How it works
Connect → scan → report → monitor
Built for MSPs who manage many small-business Microsoft 365 tenants.
1. Connect
Add the client by name and email domain. Halberd finds the Microsoft 365 tenant ID and creates a one-click admin-consent link. A Global Administrator of the client approves read-only access — you can open the link yourself if you administer their tenant, or email it to them.
2. Scan
Halberd reads only what it needs through Microsoft Graph: users and MFA registration, Security Defaults and Conditional Access, admin roles, connected apps, user-consent settings, sign-in logs (Entra ID P1) and Intune devices (if licensed). Nothing is changed in the tenant.
3. Report
Every check is a transparent rule mapped to the five Cyber Essentials control areas: Pass, Fail, Needs evidence or Manual, with plain-English fix steps. Download a white-label PDF with your logo, or CSVs of every table. Missing licences or permissions are explained, never hidden.
4. Monitor
Halberd re-scans on a schedule, tells you immediately if MFA enforcement is removed, summarises other changes weekly, and reminds you before each client's certificate expires.
What Halberd cannot check automatically
Boundary firewalls and routers, on-premises servers, apps that do not use Microsoft sign-in, and malware protection (unless you export Defender reports) appear as Manual checklist items with guidance and evidence upload, so nothing is forgotten.
See exactly which read-only permissions Halberd uses →
Important: Halberd is a readiness aid and does not issue or guarantee Cyber Essentials certification. Certification is awarded only by an IASME-licensed certification body after assessment. Halberd is not affiliated with or endorsed by the NCSC or IASME.
See where a client stands in minutes
Free Cloud scope & MFA check for one client tenant. No card needed.