Surpoint
esen

Microsoft 365 governance

Microsoft tells you what's wrong. PraxIA365 tells you what to do, who fixes it, and where.

It reviews your entire Microsoft 365 tenant in read-only mode and tells you what to fix first, why, who owns each item, and which admin center screen to fix it in. And it maps each finding to the regulations you choose, section by section.

See what it reviews
  • Read-only
  • Metadata and permissions only
  • Flat fee per organization
PraxIA365

A Surpoint product

Finding · Apps

High

App with high-risk permissions and no owner

Action
Assign an owner or disable it
Effort
Low
Owner
Security team
Linked to
PIPEDA 4.7 · NIST CSF PR.AA
Open in Microsoft Entra

Illustration with fictitious data.

Visibility. Control. Evidence.

The problem

“Governing Microsoft 365 is a seven-headed beast.”

Seven or more admin centers. Microsoft 365, Entra, Exchange, SharePoint, Teams, Intune, Power Platform, Power BI and Purview, each with its own menus, licensing and changes.

The lists never end. Thousands of accounts, apps, sites and reports, and no one knows where to start.

The tenant is alive. Every day someone invites an outside guest, consents to an app, shares a file with “Anyone” or publishes a Power BI report to the web.

There's never enough time. With so many priorities, a deep review keeps getting pushed back. Meanwhile, privacy rules keep getting stricter.

What PraxIA365 does

1

It tells you what to do, not just what's wrong.

Every finding comes with a concrete action, why it matters, how much effort it takes, and a direct link to the exact Microsoft admin screen where you fix it.

2

From finding to owner.

It shows who owns each object. Email them a plain-language explanation of the problem, or assign the task to your team. The next day, PraxIA365 checks whether it was fixed.

3

The regulations you answer to, section by section.

In the settings you choose the rules that apply to your organization. Each finding maps to them and, for each one, PraxIA365 builds an evidence folder for your privacy officer or auditor: what's open, what's closed, and who approved each exception.

See available regulations

One list for the whole tenant

What is spread across several portals today sits in one place, ranked by severity and effort, with an owner and follow-up until it's closed.

Identities

Inactive guests and accounts, admins without MFA.

Apps

Unused, with high-risk permissions, or without an owner.

Licenses

Paid for but unused.

SharePoint, Teams and OneDrive

Shared externally, without an owner, or inactive.

Power BI

Published to the web or dependent on a personal Excel file.

AI agents and Copilot

Shared with the whole organization, without a sponsor, or highly privileged.

Risky tenant settings

No conditional access, legacy authentication left open, or too many global admins.

Everything ranked by severity.

  • Critical
  • High
  • Medium
  • Low

Regulations

You choose the regulations, in the settings

Each organization selects the rules it answers to, and PraxIA365 maps findings to those only, section by section. These are the ones you can select:

CL

Chile

  • Law 21.719

    Personal data protection

  • Law 21.663

    Cybersecurity framework

  • Law 21.459

    Computer crimes

CA

Canada

  • PIPEDA

    Federal personal information protection

  • Quebec's Law 25

    Personal information protection in Quebec

US

United States

  • CCPA

    California consumer privacy

  • HIPAA

    Health information

  • GLBA

    Customer financial data

INT

International

  • NIST CSF 2.0

    NIST Cybersecurity Framework

PraxIA365 measures technical controls in Microsoft 365. It is not legal advice and does not certify compliance with any law or standard.

How it works

  1. 01

    Connect

    Your admin reviews and approves read-only permissions.

  2. 02

    Review

    You get the prioritized list, with evidence for every case.

  3. 03

    Improve

    Week by week, your team closes tasks and PraxIA365 tracks progress.

“Isn't this what Microsoft already gives me?”

Fair question. Here's the honest answer:

Microsoft gives you

Secure Score: how many points your configuration is missing.

PraxIA365 adds

Which account, which app, which Power BI report and which file, and who owns each one.

Microsoft gives you

Recommendations across 7+ portals, some only with extra per-user licenses.

PraxIA365 adds

One list, ranked by severity and effort, with an owner and follow-up until it's closed.

Microsoft gives you

Compliance Manager templates for PIPEDA, CCPA or NIST, sold as premium add-ons (E5 includes three).

PraxIA365 adds

The regulations you choose, Quebec's Law 25 and Chile's laws included, mapped object by object, with an evidence folder for each one.

Microsoft gives you

Usage reports.

PraxIA365 adds

The recommendation to drop the license nobody uses, from someone who doesn't sell licenses.

Microsoft gives you

A posture score.

PraxIA365 adds

A KPI for work done: how many findings your team closed, how fast, and how many were fixed just by notifying the owner.

Already on E5 or A5? PraxIA365 makes the most of what you pay for.

Built for large tenants

  • Groups by license type: students, faculty, staff, frontline workers, contractors and guests.
  • Your own calendars. Declare academic breaks, vacations, shift rotations and extended leave, such as parental leave, so people who are away aren't flagged as inactive.
  • Scale. Built for tenants with tens or hundreds of thousands of accounts.

Universities, enterprises and regulated organizations.

Your data, under your control

  • Read-only. It can't change anything in your tenant: you make the changes yourself, under your own sign-in.
  • It never reads the content of your files or emails. Only metadata and permissions.
  • A dedicated database per organization, in your cloud, in your data center, or managed by Surpoint.
  • AI explains, it doesn't decide. A “What does this mean?” button on every number and finding. The AI never receives names or emails.
  • Everything is logged: who decided what, and when. Accepting a risk requires a second approval and comes with an expiry date.

What your team gets

  • The list of what to do this week.
  • An optional weekly email summary, sent from your own mailbox.
  • A one-page executive report for leadership.
  • An evidence folder per regulation, ready to export.
  • English or Spanish, chosen by each user.

Priced per organization, not per user.

Most governance tools charge per user, per month: above 10,000 accounts, that's hard to justify. PraxIA365 charges a flat annual fee based on tenant size, so cleaning up accounts never costs you more.

Try it on your own tenant.

Over a read-only connection, we assess your Microsoft 365 and show you what we find.

PraxIA365 is not legal advice and does not certify compliance with any law or standard. Microsoft 365 and the products named are trademarks of Microsoft Corporation. PraxIA365 is not affiliated with or endorsed by Microsoft.