Compromised email accounts
A weak, reused or stolen password can give an attacker access to years of correspondence, invoices and client details.
Microsoft 365 security · UK estate agencies
Know where your Microsoft 365 setup stands.
A short, practical security review for independent estate and letting agencies — focused on the everyday weaknesses that can contribute to compromised accounts, email fraud and payment fraud.
Free initial health check · read-only review · no obligation
Why it matters
The everyday risks are worth checking.
Estate and letting agencies handle sensitive correspondence, client information, deposits and payment instructions through email every day. Many useful security improvements come down to ordinary configuration and account hygiene rather than anything exotic.
Invoice and payment fraud
An attacker with access to a mailbox may monitor a transaction and intervene when payment instructions are being exchanged.
Suspicious forwarding rules
Hidden mailbox rules can redirect or hide correspondence without being obvious to the person using the account.
Weak or missing MFA
Where multi-factor authentication is not consistently enforced, a leaked password may be enough to access an inbox.
Excessive privileges
Accounts sometimes have more administrative access than their role requires, increasing the potential impact of compromise.
Unintended data exposure
Sharing and access settings can sometimes make documents, sites or information available more widely than intended.
The offer
A free Microsoft 365 Security Health Check.
A focused, read-only review of your Microsoft 365 tenant, designed specifically for small independent agencies. It is intended to be useful on its own, whether or not you work with Uriel Security afterwards.
- Who it’s for
- Independent estate and letting agencies using Microsoft 365.
- Your time
- Around 15–20 minutes to arrange read-only access and answer a few questions.
- Cost
- Free, with no obligation to purchase anything afterwards.
- Access
- Temporary, read-only access for the assessment. Nothing is changed as part of the review.
- 01What it isA structured review against a practical set of Microsoft 365 security checks.
- 02What’s reviewedAuthentication, privileges, mail flow rules, sharing settings and core tenant configuration.
- 03What you receiveA concise written report with clear priorities and practical recommendations.
- 04No obligationThe health check stands on its own. Any further work is entirely your choice.
Scope
What we check.
A focused set of checks aimed at common, actionable Microsoft 365 weaknesses in smaller organisations. The assessment is practical rather than exhaustive.
MFA and authentication
Whether multi-factor authentication is enabled and consistently enforced across staff and administrative accounts.
User and admin privileges
Who holds administrative access, and whether that access is broader than the role requires.
Core tenant configuration
Baseline Microsoft 365 security settings compared with sensible small-business expectations.
Mail forwarding and rules
Mailbox and transport rules that could silently redirect, hide or alter correspondence.
Account security
Sign-in activity, legacy authentication and other indicators of weaker account hygiene where available.
External sharing
How documents, sites and other resources can be shared outside the organisation.
Security defaults / Conditional Access
Whether Microsoft security defaults or Conditional Access are in place and sensible for the available licence.
Tenant security posture
A general view of configuration health, with anything unusual or unnecessarily exposed called out.
Practical agency checks
Additional checks relevant to how a small agency actually uses Microsoft 365 day to day.
This is a focused review, not a penetration test or exhaustive audit. It is designed to surface practical issues worth addressing, not to claim that every possible weakness has been found.
The outcome
A report you can actually use.
No raw technical export and no wall of jargon. The aim is to give an owner or director a clear view of what matters and what to do next.
Security Health Check — SummaryIllustrative layout
Authentication & MFAAction recommended
Mail flow rulesReviewed
External sharingAction recommended
- FindingsWhat was reviewed and what was found, described in plain language.
- Practical impactWhy each finding matters to the business, rather than an abstract severity score.
- Recommended actionsClear steps for you or your existing IT provider to consider.
- PrioritiesA short list of what to address first, so effort goes where it matters most.
Why Uriel
Quietly competent. Properly independent.
Uriel Security is a one-person consultancy. That is deliberate: the person you speak to is the person carrying out the assessment.
Direct access to the person doing the work
No account manager between you and the assessment.
Built for small businesses
Recommendations are sized to what a small agency can realistically act on.
Plain language
Findings are written for business owners and directors, not just technical teams.
No pressure to buy more
The free health check is intended to be useful in its own right.
About
Credentials, without the theatre.
Uriel Security is run by a single practitioner with a background spanning cybersecurity and incident management. Replace the placeholders below with the exact wording you want published before launch.
OCI Security Professional
Replace: exact certification title and date achieved.
Microsoft AZ-900
Microsoft Certified: Azure Fundamentals. Replace: date achieved.
MSc
Replace: degree title, institution and year.
Incident management
Replace: brief, accurate description of relevant experience.
Process
Three straightforward steps.
Designed to take as little of your time as possible.
- 01
Request the health check
Fill in the short form. We will get back to arrange access and answer any questions.
- 02
Complete the focused review
A read-only review is carried out against the checks described above.
- 03
Receive your written findings
You receive a plain-English report with findings, impact and recommended actions.
FAQ
Questions, answered plainly.
Is the health check really free?
Yes. There is no charge for the initial Microsoft 365 Security Health Check and no obligation to purchase anything afterwards.
Do you need access to our Microsoft 365 tenant?
Yes, temporary read-only access is needed to review the configuration properly. Access should be limited to what is required for the assessment and can be revoked by you.
Is the assessment read-only?
Yes. The health check is a review only. No settings, permissions or configuration are changed as part of the assessment.
How long does it take?
Arranging access and providing context typically takes around 15–20 minutes. The review itself is carried out separately and you will be told roughly when to expect the report.
Will you change anything in our system?
No. Any recommended changes are left for you or your IT provider to action, unless you separately ask Uriel Security to help with implementation.
What happens after the assessment?
You receive the written report and can act on it yourself, through your existing IT provider, or with further help from Uriel Security if you choose.
Do we need to become a client afterwards?
No. The health check is designed to be useful on its own. There is no expectation to engage Uriel Security for further work.
Next step
Request your free Microsoft 365 Security Health Check.
Tell us a little about your agency and we will be in touch to arrange the review.
hello@urielsecurity.co.uk
Uriel Security works remotely with independent agencies across the UK.