FAQ

Can Mito change anything in my tenant?

No. Mito’s app has only read permissions and the read-only Global Reader role, so Microsoft refuses any change it might attempt. See Permissions explained.

Who needs to do the setup?

A Global Administrator, or a Privileged Role Administrator together with an Application Administrator. It takes about 10 minutes. See Connect your tenant.

Which Microsoft 365 licences do I need?

None beyond what you have. Some checks look at features that need a particular licence (for example Conditional Access needs Entra ID P1, and Identity Protection needs Entra ID P2). When your tenant doesn’t have the licence, the check is reported as skipped rather than failed. Each check’s page lists the licence it needs.

Who in my organisation can see our findings?

Only the people your Microsoft 365 admin assigns the Mito Reader role on the Mito app in your tenant. Anyone else who signs in to the portal is refused. See Give your people access.

How often does Mito run?

Once a day, on a schedule in UAE time. Each run is compared with the previous one so you can see what changed.

A check failed. What do I do?

Open the check from your report (the Learn more link) or search this site for its ID. Each page explains what the check looks at and how to fix it, with links to Microsoft’s documentation. Fixing usually takes a few minutes in the relevant admin centre. Check the User impact row first: some fixes, such as blocking legacy authentication, can affect users on old devices.

Why are some checks skipped?

A check is skipped when Mito cannot evaluate it, for example:

• your tenant doesn’t have the licence the feature needs;
• the check needs a service Mito does not connect to (on-premises Active Directory, Azure DevOps, GitHub, Azure subscriptions);
• the app is missing a permission or the Global Reader role;
• the check is in preview and not enabled for your tenant.

Do I have to fix every failed check?

No. The checks follow recognised security baselines, but your business may have good reasons for some settings. Start with Critical and High severity failures; they give the most protection for the effort.

Where is my data stored?

In Microsoft Azure’s UAE North region. See Security and data residency.

What happens when the client secret expires?

Mito can no longer sign in and runs fail until a new secret is created. We remind you a month before the expiry date. Create a new secret on the app (Certificates & secrets → New client secret) and send us the new value over the secure link.

How do I stop using Mito?

Delete the Mito Assessment (read-only) app registration in your tenant. From then on Mito can no longer sign in. Let us know as well, so we can remove your results.

Where do Mito’s checks come from?

Mito’s assessment engine is based on open-source community checks and published security baselines: the CIS Microsoft 365 Foundations Benchmark, CISA’s SCuBA baselines and Microsoft’s own guidance. Test IDs starting with MT. are Mito checks; CIS., CISA., EIDSCA. and ORCA. checks come from the benchmarks and tools named in Security checks.

Can I see the code of a check?

Yes. The engine and its checks are open source; Open-source licences lists the projects they come from and their licences. Each check’s page names its source and authors.