FAQ
Frequently asked questions
Straight answers about scope, access, and how an engagement is agreed. Anything not covered here can be settled in a first conversation.
The assessment
What a tenant audit is, what it covers, and how it relates to Microsoft’s own tools.
What is a Microsoft 365 tenant audit?
A Microsoft 365 tenant audit is an independent review of how your tenant is configured. It examines identity, email, collaboration, application, logging, and data protection settings, then reports findings with supporting evidence and a prioritized remediation roadmap.
It is a configuration assessment. It is not a penetration test and not a formal certification audit.
What does the assessment cover?
Up to seven control areas: identity and access, email protection, collaboration and sharing, applications and consent, logging and monitoring, data protection and governance, and licensing observations.
The areas included in your engagement are agreed during scoping and depend on your licensing and the evidence available.
Is this a Microsoft service?
No. The assessment is provided by GR IT Services, an independent company. It is not affiliated with or endorsed by Microsoft.
Findings reference Microsoft’s public documentation where it helps your team understand or implement a recommendation.
How is this different from Microsoft Secure Score?
Microsoft Secure Score measures your security posture against Microsoft’s recommended actions, and Microsoft notes that it isn’t an absolute measurement of how likely your systems or data could be breached.
This assessment adds business context, reviews how settings interact, backs each finding with evidence, and sequences the remediation. The two are complementary, and Secure Score remains a useful way to track progress.
Do we need a particular Microsoft 365 license?
No particular license is needed to request an assessment. Licensing does determine which controls exist in your tenant, so some areas, such as Privileged Identity Management or advanced data protection features, are reviewed only where licensed.
Findings state where a recommendation depends on a license you may not have.
Access and changes
What the review needs from your tenant, and how any change is agreed.
What access is required?
It depends on the agreed scope and assessment method. The roles involved, who grants them, and how long access lasts are agreed before the engagement starts.
Access follows least privilege and is time-bound. Read-oriented roles are preferred wherever the assessment method allows.
Will the audit change our tenant settings?
Not without your agreement. The review examines and reports on configuration. Whether the engagement includes any remediation activity, and who carries it out, is agreed during scoping before work begins.
Working together
Who takes part, where you are, and how an engagement is agreed.
Can you work with our internal IT team or MSP?
Yes. The assessment is designed to work alongside the people who run your tenant. Your internal team or managed service provider can take part in scoping, answer questions during the review, and attend the findings walkthrough.
Do you work with customers outside your home country?
Yes. Assessments are delivered remotely for customers worldwide. Meeting times, working hours, and any data handling requirements specific to your country or sector are agreed during scoping.
How are scope, timing, and pricing determined?
Scope comes first, and timing and pricing follow from it. They depend on the size and complexity of your tenant, the control areas included, and the deliverables you need.
All three are confirmed in writing before the engagement starts.
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit