Microsoft 365 Security Audit Fixed Price or Hourly? How to Scope One Without Surprises

The short version: For a Microsoft 365 security audit, a fixed price is usually the safer way to buy, because the work is bounded by your tenant, not by how many problems the auditor finds. Brocent charges by headcount, one-off and excluding tax, from US$450 for 1–10 users to US$2,900 for 76–150 users, with the same scope in every band. Hourly pricing suits fixing things, not measuring them.

If you are comparing quotes for a Microsoft 365 security audit fixed price against an hourly rate, you have probably already noticed that the numbers are hard to compare. One provider quotes a day rate. Another quotes "from" a figure with no scope. A third sends a proposal that is mostly about their own methodology. This article is about how to turn those into something you can actually weigh.

It is a buying guide, not a price list. The full price list is on the Microsoft 365 Security Audit pricing page, and the separate guide on how much a Microsoft 365 security audit costs covers what drives the number. Here I want to answer a narrower question: how should the price be structured, and what do you need to pin down before you sign?

What does a Microsoft 365 security audit actually buy you?

A tenant security audit is a one-off review of how your Microsoft 365 environment is configured. Someone reads the settings across Entra ID, Defender, Purview, Exchange Online, SharePoint and Teams, compares them with a published baseline, and writes up every gap with a recommendation and an effort estimate. It does not read your mail or documents, and it is not a penetration test.

The deliverable matters more than the hours. You are buying a report you can act on and, if you need it, use as evidence when you answer an insurer's or a client's questionnaire or a Cyber Essentials question set. If a quote describes hours but not the deliverable, you cannot tell what you are getting for them.

That is the first scoping rule: price the output, not the effort. Ask what the report contains, which baseline it measures against, and whether the recommendations come with effort estimates and a priority order.

Is a fixed price or an hourly rate better for a security audit?

For the audit itself, fixed price is better in most cases. For the work that follows, it often is not. The two get confused because the same provider may offer both.

Fixed price versus hourly: how they compare

• Predictability: A fixed price is known before you start. An hourly engagement is an estimate until the last invoice, and an audit is exactly the kind of work where "we found more than expected" is a plausible reason for the bill to grow.
• Incentives: With a fixed price, the auditor's incentive is to work efficiently and deliver the agreed report. With hourly billing, a thorough auditor and a slow auditor can look the same on the invoice, and you have no easy way to tell which one you hired.
• Scope control: A fixed price forces both sides to write the scope down. An hourly rate lets the scope stay vague, which feels flexible until you are arguing about whether a particular area was "included".
• Fit for unknowns: Hourly works when the work genuinely cannot be defined in advance, such as untangling a tenant after a failed migration or investigating a suspected compromise. A configuration audit of a normal tenant is not that kind of problem.
• Fit for fixing: Remediation depends on what was found, how many devices or users it touches and what your change process allows. That is hard to fix in advance, which is why it is normally quoted separately per job.

The pattern most buyers end up wanting is fixed price for the audit, then a separate quote for the fixes, so each decision is made with the previous result in hand.

Why does Brocent price a Microsoft 365 audit by headcount?

Because headcount is the thing that actually moves the effort. A tenant with 8 users and a tenant with 120 users are reviewed against the same set of controls, but the larger one has more accounts, more mailboxes, more sites, more guests and more sign-in activity to read and to check. The number of users is a fair proxy, and it is something you can count before you speak to anyone.

The bands are published. A one-off Microsoft 365 CIS Benchmark Audit is US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150, all in US dollars and excluding tax. Tenants with more than 150 users are quoted. The scope is the same in every band: CIS Microsoft 365 Benchmark Level 1 and Level 2, including the manual controls, across Entra ID, Defender, Purview, Exchange, SharePoint and Teams. You also get evidence for the questions that cyber insurance questionnaires and Cyber Essentials commonly ask, a prioritised roadmap with effort estimates, a debrief call, and the report 5–7 business days after read-only access is granted.

Nothing about the price depends on how bad the tenant turns out to be. If the auditor finds three problems or thirty, the price is the one you were quoted.

What should you pin down before you accept any quote?

Whatever the pricing model, these are the questions that turn a vague quote into a comparable one. Put them in writing and ask every provider the same ones.

1. Which baseline? "Best practice" is not a baseline. Ask which benchmark the audit is measured against, which levels, and whether manual controls are included. Some automated tools skip the controls that cannot be read through an API.
2. Which products are in scope? A tenant review that covers identity but not Exchange, SharePoint or Teams is a different product from one that covers all of them.
3. How is access granted? The safest pattern is a read-only application that a Global Administrator consents to once and that you can remove afterwards. Ask what it can read. A properly scoped audit reads configuration, not mail or document content.
4. How many tenants and how many users? If you have more than one tenant, or a lot of guest accounts, say so before you are quoted. We then confirm the scope in writing.
5. What is the turnaround? Ask for a number of business days from the moment access is granted, not from the moment you sign.
6. What happens after the report? Is there a debrief call? Is a retest included? What would a retest cost if you fix things yourself?
7. Who does the fixing, and is it priced separately? A cheap audit that is really a lead-in to an expensive remediation contract is not cheap.

What is usually not included in a fixed price?

It is worth being direct about the edges, because surprises usually live there.

Remediation. Finding a gap and closing it are different jobs. At Brocent the audit and the fixes are separate. Hardening work is quoted per job, because it depends on what was found and on your environment. You can take the roadmap and do the work in-house, give it to another provider or ask us to do it.

Device audits. Intune and endpoint device reviews are a different report from the tenant configuration audit. If you also want your devices examined, ask for it explicitly rather than assuming it is inside the tenant audit.

Retests. A re-audit after fixes is included when Brocent did the remediation. If the fixes were done in-house, a re-audit is charged at the band price. That is a fair rule, but check that any provider you talk to has a rule at all.

Certification. An audit does not grant or guarantee Cyber Essentials or any other certification, and no audit can promise what an insurer will accept. Our report is designed to be used as evidence about your Microsoft 365 configuration. What an insurer or assessor decides is their call.

Very large or unusual tenants. Above 150 users a quote replaces the published band, and multi-tenant estates are scoped individually. That is normal and not a reason for suspicion, as long as the quote comes with the same written scope.

When is an hourly rate the right choice?

Hourly or time-and-materials pricing is the right tool in a few situations:

• You already know the problem and need a specialist to fix it, for example tidying up Conditional Access after a merger.
• You are investigating something live, such as a suspicious sign-in or a mailbox rule nobody recognises, where the scope changes as you learn more.
• You want ongoing advice on a rolling basis rather than a deliverable.

In those cases you are buying time and judgement, and a rate card is honest. The mistake is using that model for a bounded, repeatable review and then being surprised when the total is open-ended.

How does a fixed price compare with a managed option?

If your tenant changes often, one audit is a snapshot. Staff join and leave, new apps are connected and settings drift. Brocent also offers a managed option at US$6–10 per user per month that includes a quarterly re-audit, so the baseline is checked again instead of assumed.

The decision between the two is simple. A one-off audit suits a point-in-time need, such as a renewal, a questionnaire or a first baseline. The managed option suits a tenant where nobody has time to keep watching. For a small team that does not need a recurring review, the one-off fixed price is the better fit.

What does a sensible buying process look like?

1. Count your licensed users and note any extra tenants or large numbers of guest accounts.
2. Decide what prompted the audit: an insurance renewal, a client questionnaire, Cyber Essentials, an incident, or a general check.
3. Ask each provider the seven scoping questions above, in writing.
4. Compare the deliverables first and the prices second.
5. Agree who will do any remediation, and get that quoted separately.
6. Arrange the one-off consent with your Global Administrator. For our audit that takes about 15 minutes.

Frequently asked questions

Is a fixed price Microsoft 365 security audit cheaper than hourly?

Not necessarily cheaper, but more predictable. The bigger benefit is that you know the total before the work starts.

How much does a Microsoft 365 security audit cost at Brocent?

The price depends on headcount and is one-off, in US dollars and excluding tax: US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150. Over 150 users is quoted. See the pricing page for the current list.

Does the price change if you find a lot of problems?

No. The audit price is fixed for the band, whatever the tenant turns out to contain. Fixing the problems is separate and quoted per job.

How long does the audit take?

The report arrives 5–7 business days after read-only access is granted. Granting access takes a Global Administrator about 15 minutes.

Is a re-audit included?

A re-audit after fixes is included when Brocent did the remediation. After in-house fixes, it is charged at the band price.

Does the audit read our email and documents?

No. The read-only Microsoft Graph application reads configuration, never mail or document content. You can remove it in Entra ID once the audit is done.

Will an audit help with cyber insurance or Cyber Essentials?

It is designed to give you evidence for the questions commonly asked in cyber insurance questionnaires and Cyber Essentials. It does not grant or guarantee certification, and what an insurer accepts is the insurer's decision. For background, see our guide to cyber insurance requirements.

Next steps

Work out your headcount, write down the seven scoping questions and send them to every provider on your shortlist. If one of them is Brocent, the Microsoft 365 Security Audit pricing page shows the band for your size, and the sample report shows what the deliverable looks like before you commit. If you would like to talk it through, contact us with your approximate headcount and what prompted the audit, and we will tell you which band applies and what to prepare.