Find and fix your Microsoft 365 & Google Workspace security gaps

Automated SOC 2 / ISO 27001 / CIS / HIPAA readiness — assess your tenant, then remediate in a click.

Sign in with Microsoft 365 or Google Workspace and get an auditor-ready assessment of your identity, admin access, MFA, logging, and data-sharing controls. Then apply guided, safe fixes — on Microsoft, Conditional Access changes start in report-only mode so nothing breaks. The scan runs entirely in your browser; your tenant data never reaches our servers.

Run your free scan → See what we check
Microsoft 365 & Google Workspace
Verified Microsoft publisher
Read-only — runs in your browser, data never leaves
Find and fix — guided remediation

Why LockList Security?

Enterprise-grade security assessment tools designed for compliance teams and auditors

🔒

Zero Token Storage

Your Microsoft 365 access tokens never leave your browser. We use delegated authentication—you sign in, we scan, you get results. No persistent access, no security risk.

📊

Evidence-Ready Reports

Download comprehensive reports in PDF, CSV, and JSONL formats. Each scan includes raw evidence from Microsoft Graph API, perfect for auditor verification and compliance documentation.

One-Time Scans

No ongoing monitoring, no data retention. Run assessments on-demand when you need them. Perfect for pre-audit preparation, compliance reviews, and security assessments.

🎯

Multi-Framework Mapping

Every finding maps to SOC 2, ISO 27001, CIS Microsoft 365, and the HIPAA Security Rule — so you see exactly which controls you meet and where the gaps are, in your auditor's language.

🔍

Comprehensive Coverage

Microsoft 365: 20+ checks across identity, Conditional Access, privileged access, audit logging, devices (Intune), and data sharing. Google Workspace: 2-Step Verification, admin access, audit logs, domains and more — evaluated against Microsoft, Google, and CIS baselines.

🛠️

Fix, Don't Just Find

The scan is read-only. When you're ready, apply guided remediations with one click — and Conditional Access fixes start in report-only mode, so you review the impact before anything is enforced.

👁️

Open Source & Auditable

The full source code is public on GitHub. You can read every line of code that touches your data before you run it. No black boxes — exactly what you need for a security tool.

🔒 Runs in your browser

Your data never reaches our servers

The assessment runs entirely in your browser. Your tenant data is read directly from Microsoft or Google and is never sent to or stored by LockList.

🌐

Runs in your browser

The scan executes as client-side code in your browser and calls your provider's API directly. There is no LockList server in the path reading your tenant.

🔑

Token stays with you

Your Microsoft / Google access token stays in your browser, is used only to read your settings, and is never transmitted to or stored by us. It expires on its own.

📡

Talks only to your provider

During a scan the only outbound calls are to graph.microsoft.com / admin.googleapis.com and the provider's own login — nowhere else.

🗄️

Nothing stored

We keep no database of scans and no user accounts. Results live only in your browser tab for the session; closing it clears them.

👁️

Read-only by default

The assessment requests read-only permissions. Any fixes are opt-in, require your explicit approval, and Conditional Access changes start in report-only mode.

📵

No telemetry

No analytics SDK, no tracking, no usage collection. See our Privacy Policy for the full detail.

✓ Your browser → Signs in with Microsoft / Google (MSAL / Google Identity Services) ✓ Your browser → Reads your tenant directly from the provider API (read-only) ✓ Your browser → Evaluates findings and renders results locally → On download → Results sent to our Worker only to build the file, then discarded ✗ Never → No token storage, no tenant-data retention, no telemetry ✓ Verified → Microsoft verified publisher · read our Privacy Policy

Compliance Control Coverage

Every finding maps to SOC 2, ISO 27001, the CIS Microsoft 365 / Google Workspace Benchmarks, and the HIPAA Security Rule

CC6.1 — Logical Access

MFA for Admin Roles

Verifies that Conditional Access policies exist and are enabled for privileged roles. Checks that MFA is required in grant controls and that policies target admin role assignments. Critical for preventing unauthorized administrative access.

CC6.1 — Logical Access

MFA for All Users

Evaluates organization-wide MFA enforcement through Conditional Access. Confirms policies include all users and require MFA before granting access to cloud applications. Ensures comprehensive protection across your entire tenant.

CC6.1 — Logical Access

Block Legacy Authentication

Detects policies that block legacy authentication protocols (basic auth, IMAP, POP). Legacy protocols bypass MFA and modern security controls, making them a significant attack vector. We verify blocking policies are in place.

CC6.1 — Logical Access

Privileged Role Assignments

Inventories all directory role assignments in your tenant. Flags excessive assignments (>10) as potential over-provisioning. Recommends Privileged Identity Management (PIM) and least privilege principles for better access control.

CC6.1 — Logical Access

Directory Roles & Membership

Audits Entra ID directory roles and member counts. Provides visibility into who holds sensitive roles like Global Admin, Privileged Role Admin, and Security Admin. Essential for access governance and compliance.

CC6.1 — Logical Access

MFA Registration Coverage

Calculates the percentage of users with MFA methods registered. Target is ≥95% coverage. Pulls data from Microsoft's authentication methods user registration report to provide accurate metrics.

CC6.1 — Logical Access

Per-User Auth Methods

Samples authentication methods registered per user. Validates that admins and high-risk accounts use strong methods like Microsoft Authenticator or FIDO2 security keys, not weaker SMS or phone-based MFA.

CC7.4 — Monitoring

Sign-In Logs

Verifies access to sign-in logs via Microsoft Graph API. These logs are essential for detecting failed login attempts, legacy client usage, anomalous access patterns, and potential security incidents.

CC7.4 — Monitoring

Directory Audit Logs

Confirms access to directory audit logs that capture administrative actions. Logs include role changes, app consent grants, user modifications, and other critical changes. Required for change management evidence.

CC7.4 — Monitoring

Applied CA Policies in Logs

Validates that sign-in logs include appliedConditionalAccessPolicies field. This confirms policy evaluation visibility in your audit trail, essential for understanding why access was granted or denied.

General

Tenant Licensing

Retrieves subscribed SKUs to explain feature availability. Conditional Access requires Entra ID P1 or P2 licenses, while Security Defaults are available on the free tier. Helps understand control limitations.

Technical Architecture

Built on Microsoft Graph and the Google Workspace Admin SDK with delegated authentication—secure, transparent, and evidence-ready

Technology Stack

Authentication
MSAL.js / Google Identity Services
APIs
Microsoft Graph / Google Admin SDK (delegated)
Hosting
Cloudflare Pages + Workers (TypeScript)
Evidence
PDF / CSV / JSONL / SOC 2 JSON

Authentication Flow

LockList uses delegated authentication. Your browser obtains an access token directly from your provider and calls the provider's API from the browser — the token and your tenant data never pass through our servers.

# Step 1: Admin signs in with Microsoft 365 or Google Workspace # Step 2: Browser obtains a delegated access token (MSAL.js / Google Identity Services) # Step 3: Browser calls the provider API directly and evaluates findings locally # Step 4: Only on report download are results sent to our Worker to build the file
AdminAccess Token (in browser)Microsoft Graph / Google Admin SDK
# e.g. /identity/conditionalAccess/policies, /auditLogs/signIns (Microsoft) # e.g. /admin/directory/v1/users, /admin/reports/v1/activity/... (Google)

Microsoft Graph Permissions

The assessment uses delegated (user-context), read-only permissions; admin consent is required. Write permissions are requested only if you choose to apply a fix — incrementally, one fix at a time, never as application-level access. (Google Workspace uses the equivalent read-only Admin SDK scopes.)

  • AuditLog.Read.All Access to sign-in logs and directory audit logs for security monitoring and compliance evidence
  • Directory.Read.All Read users, directory roles, and group memberships to assess access governance
  • Policy.Read.All Read Conditional Access policies to evaluate MFA and authentication controls
  • RoleManagement.Read.Directory Read role assignments to inventory privileged access and identify over-provisioning
  • UserAuthenticationMethod.Read.All Read MFA registration status and authentication methods per user
  • Organization.Read.All Read tenant information and subscribed SKUs to understand feature availability

Evidence & Reports

Each scan produces downloadable artifacts suitable for SOC2 audit documentation and compliance reviews.

  • PDF Report Formatted summary with pass/fail status, severity ratings, detailed summaries, and step-by-step remediation guidance. Perfect for executive summaries and auditor presentations.
  • CSV Results Tabular data export for spreadsheet analysis, tracking changes over time, and integration with compliance management tools.
  • JSONL Evidence Machine-readable evidence with raw Microsoft Graph API responses. Includes policy configurations, role assignments, and audit log samples for auditor verification.

Run your assessment

Sign in with Microsoft 365 or Google Workspace, get auditor-ready results in minutes — then fix what's wrong.

🌐

Scan in your browser

Nothing to install. Sign in with Microsoft 365 or Google Workspace and the assessment runs entirely in your browser — your tenant data is read directly from Microsoft/Google and never sent to our servers.

  • ✓ Microsoft 365 & Google Workspace
  • ✓ Read-only scan; nothing stored
  • ✓ Guided one-click fixes when you're ready
Run your scan →

The assessment is free. Unlock the full multi-format report (PDF, CSV, JSONL, SOC 2 JSON) and guided auto-fix with a one-time payment.