Read-only assessment tools that check your Microsoft 365 and Entra ID settings against NIST SP 800-171. Built for small defense contractors and the consultants who support them.
DoD suspended CMMC Phase 2 on July 13, 2026, so third-party C3PAO certification did not become a condition of award on November 10. A reform task force has sent recommendations to the DoD CIO; none have been approved. Everything below still applies, and an inaccurate self-assessment carries False Claims Act risk.
Status as of November 2026. Confirm current guidance before acting.
Start with the free Assay on your identity settings. Move to Pro when you need the whole tenant, a PDF your leadership will read, and evidence you can hand to a prime or an assessor.
One PowerShell script. 15 identity checks in Entra ID, each mapped to 800-171, with an HTML report that explains the fix.
52 checks across Identity, Exchange Online, email DNS, SharePoint and Intune, scored by severity, with output built for audits.
The fixes, written down. A hardening guide, a Conditional Access baseline you can import, and policy templates ready for your SSP.
High, medium and low findings are weighted 3, 2 and 1. A check that can't run in your tenant is listed as not evaluated, with the reason, and left out of the score instead of quietly passing.
| ID | Check | 800-171 |
|---|---|---|
| AA-01 | MFA required for all users | 3.5.3 |
| AA-02 | MFA required for Global Administrators | 3.5.3 |
| AA-03 | Legacy authentication blocked | 3.5.3, 3.1.1 |
| AA-04 | Global Administrator count is 2–4 | 3.1.5, 3.1.6 |
| AA-05 | Global Administrators are cloud-only | 3.1.5 |
| AA-06 | Guest directory access restricted | 3.1.1, 3.1.3 |
| AA-07 | Guest invitations limited | 3.1.1, 3.1.22 |
| AA-08 | Users cannot register applications | 3.4.9, 3.1.5 |
| AA-09 | User consent to apps restricted | 3.4.9, 3.1.1 |
| AA-10 | No stale member accounts | 3.5.6 |
| AA-11 | No stale guest accounts | 3.5.6 |
| AA-12 | SMS and voice MFA disabled | 3.5.3, 3.5.4 |
| AA-13 | Session lifetime limited | 3.1.11 |
| AA-14 | Managed device required | 3.1.1, 3.1.12 |
| AA-15 | Report-only CA policies flagged | Info |
Every request is a GET. The scripts never create, change or delete anything in your tenant. Sign in as Global Reader.
Policy.Read.AllDirectory.Read.AllRoleManagement.Read.DirectoryUser.Read.AllAuditLog.Read.AllThe scripts run on your workstation and talk only to Microsoft. Reports are written to your own folder. There's no Aurum Cyber server in the loop and nothing to upload.
Plain PowerShell you can read before you run. The free Assay is source-available on GitHub, so your team can review exactly what it does.
Every license includes 12 months of updates. Consultant tiers add client tenants, white-label reports and the right to use the M365 Kit with your clients.
For a contractor assessing its own tenants.
For independent consultants and small MSPs.
For firms with a bigger client book.
Hardening guide, 12-policy Conditional Access baseline with import script, and six Word policy templates mapped to 800-171. The free Assay is included.
Extra consultant seats are $150 per year. A client tenant counts once per license year, on its first run.
Launch offer: the first 20 Consultant buyers get 25% off year one in exchange for feedback on two real client runs.
A passing check means one setting is where it should be. Meeting an 800-171 requirement also takes policy, procedure and evidence that no script can see.
No. Both versions make read requests only. The free Assay asks for five delegated read permissions, listed above, and you can read the script before you run it.
Yes. Run the free Assay with -Environment USGov for GCC High or USGovDoD for DoD. The default covers commercial and GCC.
Most checks work on any Microsoft 365 plan. The stale-account checks need Entra ID P1 for last sign-in data. Without it they're skipped and everything else still runs.
No. The free Assay is licensed for use on your own organization's tenants under the PolyForm Internal Use license. Running it for clients or as part of a paid service needs a Consultant license.
Reports include real account names from your tenant, so treat them as internal. Keep them out of source control and don't post them unredacted.
No. It means the settings the tool looks at are in the expected state. Use the findings to fix configuration and to support your SSP, POA&M and self-assessment, alongside the policy and procedure work only your team can do.
./Invoke-AurumAssay.ps1 -Demo