FAQ

Frequently Asked Questions

Everything you need to know about Circle360 AI assessments.

📊 Results & Value

On average, companies discover 47 findings including 3 critical attack paths. About 35% of these are risks that were never caught by existing tools — things like cross-service attack chains, misconfigured guest access combined with overshared SharePoint sites, or legacy authentication quietly enabled for a subset of users. The most common reaction: "We had no idea this was exposed."
Secure Score checks individual settings in isolation. Circle360 AI correlates across all 9 M365 services to find attack chains — like a guest user in Teams combined with external sharing in SharePoint combined with no Conditional Access, creating a data exfiltration path. We also adjust for your org size (a 50-person company has different risk thresholds than a Fortune 500), your license tier (no flagging features you can't use), and your identity architecture (federation-aware analysis eliminates false positives).
A traditional consultant-led M365 security assessment takes 4-6 weeks and costs $15-30K in professional services. Circle360 AI delivers a more comprehensive assessment (600+ checks vs. typical 50-100 manual checks) in under an hour. Most companies fix their critical risks within days of seeing their report — not weeks. For MSPs, the ROI multiplies: run assessments across your entire client base with the same tool and demonstrate measurable improvement over time.

🚀 Getting Started

Under an hour. Data collection takes 15-30 minutes depending on tenant size, analysis runs automatically, and you'll have a complete 360° assessment report ready for review. No waiting days or weeks for consultants.
We provide an automated deployment wizard that handles everything:
  • Creates the Azure AD / Entra ID app registration automatically
  • Configures all 55 required Microsoft Graph API permissions
  • Generates secure credentials encrypted with your password
  • Grants admin consent with one click
  • Validates the setup before your first assessment
The entire setup takes about 5 minutes with a Global Administrator account.

🔐 Security & Access

Read-only access only. We use 55 Microsoft Graph API permissions, all with .Read scope — no write access, no changes to your environment. We look, we don't touch.
View all 55 Graph API permissions (read-only)
Identity & Directory (18)
Directory.Read.All User.Read.All Group.Read.All RoleManagement.Read.All Organization.Read.All Policy.Read.All IdentityRiskEvent.Read.All IdentityRiskyUser.Read.All Application.Read.All PrivilegedAccess.Read.AzureAD UserAuthenticationMethod.Read.All Domain.Read.All RoleEligibilitySchedule.Read.Directory RoleAssignmentSchedule.Read.Directory OnPremDirectorySynchronization.Read.All CustomSecAttributeDefinition.Read.All CrossTenantInformation.ReadBasic.All AccessReview.Read.All
Conditional Access (2)
Policy.Read.ConditionalAccess AuthenticationContext.Read.All
Security & Compliance (12)
SecurityEvents.Read.All SecurityActions.Read.All ThreatIndicators.Read.All SecurityIncident.Read.All SecurityAlert.Read.All InformationProtectionPolicy.Read.All ThreatSubmission.Read.All AttackSimulation.Read.All eDiscovery.Read.All RecordsManagement.Read.All InformationProtectionContent.Read.All SubjectRightsRequest.Read.All
Device Management (5)
DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All DeviceManagementApps.Read.All DeviceManagementServiceConfig.Read.All DeviceManagementRBAC.Read.All
SharePoint (1)
Sites.Read.All
Exchange & Mail (3)
Mail.Read MailboxSettings.Read Mail.ReadBasic.All
Microsoft Teams (5)
Team.ReadBasic.All TeamMember.Read.All AppCatalog.Read.All Channel.ReadBasic.All TeamworkTag.Read.All
Microsoft Defender (4)
ThreatHunting.Read.All SecurityAnalyzedMessage.Read.All ThreatAssessment.Read.All ThreatIntelligence.Read.All
Reports & Audit (4)
Reports.Read.All ReportSettings.Read.All AuditLog.Read.All DirectoryRecommendations.Read.All
Your data is protected throughout the entire process. Circle360 AI is designed with data privacy as a core principle:
  • Secure Handoff: You provide an encrypted credentials file. We handle the assessment — you never need to run anything yourself.
  • Encrypted at Rest & In Transit: All data is encrypted during transmission and while stored during processing.
  • Temporary Retention: Assessment data is retained only while your report is being generated. Once complete, all tenant data is permanently deleted.
  • Read-Only Access: All API calls are read-only. We cannot modify, delete, or change anything in your environment.
We believe security tools shouldn't create new security risks. Your data is handled with the same rigor we'd expect for our own.

📋 Compliance & Frameworks

We map findings to four major frameworks with our 3-tier confidence system:
  • CIS Microsoft 365 Benchmark v6.0: Direct control verification via Graph API
  • NIST Cybersecurity Framework 2.0: Mapped to all 6 functions (Govern, Identify, Protect, Detect, Respond, Recover)
  • ISO 27001:2022: Annex A control alignment
  • GDPR Article 32: Technical measure verification
Each mapping shows its confidence tier: Verified (direct evidence), Mapped (strong correlation), or Aligned (conceptual match). No inflated compliance claims.
Circle360 AI works with any M365 tenant, but some checks require specific licenses:
  • Basic Assessment: Works with M365 Business Basic and above
  • Identity Protection: Azure AD Premium P2 for risk detection features
  • Device Management: Intune licenses for endpoint checks
  • Advanced Threat: Defender for Office 365 P2 for attack simulation data
Our license-aware analysis automatically detects your license tier and adjusts finding severity accordingly. You won't be flagged for missing features you can't use.

⚡ Advanced Features

Yes. Our multi-tenant system supports MSPs and enterprises with multiple M365 environments:
  • Register unlimited tenants with unique credentials
  • Run assessments independently per tenant
  • Track assessment history with timestamped snapshots
  • Generate comparison reports to show improvement over time
Perfect for demonstrating remediation progress to clients or management.
Circle360 AI is federation-aware — an industry first. We automatically detect:
  • Which domains use federated vs. managed authentication
  • Whether your IdP declares MFA support
  • How Entra ID handles IdP MFA claims
This means no false positives like "MFA not configured" when your Okta or ADFS handles authentication. We adjust MFA coverage calculations and Conditional Access analysis based on your actual identity architecture.

Still have questions?

Schedule a demo and we'll walk you through everything.

Request a Demo →