Microsoft 365 security assessment
A scoped review of your Microsoft 365 tenant by people who investigate compromised tenants: identity, admin roles, mail flow, sharing, logging and devices, with each finding rated by how an attacker would actually use it.
Reviewed by the ITRS security team · Last updated
Why a tenant review is different from a general IT audit
A general IT audit asks whether controls exist. A tenant review asks whether they hold up against the attacks that actually happen to Microsoft 365 customers: phished passwords, token theft, malicious app consents, forwarding rules and compromised admin accounts. We look at the configuration the way an investigator does after an incident, except before one.
Microsoft Secure Score is a useful input, but it is not an assessment. It counts settings, weights them generically, and cannot tell you that the one account without MFA is your controller's, or that a former contractor still holds Global Administrator. Our findings come with that context.
What we review: identity, MFA, Conditional Access and admin roles
Identity is where most Microsoft 365 compromises start, so it gets the most attention. Reviews are done with read-only access wherever possible.
- MFA coverage across every user, guest and service account, and which methods are allowed (SMS and voice versus authenticator apps, passkeys and FIDO2 keys)
- Security defaults versus Conditional Access, and gaps in the policies you have: excluded users, legacy authentication, risky sign-ins, unmanaged devices
- Privileged roles in Microsoft Entra ID: who holds Global Administrator and other high-impact roles, whether admin accounts are separate from daily accounts, and break-glass account design
- Enterprise applications and OAuth consents, including whether users can grant apps access to their mailboxes
- Guest access and cross-tenant settings
- Stale, shared and unlicensed accounts that can still sign in
Mail: forwarding, authentication and Defender policies
- Automatic external forwarding: whether it is blocked, and existing rules or SMTP forwards that send mail outside
- Mailbox delegation and Send As permissions
- SPF, DKIM and DMARC on every domain you send from, and whether DMARC is enforced
- Microsoft Defender for Office 365 or Exchange Online Protection policies: anti-phishing impersonation protection, Safe Links, Safe Attachments, and quarantine handling
- Connectors and transport rules that bypass filtering
Data: sharing, retention and audit logging
These settings decide whether you can answer questions after an incident, which is where many tenants fall short.
- SharePoint and OneDrive external sharing levels, 'Anyone' links and their expiry
- Teams external access and guest settings
- Microsoft Purview Audit: whether auditing is on, and what retention your licences give you (Microsoft's documentation states Audit (Standard) keeps records for 180 days; longer retention requires Audit (Premium) licensing or retention policies)
- Mailbox auditing and sign-in log availability in Microsoft Entra
- Retention policies and labels, and whether anything would stop a departing user deleting their mailbox content
- Backup of Microsoft 365 data separate from Microsoft's own retention
Devices
Where Intune or another device management tool is in use, we check compliance policies, whether Conditional Access requires compliant or managed devices, BitLocker and FileVault status, and how personal devices are allowed to reach company data.
How findings are rated and reported
Each finding is rated on how likely it is to be used and what an attacker gains if it is, not on how many points it scores. We map findings to the Canadian Centre for Cyber Security's baseline cyber security controls for small and medium organizations so you can see which gaps are baseline issues and which are refinements.
- An executive summary a non-technical owner can read in five minutes
- Detailed findings with evidence (setting, current value, recommended value)
- A prioritized remediation plan, with quick wins separated from projects
| Rating | Meaning | Example |
|---|---|---|
Critical | Direct path to account takeover or data loss today | Admin account without MFA; legacy authentication open |
High | Likely to be used in a common attack | Users can consent to any app; external forwarding allowed |
Medium | Weakens detection or response | Audit retention too short for your risk; no alerts on new inbox rules |
Low | Hygiene and hardening | Unused licences on disabled accounts; inconsistent naming |
What happens after
You own the findings. Your internal IT team or current provider can fix them, and we will answer their questions. If you would rather we do the work, our Managed IT team can carry out remediation at our standard IT rate. Either way, a short re-check confirms the critical and high findings are closed.
If the assessment turns up signs of an existing compromise, such as unknown forwarding rules or sign-ins from unexpected countries, we stop and tell you before going any further. At that point it becomes an investigation, and evidence needs to be preserved before anything is changed.
FAQ
Read-only roles such as Global Reader and Security Reader cover most of the review. If a setting can only be read with higher privileges, we explain why and agree how it will be checked.
No. The assessment reads configuration and logs; nothing is changed without your approval.
No. A penetration test attempts to exploit weaknesses. A tenant assessment reviews configuration against how real attacks work. Many organizations do the assessment first, then test.
Yes, using the equivalent Google Admin console controls; the areas reviewed are the same: identity, mail, sharing, logging and devices.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyCleaning Up a Microsoft 365 Tenant for a Fire Protection & Security CompanyHow IT Rapid Support audited every Microsoft 365 group for a GTA fire protection company, fixed mail routing, and cut an 82,456-item mailbox by 62%.
Related.
- PracticeCyber Forensics & AssuranceIncident response, digital forensics, penetration testing and independent attestation.
- ServiceGoogle Workspace compromise investigationWhen a Gmail account in your Google Workspace organization is taken over, we use the Admin console's audit and investigation tools to establish what the attacker did…
- ServiceMicrosoft 365 and Exchange Online forensicsWhen a mailbox is taken over, a payment is redirected or an employee leaves with more than they should, the answers are in your Microsoft 365 tenant's logs.
- ServiceAttestation & AssessmentsIndependent security assessments, Microsoft 365 audits and attestation letters for clients, insurers and auditors.
- ArticleMicrosoft 365 Security Best Practices for 2026Eight settings that close the gaps we find most often in small-business Microsoft 365 tenants, each with where to find it and which licence it needs.
- ToolHow secure is your Microsoft 365 tenant?Work through 22 yes or no questions about identity, devices, email, data and monitoring.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.