Microsoft 365 check
See from the outside whether a domain uses Microsoft 365, whether sign-in is cloud-based or federated, and whether email (MX, SPF, DKIM) is set up correctly. All without signing in.
About the Microsoft 365 check
What it does
Microsoft's public services are asked whether the domain runs Microsoft 365 and whether sign-in is cloud-based or federated. MX, autodiscover, SPF and DKIM for Microsoft 365 are then checked.
Why it matters
A lot is visible from the outside: federated sign-in is a larger attack surface, missing DKIM gets mail rejected. This is the first thing an attacker sees.