Every domain publishes a set of records that anyone can read. This checks the ones that matter and explains what they mean, in a minute, for nothing.
What this checks
Email security first: whether someone can send mail that appears to come from your business. Then your website's certificate and the protections it asks a browser for. Then what your domain says it runs.
What this does not do
Nothing is scanned and nothing is touched. Most of what this reports comes from records your domain already publishes, which you can verify yourself. The one exception is whether Microsoft's own directory recognises your domain, a separate, equally public lookup.
What it cannot see
This looks from the outside. It cannot see inside your Microsoft 365: who has multi-factor turned on, which accounts have admin rights, whether your backups have been tested, what you are paying for and not using. That is the free IT and security health check, and a person does it.