Microsoft secures the environment. Praxis Navigator measures the people in it.
Microsoft Defender, Secure Score, Purview and Entra ID report on your tenant's security posture. Praxis Navigator reads the same tenant to measure how your people actually behave inside it. This page shows which layer answers which question — and why you need both.
Layers, not gaps
Both Praxis Navigator and Microsoft read the same Microsoft 365 tenant. Microsoft secures it and reports its posture; Praxis Navigator measures the behavior of the people working inside it. Praxis Navigator is a Microsoft Marketplace SaaS partner, built on Microsoft's own data surface — it adds a layer, it does not replace one.
So this is not a question of which tool is better. It is a question of which layer answers which question, and the effectiveness regimes now ask about both.
What Microsoft 365 already tells you
Microsoft Defender
Defender protects email, endpoints, identities and cloud apps, and reports the threats it detected and stopped. It answers: what tried to get in, and did we block it? It is the layer most teams already trust for threat protection, and Praxis Navigator does not touch it.
Microsoft Secure Score
Secure Score rates how well your tenant is configured against Microsoft's recommended controls. It answers: is the environment set up securely? It measures configuration, which is a different thing from how people behave inside that configuration.
Microsoft Purview
Purview governs data — classification, data loss prevention, retention and compliance records. It answers: is sensitive data governed and are policy violations caught? It sees the data; it does not measure the habits of the people handling it over time.
Entra ID reporting
Entra ID reports identity and access events — sign-ins, MFA registration, risky sign-in detections. It answers: what happened at the identity layer? Those events are also a rich behavioral signal, which is where the two layers meet.
Available in Graph is not the same as measured
Much of this signal is reachable through the Microsoft Graph API, and a capable team can pull a first report from it. But a raw event count is not a behavior indicator. Turning signals into something comparable across teams and defensible over time — controlling for headcount, seasonality and method — is the work, and it is the honest version of the build-vs-buy question.
See what building it yourself from Graph actually takesPeer-reviewed field research
29–55%
of the variation in phishing susceptibility is attributable to organizational-level factors, not individual ones.
Measured across 83,269 employees in 510 organizations, using their real responses to phishing campaigns.
Petrič, G., & Roer, K. (2022). The impact of formal and informal organizational norms on susceptibility to phishing. Telematics and Informatics, 67, 101766. Licensed under CC BY 4.0.
One clause, two kinds of evidence
The effectiveness regimes ask about controls and about people. Microsoft's tenant reporting answers the first well. The same clause also asks for the second — and that is a different measurement.
| What your reports show | What the regulation asks for | What closes the gap |
|---|---|---|
| Secure Score, Defender and Purview reporting on your technical posture | NIS2 CIR Annex §7 — the effectiveness of risk-management measures, technical and organizational | Behavioral evidence for the human layer, read from the same tenant |
| Policy violations and configuration state | GDPR Art 32(1)(d) — a process for regularly testing, assessing and evaluating effectiveness | A behavioral baseline and trend showing how people actually handle data |
| Identity and access events from Entra ID | DORA Art 13(4) and 13(6) — monitoring the effectiveness of the resilience strategy over time | Before-and-after behavioral comparison across the workforce |
Neither layer substitutes for the other. Microsoft evidences the environment; Praxis Navigator evidences the people in it; the clause asks for both.
See what the effectiveness regimes actually requireHow Praxis Navigator measures the people layer
Praxis Navigator connects to your Microsoft 365 tenant read-only through the Graph API and turns the behavioral signal Microsoft already holds into rolling baselines and before-and-after evidence — across email handling, file sharing, collaboration and identity. You run the program; Praxis measures whether behavior changed.
How the layers fit
Microsoft secures the tenant — Defender, Secure Score, Purview and Entra ID report on threats, posture and configuration.
Praxis reads the same tenant — the Graph API surfaces how people actually behave inside it, read-only.
Baseline from day one — Microsoft's retained history gives a behavioral starting point immediately.
Measure change — tag an intervention and see before-and-after behavior across the workforce.
Evidence both layers — technical posture from Microsoft, human behavior from Praxis, for the same clause.
Which layer reports what
Microsoft 365 and Praxis Navigator report on different layers of the same tenant. This is the division of labour, not a scorecard.
| Capability | Microsoft 365 | Praxis Navigator | Together |
|---|---|---|---|
| Threat protection across email, endpoint and identity | Microsoft Defender | — | Microsoft blocks the threat; Praxis measures the behavior around it |
| Security configuration score | Microsoft Secure Score | — | Microsoft rates the setup; Praxis rates behavior over time |
| Data governance and DLP | Microsoft Purview | — | Microsoft governs the data; Praxis shows how people handle it |
| Identity and access reporting | Entra ID reporting | — | Microsoft logs the events; Praxis turns them into a behavioral trend |
| Behavioral baseline and before/after comparison | — | Yes, read-only from Microsoft 365 | The human-layer evidence tenant posture reports don't provide |
| Published pricing, self-serve signup | Published Microsoft 365 plans | Yes | Both buyable without a sales call |
| Dedicated environment per customer | Your own tenant | Yes — dedicated Azure | No pooled tenant data |
| Behavioral evidence independent of any single control | Posture and events | Yes | Human-layer evidence that survives a config or vendor change |
Pricing you can see
Our prices are published. Use the calculator, see your number, start a trial — no sales call, no qualification, no quote request. Most platforms in this category will not tell you the price without a meeting first.
See the priceQuestions security leaders ask
Is Praxis Navigator a competitor to Microsoft Defender?
Doesn’t Microsoft Secure Score already measure this?
If the data is in Microsoft Graph, can’t we just read it ourselves?
Does Microsoft 365 reporting satisfy NIS2, DORA or GDPR effectiveness requirements?
What does Praxis Navigator read from Microsoft 365?
How quickly can I see results?
Measure the people in your tenant
Praxis Navigator reads the same Microsoft 365 data your tenant already produces — and turns it into behavioral evidence in 15 minutes.
Start your free 30-day trialNo credit card. No commitment. Results in 15 minutes, or don't continue.
See the price — published, no sales call required.
Read what the regulations require — NIS2, DORA and GDPR ask about the people, not just the posture.