azure AD Premium P2	1	1	SUSPENDED
Power BI Pro	7	7	SUSPENDED
Exchange Online (Plan 1)	129	144	ACTIVE
Defender for Office 365 F2	1	1	ACTIVE
Microsoft 365 Copilot	1	1	ACTIVE
Power BI Premium Per User	1	1	ACTIVE
Flow Free	58	10,000	ACTIVE

App Registration Secrets

App Name	Secret Status	Risk
Noreply	Expired January 2025 (16+ months)	EXPIRED
Amalfi Outsourcing	Expired May 2025 (12+ months)	EXPIRED
test	Expired March 2026	EXPIRED — remove if unused
Other apps (6)	Active secrets	OK

Password Policy

Domain	Expiry Period	Notification	Assessment
amalficompany.com	Never (effectively)	14 days	Acceptable only if MFA enforced — currently it is not
amalfiagents.com	Never (effectively)	14 days	Same concern

Hybrid Active Directory Concerns (from Secure Score)

Issue	Risk
Unsafe permissions on Entra Connect AD DS Connector account	HIGH — lateral movement risk
Reversible passwords found in Group Policy Objects	HIGH — plaintext credential exposure
DnsAdmins group has unsafe permissions	HIGH — DNS hijack risk
Privileged accounts in both Entra ID and on-prem AD	MEDIUM — account dual exposure

POPIA Alignment (South Africa)

Requirement	Current State	Status
Access controls on personal data (s19)	92% of users without MFA, 0 CA policies	NON-COMPLIANT
Security safeguards (s19)	Secure Score 35.6%, suspended security licences	NON-COMPLIANT
Data minimisation	Cannot verify (permissions required)	UNVERIFIED
Breach notification capability	0 security alerts, no SIEM	AT RISK
Audit log retention	Cannot verify (permissions required)	UNVERIFIED
DLP policies	Cannot verify (permissions required)	UNVERIFIED

UK GDPR / UKGC (UK Operations)

Requirement	Current State	Status
Data security (Art. 32 UK GDPR)	No MFA, no CA, 35.6% Secure Score	NON-COMPLIANT
UKGC: adequate security controls for gambling operators	UK gambling entities share tenant with minimal controls	HIGH RISK
ICO registration validity	UK entity gap previously identified — registration may be invalid	REVIEW URGENTLY
Data subject access requests	Cannot verify DSAR capability	UNVERIFIED
Cross-border transfer disclosure	SA tenant processing UK subject data	DISCLOSE IN PRIVACY NOTICE

ICO Registration & UK Entity Gap

This finding requires legal and compliance expertise beyond the scope of internal IT remediation. Resolving UK data processing obligations, ICO registration status, and UKGC licence compliance requires specialist legal counsel and a structured compliance programme — not a configuration change.

12

Month Minimum Commitment

All retainer pricing is based on a 12-month minimum contract. Month-to-month arrangements are available at a 20% premium. Pricing reviewed annually.

Phase 1 — Emergency Remediation

R95,000 once-off

Covers all P0 findings. Delivered within 30 days of contract signature.

MFA rollout (583 users)Included
Conditional Access policy design + deployIncluded
DMARC + DKIM for 15 domainsIncluded
Licence audit + billing remediation planIncluded
Admin role cleanup + PIM setupIncluded
App secret rotation (3 expired)Included
P0 hybrid AD remediationIncluded

Monthly Managed Service

R305,000 /month

Comprehensive managed M365 security, compliance, and AI operations. 12-month minimum.

M365 Security Operations (635 users, 18 domains)R50,000
Identity Governance (MFA, CA, PIM, admin hygiene)R30,000
Email Security & DMARC Management (18 domains)R25,000
Compliance Management (POPIA + UK GDPR + UKGC)R60,000
Infrastructure & DNS ManagementR25,000
Alice — AI-Assisted OperationsR115,000
Total monthly retainerR305,000

Current Spend — Where the Money is Going

Based on the audit findings, the following areas represent confirmed or highly probable cost bleed and unquantified risk liability. Consolidated under a single managed service, the savings below are achievable in month one.

M365 Licence Spend — What You're Paying For vs What You're Getting

Finding (Audit-Confirmed)	Current State	Financial Impact	Estimated Monthly Saving / Value
Orphaned licences — disabled & departed users	Disabled accounts and departed staff identified in licence audit with active paid licences still assigned	Direct billing waste. You are paying per-seat for users who cannot log in and generate zero output.	R8,000–R25,000/month recoverable
AAD P2: 1 licence assigned for 635 users	Entra ID P2 is active but assigned to 1 user only. Identity Protection, PIM, and Conditional Access P2 features require a licence per user to function.	634 users have no access to Identity Protection, PIM just-in-time activation, or risk-based Conditional Access — despite the org paying for M365 services. Per-user P2 licensing is required to unlock these controls at scale.	Per-user P2 licensing unlocks full security stack
Microsoft Defender for Office 365 — unconfigured	Safe Links and Safe Attachments are not deployed across any users. Audit confirmed 0 active anti-phishing policies beyond defaults.	Features are included in your existing licence tier. Zero additional cost to activate. Currently delivering zero protection on a 600-user BPO handling UK client data.	Full activation at no extra licence cost
3 expired application secrets	Three registered applications have secrets past their expiry date. These apps continue to operate in a degraded or broken auth state.	Silent auth failures, potential access control gaps. Unrotated secrets are a standard vector for long-term credential abuse in compromised tenants.	Risk closure — no additional spend
18 domains — 12+ entities in one tenant	Audit identified 18 verified domains spanning approximately 12 separate business entities, all operating in a single unpartitioned tenant.	No data segregation between entities. A compromise of one entity = full access to all 18. Each entity's compliance obligations (POPIA, UK GDPR) apply independently — all are currently unmet.	Architecture remediation required

Unquantified Risk Liability — Sitting on the Balance Sheet Now

Risk	Current Status	Worst-Case Exposure	Probability (Unmanaged)
UK GDPR / ICO fine	UK entity dissolved. Processing UK data subjects without valid legal basis or registered entity.	£17.5M (~R420M)	High — active state, not theoretical
POPIA fine + enforcement	No privacy notice on public site. No DLP policies. No consent recording infrastructure.	R10,000,000	Medium — POPIA enforcement ramping
SSL certificate expiry (15 Jun 2026)	Let's Encrypt cert on shared hosting. Auto-renewal unconfirmed. 19 days from this report.	Full site down. BPO revenue halt.	High — 19 days, unconfirmed renewal
DMARC missing — domain spoofable	No DMARC policy on primary domain. Any actor can send email as @amalficompany.com.	BEC / phishing campaign against 600-staff workforce and UK clients	Ongoing — no fix in place
Credential compromise (8% MFA)	92% of staff have no MFA. No Conditional Access. Legacy auth unblocked.	Full tenant takeover via single credential	High — standard attack vector for BPOs

Consolidated Saving Estimate

Direct licence recoveries from the audit: R8,000–R25,000/month in orphaned seat savings, plus immediate activation of Defender for Office 365 and Conditional Access features already included in the existing licence — at zero additional cost. Against a R305,000 managed service retainer, those recovered features represent significant security uplift with no incremental spend. The risk liability column — £17.5M ICO exposure, R10M POPIA, BPO downtime from SSL expiry — sits unmanaged today.

Referral Programme — Reduce Your Monthly Fee

Introduce a qualified business to The Fourths and earn a graduated discount on your monthly retainer — applied from the month the referred client's contract commences. Discounts are cumulative up to a maximum of 15%.

Referrals	Discount	Monthly Retainer	Annual Value
0 (base)	—	R305,000	R3,660,000
1 qualifying referral	5% off	R289,750	R3,477,000
2 qualifying referrals	10% off	R274,500	R3,294,000
3+ qualifying referrals	15% off (cap)	R259,250	R3,111,000

Terms & Conditions: A qualifying referral is a business introduced by Amalfi Outsourcing (or its principals) that signs a minimum 12-month retainer contract with The Fourths. The discount is applied from the month the referred client's contract commences and first payment is received. Discounts are cumulative to a maximum of 15%. Referral discounts are not applied retroactively and do not apply to the once-off remediation fee. The Fourths reserves the right to verify qualifying status. Maximum discount: 15% (3+ referrals).

Contract Summary

Item	Amount	Notes
Phase 1 Emergency Remediation (once-off)	R95,000	Invoiced on contract signature. Due within 7 days.
Monthly Managed Service Retainer	R305,000/month	12-month minimum. First month due on commencement date.
Minimum 12-month commitment	R3,660,000	Plus once-off R95,000. Total minimum: R3,755,000.
Referral discount (per qualifying referral)	−5% per referral	Applied from month of referred client's contract start. Max 15% (3+ referrals).

Amalfi Outsourcing — M365 Tenant Audit