Your donor data. Your grants. Your inbox.
A nonprofit tenant holds everything a funder would ask about and everything a donor assumed you were protecting. It was usually configured during a migration years ago, by a volunteer or a vendor, and untouched since. We read it, tell you what is exposed in language your board will follow, and fix what needs fixing.
The grant changed under you
The Microsoft 365 Business Premium and Office 365 E1 grants ended at each nonprofit’s renewal from July 2025. What remains granted is up to 300 seats of Business Basic, which carries no Intune, no Entra ID P1 and no Defender. A lot of nonprofits lost security capability without anyone announcing it, and are still assuming they have protections that lapsed.
Nobody there is an administrator by trade
Your executive director does not have an IT department, and the person holding Global Administrator often inherited it because they were the one who set up the email. That is not a failure. It is the normal shape of a fifteen-person nonprofit. But it does mean nobody’s job is reading the security configuration.
An answer your board can read
The report is one page in plain English, which matters more here than anywhere else: the person who has to approve spending on it is a volunteer treasurer, not an engineer. No jargon, no severity matrix, and a clear line between what costs money and what does not.
Read
You grant read-only access from your own admin account. No agent, no install, nothing changed in your tenant. We check what is actually enforced against what everyone assumes is enforced. About forty minutes.
Report
One page, in plain language: what is exposed, what it would cost us to fix, and what you can fix yourself for nothing. No severity scores nobody can act on, and no findings padded in to make the list look longer.
Fix
We work the list in the order that actually reduces risk, starting with identity and then whatever your tenant needs. We write down what changed as we go, so the next person to read it is not starting from nothing.
We support what we configure. Changing security settings creates friction: lockouts, prompts, a restore someone needs today. Handing a client that friction with nobody to call is not a service.
What we check, and what we usually find
SS-01Rev 2026.2| No. | Check | Typical finding | Remark |
|---|---|---|---|
| 01 | Multifactor enforced, everyone | Partial | Exemptions added once and never removed |
| 02 | Legacy authentication closed | Open | Left on for equipment long since retired |
| 03 | Administrator accounts | Excess | Including people who left, and their sessions |
| 04 | Devices enrolled and encrypted | None | Personal laptops holding company records |
| 05 | A copy the tenant cannot reach | Absent | Microsoft protects the service, not your files |
| 06 | Licensing after the grant change | Basic | Premium grant ended in 2025; Basic drops Intune and Defender |
These are what we find most often in tenants that were configured once and not read since. Yours takes about forty minutes to check, and the report is yours whether or not you hire us.
Forty minutes. No obligation. The report is yours.
We read your tenant’s configuration. Nothing is changed. We send back a plain-language list of what is exposed, what it would cost to fix, and what you can fix yourself for free.
If you hire us for the fixes, the work is priced the way the report reads: a fixed price for a project, a flat monthly fee for ongoing work, and no hourly meter.
What we can see
Configuration only: whether multifactor authentication is registered, whether legacy protocols are blocked, how many devices are enrolled, which applications are consented, and what your subscriptions include. We read the settings, not the contents.
What we cannot do
Nothing can be changed, created or deleted. The permissions granted are read-only, and the tool that uses them has no ability to write. We cannot read your mail, your files or your messages, and we cannot send anything as anyone in your organization.
How to revoke it
In the Microsoft Entra admin center, open Enterprise applications, find Saint Sync in the list, and delete it. That removes our access immediately. You do not need to tell us, and you do not need our help to do it.
Or email us directly: info@saintsync.io
We’ll use your address to send the report and arrange the assessment. Nothing else, and no mailing list.