GR IT ServicesDiscuss your audit

Service

Microsoft 365 tenant audit

A Microsoft 365 tenant audit is an independent review of how your tenant is configured. It examines identity, email, collaboration, application, logging, and data protection settings, and reports each finding with supporting evidence, business context, and a recommended action, sequenced into a remediation roadmap.

Discuss your audit
Assessment type
Configuration review
Delivery
Remote, worldwide
Access
Least privilege, time-bound
Output
Findings, evidence, roadmap

Seven control areas

The areas in your engagement, and the depth of review in each, are agreed during scoping. Coverage depends on your tenant licensing and the evidence available.

01

Identity and access

Microsoft Entra ID, authentication, Conditional Access, and privileged access

How people and administrators sign in, which conditions apply to that sign-in, and who holds privileged access.

Typical review points

  • Authentication methods and multifactor coverage
  • Conditional Access policy design, exclusions, and gaps
  • Privileged role assignments and emergency access accounts
  • Guest and external identity settings

Some capabilities, such as Privileged Identity Management, require additional licensing and are reviewed where licensed.

Microsoft documentation

02

Email protection

Exchange Online and email protection

How inbound and outbound mail is filtered and authenticated, and whether mailbox settings could be used to move data out unnoticed.

Typical review points

  • Anti-phishing, anti-spam, and anti-malware policies
  • SPF, DKIM, and DMARC for your sending domains
  • Automatic external forwarding and mail flow rules
  • Mailbox auditing configuration

Built-in protection applies to all cloud mailboxes. Microsoft Defender for Office 365 settings are reviewed where licensed.

Microsoft documentation

03

Collaboration and sharing

Teams, SharePoint, and OneDrive sharing and collaboration

How files, sites, and conversations are shared inside the organization and with people outside it.

Typical review points

  • External sharing levels for SharePoint and OneDrive
  • Default sharing link types and link expiration
  • Teams external access and guest access
  • Who can create groups, teams, and sites

Only the collaboration services your organization uses are in scope.

Microsoft documentation

04

Applications and consent

Enterprise applications, app consent, and service principals

Which applications can reach tenant data, what permissions they hold, and who granted them.

Typical review points

  • User and admin consent settings
  • Applications holding high-privilege permissions
  • Credentials and owners on app registrations
  • Unused or unattributed service principals

Line-of-business and third-party applications are reviewed for their tenant permissions, not their own code.

Microsoft documentation

05

Logging and monitoring

Audit logging, monitoring, and relevant Microsoft Defender capabilities

Whether activity is recorded, retained long enough to investigate, and reviewed by someone who can act on it.

Typical review points

  • Audit log status and retention
  • Alert policies and who receives them
  • Availability of sign-in and audit logs for investigations
  • Relevant Microsoft Defender configuration

Defender coverage depends on the products you license and the agreed scope.

Microsoft documentation

06

Data protection and governance

Data protection, retention, and governance settings where licensed

How sensitive information is classified, retained, and protected from oversharing.

Typical review points

  • Sensitivity labels and how they are published
  • Data loss prevention policies
  • Retention policies and retention labels
  • Ownership of data lifecycle decisions

Reviewed where licensed and included in the agreed scope.

Microsoft documentation

07

Licensing observations

Licensing observations where included in the agreed engagement

Where license entitlements and configuration do not line up, in either direction.

Typical review points

  • Security capabilities that are licensed but not configured
  • Assignment patterns that leave users outside a control
  • Observations to inform renewal and planning discussions

Included only when agreed in the engagement scope. This is an observation, not licensing advice from Microsoft.

How this complements Microsoft Secure Score

Microsoft Secure Score measures your security posture against Microsoft’s recommended actions. A contextual assessment adds an independent view of which gaps matter for your organization, how settings interact, and the order in which to address them.

“It isn’t an absolute measurement of how likely your system or data could be breached.”

Microsoft Learn, Microsoft Secure Score
Business context
Findings are rated against how your organization operates, including who uses which services and where sensitive data sits.
Configuration interactions
Settings are reviewed together. A single Conditional Access exclusion, for example, can weaken several otherwise sound policies at once.
Evidence quality
Each finding is backed by the configuration evidence that supports it, so your team can verify it rather than take it on trust.
Remediation sequencing
Changes are ordered by dependency and user impact, so fixes do not disrupt the business or each other.
Ownership and implementation
Each recommendation names the team best placed to act on it and what they should consider before making the change.

Secure Score remains a useful way to track progress over time. The two work well together.

When teams ask for an assessment

Most requests start with a specific question about the tenant. These are the most common.

  1. 01

    Reviewing an inherited tenant

    After a merger, an acquisition, or a change of IT provider, establish what was configured, by whom, and what it means now.

  2. 02

    Preparing for a security or governance review

    Understand the current configuration and gather supporting evidence before an internal review, a customer questionnaire, or an audit.

  3. 03

    Validating configuration after change

    Growth, restructuring, or new services can leave settings that no longer match how the organization works.

  4. 04

    Establishing a remediation backlog

    Turn a general concern into a prioritized list of changes, each with an owner, that your team can plan and track.

  5. 05

    Obtaining an independent second opinion

    Test your team’s or your provider’s view of the tenant against an independent review of the same configuration.

  6. Other

    A different situation?

    Describe what prompted the question, and we will help you decide whether an assessment is the right step.

    Discuss your audit

What a tenant audit is not

Knowing the limits of an assessment helps you decide what else your security program needs.

Not a penetration test
The assessment reviews configuration. It does not attempt to exploit weaknesses or simulate an attack.
Not a certification audit
It assesses configurations relevant to the frameworks you follow and supports evidence collection, but it does not certify compliance with any standard.
Not a guarantee
No assessment can guarantee security, prevent every breach, or produce a particular Microsoft Secure Score.
A point in time
Findings describe the configuration observed during the review window. Settings can change afterwards.

How an engagement runs

Scope and access are agreed first. Findings are validated with your team before they are final.

Read the full methodology

  1. 01

    Define scope and access requirements

    Agree which areas are in scope, the questions the assessment should answer, and the access and evidence handling the review needs.

  2. 02

    Review agreed configurations and evidence

    Examine the configuration of the in-scope areas and record the evidence behind each observation.

  3. 03

    Validate and prioritize findings

    Confirm each observation, remove false positives, and rate findings by severity and business context.

  4. 04

    Present recommendations and next steps

    Walk through the findings and the recommended sequence of changes with the people who will act on them.

Get a clear view of your tenant’s configuration.

Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.

Discuss your audit