Microsoft 365 Security Assessment for UK Businesses: Fixed Price, Scope and Cyber Essentials Mapping

The short version: A UK business on Microsoft 365 usually needs one fixed-price, read-only assessment of its tenant against the CIS Benchmark, with the findings mapped to Cyber Essentials. Ours costs US$450 for up to 10 users and US$2,900 for 76–150, with a written report 5–7 business days after access. You save most by fixing the automatic-fail items before you book Cyber Essentials.

If you run a UK company on Microsoft 365, a security assessment usually comes up for one of three reasons: a customer or the public sector wants Cyber Essentials, an insurer's proposal form asks how your accounts are protected, or someone senior wants to know whether personal data in Outlook, SharePoint and Teams is actually safe. All three questions are answered by the same piece of work: a review of how your tenant is configured, graded against a recognised baseline, with a plan to fix what is wrong.

This guide explains what that work costs, what it covers, how it lines up with Cyber Essentials and UK GDPR, and how to avoid paying for more than you need. Where we quote a standard, we link to the source at the end.

What does a Microsoft 365 security assessment in the UK cost?

We price one product by headcount. The fee is fixed before we start and is the same in every country, so a firm in Leeds pays what a firm in Singapore pays for the same number of users. All figures are one-off, in US dollars and exclude tax:

• 1–10 users: US$450
• 11–25 users: US$990
• 26–75 users: US$1,800
• 76–150 users: US$2,900
• Above 150 users: quoted as a fixed fee after a short scoping call

There is no day rate and no "number of days to be agreed". The scope is identical in every band: a 10-person practice gets the same checks as a 150-person company, the report is simply shorter. Any current offer, the optional monthly monitoring plan and the larger-tenant options are on the Microsoft 365 security assessment UK pricing page, which is always the current source for prices.

We publish one price list in US dollars. If you need the quote in another currency, ask and we will say what we can invoice in.

How to spend less: if your headcount sits near a band boundary, tell us when you ask for the quote. We confirm the band and the fixed fee before any work starts, so there is no surprise at the end.

What is in scope, and what is not?

A Microsoft 365 assessment is a configuration review, not a network scan. There are no servers of yours to probe, so the scope is the tenant's settings and who can reach its data. Every band checks three areas.

Identity: who can sign in, and how

• MFA coverage for every user, including emergency ("break-glass") and service accounts
• Conditional Access policies and the people excluded from them
• Privileged roles, and whether administrators use phishing-resistant sign-in
• Legacy authentication and SMTP AUTH, which bypass MFA
• Third-party apps users have consented to, and what those apps can read
• Guest accounts and whether they ever expire

Email: Exchange Online and Defender for Office 365

• SPF, DKIM and DMARC on every domain, including domains you no longer use
• Automatic forwarding to outside addresses, and inbox rules that hide mail
• Anti-phishing, anti-spam, Safe Links and Safe Attachments policies
• Mailbox auditing and how long the unified audit log is kept

Files and collaboration: SharePoint, OneDrive and Teams

• External sharing and anonymous "Anyone" links
• Sensitivity labels, retention and data loss prevention for personal data
• Teams external access and third-party apps
• Personal phones and laptops that reach mail and files without app protection

What is not included: making the fixes (we quote those as a fixed fee once you have the report), Microsoft 365 backup, penetration testing, phishing simulation, your office firewall and other on-premises equipment, and opening anyone's mail or documents. The assessment reads settings and metadata only.

How does the assessment map to Cyber Essentials v3.3?

Cyber Essentials is the UK government-backed scheme run by the NCSC with IASME as the delivery partner. Version 3.3 of the Requirements for IT Infrastructure, assessed with the "Danzell" question set, applies to new assessments from late April 2026. For a Microsoft 365 company, three things in it matter most:

• Cloud services are always in scope. Microsoft 365 is named in the NCSC document as an example of Software as a Service. You cannot carve it out, and user access control, including MFA, is always your responsibility rather than Microsoft's.
• MFA on cloud services is an automatic fail if it is missing. IASME states that if MFA is available for a cloud service and you have not turned it on, the assessment fails.
• Patching within 14 days is an automatic fail too. High-risk or critical updates for operating systems and applications must be installed within 14 days of release.

Our report includes a Cyber Essentials readiness table for the Microsoft 365 view of the five controls. It covers MFA on cloud services, administrator accounts, unused accounts, secure configuration, malware protection and update settings, and flags each item that would fail an assessment. Firewalls are mostly outside a Microsoft 365 review, so the table says where your evidence has to come from elsewhere.

Two cautions. The report is evidence for your assessment; the certification body makes its own decision, and we do not certify you. And a tenant review does not examine every laptop. For the control-by-control detail, read our guide to Cyber Essentials with Microsoft 365. If you are going for the Plus level, where an assessor tests a sample of your devices, read what the Cyber Essentials Plus technical verification tests before you book.

How to spend less: fix the automatic-fail items first. In a typical small tenant, those are a handful of accounts without MFA, a legacy protocol left switched on, and update rings with no deadline. Failing and re-applying costs more time than finding them a week earlier.

What does UK GDPR expect, and where does the assessment help?

UK GDPR requires security that is appropriate to the risk of your processing. Article 32 lists the measures, and one of them is "a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures". The ICO's guidance says the same thing in plainer terms: test your measures regularly, by methods that suit your risk. It does not prescribe a particular test or a frequency.

For most small and mid-sized UK firms, Microsoft 365 is where the personal data actually sits: CVs in OneDrive, client files in SharePoint, payroll attachments in Outlook. A dated, graded review of the settings that protect that data is a practical piece of the "regularly testing and assessing" record. Where a finding touches personal data, our report says so and rates it. Typical examples are:

• anonymous sharing links on folders that hold client or HR files
• mailbox rules forwarding mail to a personal address
• no data loss prevention policy for passport or National Insurance numbers
• an audit log retention period too short to investigate a breach after the fact

The assessment is not legal advice and does not replace a data protection impact assessment. It shows what your tenant settings allow; your data protection lead decides what that means for your obligations.

What will an insurer or a client's security questionnaire ask for?

UK cyber-insurance proposal forms and client security questionnaires tend to ask the same short list: is MFA on for everyone, how are administrator accounts protected, is email authenticated, are devices protected and patched, and how long are logs kept. The answer is easier to give, and harder to argue with, when each "yes" points to a dated export.

Our report includes an evidence pack for exactly those questions. Each answer is tied to an export from your tenant with the date it was taken. Every insurer sets its own rules, so we cannot promise what a particular one will accept; what we can do is make sure your answers are true and backed by something you can show. Our article on the Microsoft 365 evidence behind each insurance answer goes through the questions one by one.

How does the assessment run? Access, timeline and deliverables

The whole engagement is remote, and the debrief call is booked in UK business hours.

1. We confirm your headcount band and the fixed fee, normally within one business day.
2. One of your Global Administrators approves our read-only audit application. This takes about 15 minutes. No Brocent account or password is created in your tenant.
3. The automated checks run in minutes; an engineer then works through the manual controls that no script can read.
4. You receive the written report 5–7 business days after access is granted.
5. A debrief call walks through the findings and the order to fix them.

You can remove the application in Entra ID the day the assessment ends. If you want to see exactly which permissions it asks for, read what a read-only Microsoft 365 audit app asks for, and why.

What you receive:

• a written report with graded findings, the evidence for each and the effort to fix it
• results against the CIS Microsoft 365 Foundations Benchmark, Level 1 and Level 2, by section, including manual controls
• results against CISA's ScubaGear baselines by service, as an independent cross-check
• your Microsoft Secure Score, used as a trend line rather than as the verdict
• the Cyber Essentials readiness table and the insurer evidence pack
• a phased fix plan, plus an Excel workbook listing every control

You can read a complete sample assessment report before you buy. It uses a fictitious client.

Contracts: any of Brocent's 11 local legal entities can be the contracting party, and the proposal confirms which one. Brocent was founded in Beijing in 2007, is headquartered in Singapore and serves clients in 100+ countries and regions. If you also need hands-on help in the UK, see our IT support in the United Kingdom page.

Assessment, Cyber Essentials Plus or penetration test: which comes first?

UK firms are often offered all three in the same month. They answer different questions.

Which one answers your question?

• Microsoft 365 security assessment: checks how your tenant is configured against a published baseline. Answers "are our cloud settings safe, and what do we fix first?" Fixed price, remote, report in days.
• Cyber Essentials: a certificate based on a self-assessment questionnaire, checked by a certification body. Answers "can we show a customer or a tender that we meet the basic controls?"
• Cyber Essentials Plus: the same controls, plus hands-on testing of a sample of your devices by an assessor. Answers "do the controls actually work on our machines?"
• Penetration test: a tester tries to break in. Answers "what could an attacker do with the weaknesses we have?" It needs a defined target and usually costs more.

For most small UK companies the sensible order is: assessment, fix, Cyber Essentials, then Plus if a contract asks for it. A penetration test makes more sense once the basics are in place. Our comparison of a Microsoft 365 security audit and a penetration test explains when each one is the right buy.

Sources

• NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026): ncsc.gov.uk
• NCSC, Cyber Essentials overview: ncsc.gov.uk/cyberessentials/overview
• IASME, changes to Cyber Essentials for April 2026: iasme.co.uk
• UK GDPR Article 32, security of processing: legislation.gov.uk
• ICO, A guide to data security: ico.org.uk
• CIS Microsoft 365 Foundations Benchmark: cisecurity.org

FAQ

How much does a Microsoft 365 security assessment cost in the UK?

It is a fixed one-off fee by headcount, in US dollars and excluding tax: US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150. Above 150 users we quote a fixed fee. There is no day rate, and the price does not change by country.

Is a Microsoft 365 security audit different from an assessment?

Not here. Audit, assessment and review describe the same engagement: a read-only review of your tenant against the CIS Benchmark and CISA's baselines, delivered as one report and fix plan for one fixed fee.

Will the assessment get us Cyber Essentials?

No assessment can promise that, because the certification body decides. The report maps findings to the Cyber Essentials requirements a Microsoft 365 tenant can evidence and flags the automatic-fail items, so you can fix them before you apply.

Does it cover UK GDPR?

It covers the Microsoft 365 settings that decide whether personal data is protected, such as sharing, forwarding, data loss prevention, labels, retention and access. It is not legal advice or a data protection impact assessment.

Do you need to visit our office?

No. The assessment is fully remote. A Global Administrator approves a read-only application once, and the debrief is a call booked in UK business hours.

Do you read our email or documents?

No. The assessment reads configuration and metadata, never the content of mail or files, and no account or password is shared with us.

How long does it take?

About 15 minutes of your administrator's time to approve access, then 5–7 business days to the written report, followed by the debrief call.

Can you fix what the assessment finds?

Yes, if you want us to. We quote the fixes as a fixed fee after the report, and one re-assessment is included when Brocent carries out the fixes.

Your next step: count your licensed, active users, then request a quote on the Microsoft 365 security assessment page. We confirm the band and the fixed fee within one business day.