How to Turn a Microsoft 365 Security Audit Report Into a Remediation Roadmap With Claude

The short answer: Claude can turn a Microsoft 365 security audit report into a draft remediation roadmap in minutes: findings grouped by risk and effort, split into phases, with an owner and a dependency for each line. It works only from the text you give it. It does not connect to your tenant or check a single setting. Redact tenant IDs, domains, user names and IP addresses before you paste anything, and treat the output as a draft that a named person has to own.

You have just received a Microsoft 365 security audit report. It lists dozens of findings, each with a severity, some evidence and a recommendation. The business now wants to know what happens next, in what order, and what it will cost in time. This guide is for the IT manager at a firm of 20 to 500 staff who has to answer that, and who wants to use Claude to do the first draft of the answer.

It covers what to remove from the report before Claude sees it, a prompt you can copy, how to sanity-check what comes back, and where an AI-drafted roadmap stops being enough.

Why do audit reports get filed instead of acted on?

Most audit reports are organised the way the auditor worked, not the way the business will fix things. Findings appear by domain (identity, email, sharing, devices), and inside each domain by severity. That order is right for evidence and wrong for action.

Three things usually stall the report:

• No sequence. A critical finding that takes ten minutes sits next to a critical finding that needs a licence change and a month of user communication. Without a sequence, both wait.
• No owner. The report says what to fix. It rarely says who, because the auditor does not know your team.
• No budget shape. The finance director cannot approve "42 findings". They can approve "two weeks of configuration now, one licence decision next quarter, one project in next year's budget".

A remediation roadmap fixes those three things. It does not add new findings. It reorders the existing ones into work a business can schedule and fund.

What can Claude do with an audit report, and what can't it do?

Claude is good at the reorganising part of this job: reading a long document, grouping related items, spotting that two findings share a fix, and writing the same information in a different structure. It is not an auditor and it cannot see your environment.

• It reads what you give it. Paste the findings or attach the report where your Claude plan allows file uploads. Claude works from that text only.
• It does not access your tenant. In this workflow, Claude is not connected to Microsoft 365, Entra ID or any admin portal. It cannot confirm that a finding is still open, that a fix worked, or that a setting is what the report says.
• It can be wrong. It may misread a dependency, merge two findings that should stay separate, or estimate effort badly for your environment. Every line needs a human check.
• It does not replace the evidence. If the report is going to an insurer, an auditor or a client, the original findings and evidence stay the record. The roadmap is a plan, not proof.

If your firm has connected Claude to Microsoft 365 for other work, keep that separate. Turning an audit report into a plan needs no connector, and giving an AI tool more access than a task needs is exactly the kind of finding the audit itself would raise. Our guide to connecting Claude to Microsoft 365 with secure employee access covers that question.

What should you redact before giving the report to Claude?

An audit report is a map of your weaknesses. Before any of it leaves your control, strip what would help someone attack you and what identifies people.

Remove or replace

• Tenant identifiers. The tenant ID (a GUID), the tenant's onmicrosoft.com name and every custom domain. Replace with placeholders such as TENANT and DOMAIN-1.
• People. User principal names, display names and email addresses, especially for admin accounts and the accounts named in critical findings. Replace with roles: ADMIN-1, FINANCE-USER-2.
• Network and app details. Public IP addresses, named locations, application (client) IDs, service principal names and third-party app names granted permissions.
• Evidence extracts. Screenshots, sign-in log rows and exported settings. Claude needs the finding and the recommendation, not the raw evidence.
• Anything client-related. Site names or file paths that reveal a client, a deal or a matter.

Keep

• The finding title, severity and domain.
• The recommendation text.
• Effort or licence notes, if the report gives them.
• Any phase or reference number, so you can map the roadmap back to the report.

Check which Claude plan you are using

Data handling depends on the plan. Anthropic states that it does not use content from its commercial products (Claude for Work Team and Enterprise plans, and the API) to train its models unless the customer opts in, for example through its Development Partner Program. On the consumer Free, Pro and Max plans, model training depends on a privacy setting the user chooses. Read Anthropic's current privacy documentation for the plan you actually use, and follow your firm's AI policy. If there is no policy yet, that is worth fixing first; our AI support service helps firms write one and decide which tools staff may use, and our AI tools pricing page sets out reference prices for the main assistants.

How do you structure findings into a roadmap a business can fund?

Before writing the prompt, decide the shape you want back. A roadmap that works for a small or mid-size firm usually has four phases.

Sort by risk and cost to fix, not by the order in the report

Each finding gets two scores: how bad it is if exploited, and how much work it is to close. The useful order is high risk and low effort first, because those are the fixes that cut the most risk per hour. High risk and high effort comes next, planned as a project. Low risk and low effort fills gaps. Low risk and high effort is often deferred, with the reason written down.

Split into phases a budget can follow

• Phase 0, stabilise (the next two weeks). Critical findings that are configuration changes with licences you already own: multi-factor authentication gaps, legacy authentication, anonymous sharing links, external mail forwarding.
• Phase 1, harden (the next quarter). High findings that need planning or user communication: phishing-resistant sign-in methods, separate admin accounts, app consent controls, DMARC enforcement, device and app protection.
• Phase 2, govern (next budget cycle). Findings that need a licence decision, a policy or a project: data loss prevention, sensitivity labels, retention, longer log retention.
• Phase 3, sustain (ongoing). Recurring reviews, access reviews and a re-check against the original findings.

Brocent's own sample report uses this phase structure. You can read the sample Microsoft 365 security audit report online to see what a phased fix plan looks like when the auditor writes it; it uses a fictitious 14-person firm with 3 critical and 7 high findings.

A prompt you can copy

Paste the redacted findings after this prompt. Adjust the phase lengths to your team.

• Role and source — "You are helping an IT manager plan remediation. Use only the findings below. Do not add findings that are not in the list."
• Scoring — "For each finding, give risk (critical, high, medium, low, as stated in the report) and effort (small: under half a day; medium: up to three days; large: more), and say if effort is your estimate."
• Dependencies — "Flag any finding that depends on another being fixed first, and any finding that needs a licence the report says is missing."
• Grouping — "Group findings that are closed by the same change, and say which ones."
• Phases — "Place each finding in Phase 0 (two weeks, configuration only), Phase 1 (one quarter), Phase 2 (next budget cycle) or Phase 3 (ongoing). Give a one-line reason for each placement."
• Owner column — "Add an owner column with the role best placed to do the work, for example IT lead, Microsoft 365 administrator, HR, managing partner. Do not invent names."
• User impact — "Note any change users will notice, so it can be communicated in advance."
• Rules — "Keep the report's reference numbers. If anything is unclear, list it as a question at the end instead of guessing."

Ask for the result as a list grouped by phase. If you want a spreadsheet, ask Claude for a version with one finding per line and the columns above, then check it before it goes anywhere.

A worked example: three critical findings, reordered

Take three findings that appear, in some form, in many Microsoft 365 audits, including Brocent's sample report: two accounts can sign in without multi-factor authentication, one of them a Global Administrator; legacy authentication is not blocked and SMTP AUTH is enabled across the tenant; and anonymous "Anyone" sharing links are allowed and are the default on a client-facing site.

In the report they sit in three domains: identity, email and sharing. Claude, given the prompt above, will usually do three useful things with them:

• Put all three in Phase 0. They are critical, and each is closed by configuration the firm already licenses.
• Spot the dependency. Blocking legacy authentication can break an old scanner or a line-of-business app that sends mail with SMTP AUTH. The roadmap should list "inventory devices and apps that send mail" as a step before the block, not after.
• Flag the user impact. Turning on MFA for the two remaining accounts and changing the default sharing link both change what people see. Both need a short message to staff before the change, not after the helpdesk fills up.

What Claude cannot tell you is whether the scanner exists, whether the Global Administrator account is used by a person or a script, or whether a client relies on anonymous links. Those questions go to whoever knows the environment. The roadmap's value is that it makes them visible before the change, not that it answers them.

AI-drafted roadmap vs a managed remediation engagement

Both start from the same report. They differ in who carries the work after the plan is written.

• AI-drafted roadmap (you plus Claude) — Fast and cheap for the planning step. Good at structure, grouping and wording. Effort estimates are generic. No one is accountable for the result, nothing checks that a fix took effect, and the roadmap goes stale as soon as work starts unless someone maintains it.
• Managed remediation (a provider that owns the fixes) — The provider plans against your actual environment, makes the changes under change control, verifies each fix, and reports progress against the original findings. It costs more and needs a contract, but someone is answerable for every line. Brocent's managed IT security services cover this, including a prioritised remediation plan with budget estimates.
• The common middle — Many firms draft the roadmap with Claude, close Phase 0 themselves, and bring in a provider for Phase 1 and Phase 2, where licence decisions and user change management start to matter.

Getting it right: someone has to own each line

A roadmap without owners is a longer version of the report. Before it goes to the business, do four things.

• Name a person for every line. Replace the role Claude suggested with a name and a date.
• Check every effort estimate against your environment. Claude's estimates are general; your tenant has its own history.
• Keep the link to the evidence. Every roadmap line should carry the report's reference, so that when the auditor or an insurer asks whether F-01 was closed, you can show the before and after.
• Re-check, don't assume. When Phase 0 is done, confirm each setting in the admin portal or with a re-scan. A plan that says "done" and a tenant that says otherwise is the worst outcome.

If you have not had a Microsoft 365 audit yet, start with the report itself. Brocent's Microsoft 365 security audit runs the CIS Microsoft 365 Benchmark across the tenant and comes with a prioritised remediation roadmap, in a report designed to be used as evidence. If you already have a report from any provider and want help turning it into work, talk to our team.

Frequently asked questions

Can Claude read a PDF audit report directly?

On Claude plans that support file uploads, you can attach a PDF and Claude will read its text. Check Anthropic's current documentation for the file types and size limits on your plan. Redact the report first; for a long report it is often cleaner to paste only the findings table.

Does Claude connect to my Microsoft 365 tenant to check the findings?

Not in this workflow. Claude reads the text you give it and nothing else. It cannot confirm that a finding is still open or that a fix worked. Confirming that needs an administrator, the admin portals or a re-scan.

How do I estimate effort without a vendor quote?

Use the report's own effort notes if it has them. Otherwise ask Claude for a small, medium or large estimate with its reasoning, then adjust each one with whoever administers the tenant. Treat Claude's numbers as a starting point, not a quote.

What if two findings conflict on priority?

Ask Claude to list the conflict instead of resolving it. A common case is a critical identity fix that would break an old app. The usual answer is to fix the dependency first, but the decision belongs to someone who knows which app matters to the business.

Should the board see the raw findings or the roadmap?

Usually the roadmap, with a one-page summary: overall score, the critical items, what Phase 0 closes and what needs a budget decision. Keep the full findings available for the audit committee or anyone who asks for the evidence.

How often should the roadmap be revisited?

At the end of each phase, and whenever something changes the risk: a new licence, a merger, a security incident. A short monthly check of open items is enough for most firms of this size.

Is it safe to paste an audit report into an AI tool?

Only after redaction, and only into a tool and plan your firm has approved for confidential material. An unredacted audit report lists exactly where you are weakest. Remove tenant identifiers, people, network details and evidence first.