Microsoft 365 Security Audit in Kent and the South East: What a Tenant Audit Covers for Local Businesses

The short version: A Microsoft 365 security audit in Kent is a one-off review of your tenant's configuration against the CIS Microsoft 365 Benchmark, Level 1 and Level 2, including the manual controls. Brocent delivers it remotely for a fixed price set by headcount, from US$450 for 1–10 users to US$2,900 for 76–150 users. The report arrives 5–7 business days after read-only access is granted.

If you run a business in Kent or elsewhere in the South East and you are looking for a Microsoft 365 security audit, you are probably asking one of three things. Can someone look at my tenant and tell me what is wrong? What will it cost? And will the result help with the cyber insurance renewal, a client's supplier questionnaire or Cyber Essentials?

This page answers those questions for a small or mid-sized business. It explains what a tenant audit covers, how the work is delivered when the people doing it are not in your building, what you have to do, how long it takes, and what it costs. It also says plainly what an audit does not do. The full price list is on the Microsoft 365 Security Audit pricing page, and I will come back to it at the end.

What is a Microsoft 365 security audit, and who in Kent needs one?

A Microsoft 365 security audit is a structured review of how your tenant is actually configured, as opposed to how you believe it is configured. Someone reads the settings in Entra ID, Exchange Online, SharePoint, Teams, Defender and Purview, compares them with a published baseline, and writes down every gap with a recommendation and an effort estimate.

It is not a penetration test, and it is not a vulnerability scan of your laptops. It looks at one thing: the cloud tenant that holds your email, files, chat and identities. For most small businesses that tenant is the most valuable thing they own, because everything else signs in through it.

The businesses that ask for this tend to share a few traits. They have grown from a handful of users to a few dozen. Somebody set the tenant up quickly, often a long time ago, and nobody has reviewed it since. Then a trigger arrives:

• A cyber insurance renewal form asks about multi-factor authentication, administrator accounts and email protection.
• A larger client sends a supplier security questionnaire.
• The business wants to apply for Cyber Essentials and needs to know how its Microsoft 365 set-up stands.
• A member of staff had an account taken over, or a near miss, and the owner wants to know whether it could happen again.

If one of those sounds familiar, an audit is a sensible first step because it gives you a single, ordered list of what to fix. The companion guide on what the audit does for Entra ID in particular goes deeper on the identity side.

Can an audit be done properly if the auditor is not in Kent?

Yes, and it is worth being clear about why. Brocent delivers the audit remotely. We do not claim an office or a team on site in Kent or anywhere else in the UK, and we do not need one: a tenant audit reads configuration through Microsoft's own interfaces, so the work is the same wherever it is done.

How Brocent serves UK clients more generally, including who signs the contract and how on-site visits are arranged through vetted local engineers at published dispatch rates, is set out on the UK IT support page. The UK and Australia section of the audit pricing page covers the Cyber Essentials readiness table and the time-zone arrangements for the debrief.

What matters is access and accountability, so here is how it works:

• Read-only access. A Global Administrator at your company consents once to a read-only Microsoft Graph application. It takes about 15 minutes. The application reads configuration. It does not read the content of email or documents.
• Removable. The consent can be withdrawn at any time in Entra ID by removing the application, and nothing is left running afterwards.
• No installation on your devices. Nothing is deployed to laptops or phones for a tenant audit.
• A debrief call. When the report is ready we go through it with you by video call, in your time zone, and answer questions.

The honest trade-off of working remotely is that we do not walk the office or look at physical security. That is outside the scope of a tenant audit in any case. If you want someone to stand in your server room, this is not that service.

What does a Microsoft 365 security audit cover?

The scope is the same in every price band. Brocent audits against the CIS Microsoft 365 Benchmark, at Level 1 and Level 2, and that includes the manual controls, the ones a script cannot read and a person has to judge.

The areas covered are:

• Entra ID: multi-factor authentication coverage, Conditional Access policies, legacy authentication, administrator roles and how many people hold them, guest accounts, break-glass accounts, and app consent settings.
• Exchange Online: mail flow rules, external forwarding, anti-phishing and anti-malware policies, SPF, DKIM and DMARC records, and shared mailbox sign-in settings.
• Defender: the protections that are switched on, those that are licensed but not configured, and alert and reporting settings.
• Purview: audit log settings and retention, sensitivity labels and data loss prevention where licensed.
• SharePoint and OneDrive: external sharing settings, anonymous links, and default permissions.
• Teams: external access, guest policies and meeting settings that affect who can join and share.

CIS publishes the benchmark and updates it, so the version matters. CIS released version 7.0.0 of the Microsoft 365 Foundations Benchmark in May 2026 (listed in CIS's June 2026 benchmarks update, read 28 October 2026). When you commission an audit, ask which version it was measured against, and ask to see the version stated in the report.

Why do the manual controls matter?

Automated tools are good at reading a setting and comparing it with a target value. They are much weaker at questions such as: is the break-glass account actually protected and monitored? Do the people holding administrator roles still need them? Does the Conditional Access policy that looks right on paper leave a gap for a particular group or application? A reviewer has to look at those in context.

That is why an audit that covers only the automated checks can produce a tidy report that misses the findings that matter most. If you are comparing offers, ask whether manual controls are included. In Brocent's audit they are, in every band.

How long does the audit take?

The report is delivered 5–7 business days after read-only access is granted. The clock starts when the Global Administrator completes the consent, not when you place the order, so the quickest route is to arrange a 15-minute slot with your administrator or IT contact at the start.

The sequence is simple:

• Day 0: you agree the band, and your Global Administrator grants read-only access.
• Days 1 to 5–7 (business days): we collect the configuration, review it against the benchmark including the manual controls, and write the report.
• On delivery: you receive the report with a prioritised roadmap and effort estimates, and we hold a debrief call.

Because the work is remote and the window is in business days, a Kent business does not wait longer than anyone else. If your tenant has unusual complexity, such as several tenants or a recent migration, tell us at the start so that the band and timeline are agreed honestly.

How much does a Microsoft 365 security audit cost for a Kent business?

Brocent prices the audit once, in US dollars, excluding tax, according to the number of users in the tenant:

• 1–10 users: US$450
• 11–25 users: US$990
• 26–75 users: US$1,800
• 76–150 users: US$2,900
• Over 150 users: quoted individually

It is a one-off fee. The scope does not shrink for the smaller bands: a 10-person business gets the same CIS Level 1 and Level 2 review, with manual controls, the same roadmap and the same debrief call as a 150-person one. The price differs because a larger tenant has more users, more groups and more to read.

We have not converted these figures into pounds, because the exchange rate moves and a converted number on this page would go out of date. Use the current rate on the day you buy.

If you want to see how this compares with other ways of buying an audit, our cost guide, How much does a Microsoft 365 security audit cost?, sets out the range from self-run scanners to day-rate consultancy. The short version: the price differences are mostly about who does the judgement work and how much of the tenant they look at.

What does the managed option cost, and when is it worth it?

There is a second way to buy. If you would rather not treat the audit as a once-only event, the managed option is US$6–10 per user per month and includes a quarterly re-audit. It suits businesses whose tenant changes often, such as growing teams with frequent joiners, new apps and new sharing arrangements.

For a stable 12-person business, the one-off audit is usually enough. For a 60-person business that adds apps and users every month, a quarterly check stops drift from silently undoing the work.

Will the audit help with cyber insurance, supplier questionnaires and Cyber Essentials?

This is the question that most often triggers the enquiry, so it deserves a careful answer. The report includes evidence for the questions that cyber insurance questionnaires commonly ask about Microsoft 365: whether multi-factor authentication is enforced, how administrator accounts are protected, whether email filtering and authentication records are in place, and whether logging is on. It is designed to be used as evidence. It is not a statement from an insurer or an assessor, and we do not say that any insurer or client will accept it. Underwriters and customers decide for themselves what they accept, and their forms differ.

For Cyber Essentials the picture is similar. The scheme's requirements document, version 3.3, says authentication to cloud services must always use multi-factor authentication, and IASME's April 2026 update says that failing to enable MFA on cloud services where it is available leads to an automatic fail (read 28 October 2026). IASME's own articles give slightly different cut-over dates in late April 2026, so check its current guidance for the exact date that applies to your application.

For a Microsoft 365 business that means the tenant-side questions are exactly the ones an audit examines. The audit gives you evidence about your Microsoft 365 configuration and a list of what to change. It does not grant Cyber Essentials, and it does not guarantee that you will pass. The assessment is carried out by a certification body, and it covers more than Microsoft 365, including devices, firewalls and patching.

For a wider picture of how insurers phrase these questions, our guide to cyber insurance requirements and IT renewal walks through the usual themes; it was written for Hong Kong businesses, but the Microsoft 365 questions are much the same.

What do you get at the end?

The deliverables are the same whether you have 8 users or 140:

• A written report covering each area above, with findings ranked by risk.
• A prioritised roadmap with effort estimates, so that you can see which changes take ten minutes and which need a project.
• Evidence for common questionnaire questions drawn from the tenant, arranged so that the person filling in a form can find the relevant setting.
• A debrief call to walk through the findings and decide what to do first.

If you would like to see what a report looks like before you decide, there is an example audit report on the site. It is available in English only.

What happens after the report?

You choose. Some businesses fix everything themselves, because the roadmap is detailed enough for an in-house person or their existing IT supplier. Others ask Brocent to do the remediation. The re-audit terms are straightforward: a re-audit after fixes is included when Brocent did the remediation. After in-house fixes, a re-audit is charged at the band price.

Which questions should you ask any provider before you hire them?

Whether you choose Brocent or someone else, these questions separate a useful audit from a decorative one. We would ask them ourselves.

• Which benchmark and which version? The answer should name the benchmark and the version.
• Are manual controls included? If the answer is "we run a scanner", you are buying a scanner report.
• What access do you need, and can I remove it? Read-only, consented once, removable, and no access to mail or document content is a sound answer.
• Is the price fixed, and what is outside it? Ask about re-audits and remediation specifically.
• What exactly do I receive? A prioritised roadmap with effort estimates is more useful than a list of failed checks.
• Will anyone explain it to me? A debrief call is where a report becomes decisions.

Frequently asked questions

How much does a Microsoft 365 security audit cost in Kent?

Brocent's fixed prices are US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150, one-off and excluding tax. Tenants with over 150 users are quoted. The scope is the same in every band.

How long does the audit take?

The report is delivered 5–7 business days after read-only access is granted. Granting access takes a Global Administrator about 15 minutes.

Do you need to visit our office in Kent?

No. The audit is delivered remotely and reads configuration through a read-only Microsoft Graph application. It does not read mail or document content, and you can remove the application in Entra ID at any time.

Is the audit enough to pass Cyber Essentials?

No audit can promise that. Our report is designed to be used as evidence about your Microsoft 365 configuration, and it lists what to change, such as enforcing MFA for cloud services. Cyber Essentials is assessed separately and also covers devices, firewalls and updates.

Will my cyber insurer accept the report?

We cannot say, and nobody honestly can on an insurer's behalf. The report contains evidence for the questions that cyber insurance questionnaires commonly ask about Microsoft 365. What a particular insurer needs is the insurer's decision, so check what yours asks for.

What is the difference between this audit and Microsoft Secure Score?

Secure Score is a built-in measure based on Microsoft's own recommended actions. The audit measures your tenant against the CIS Microsoft 365 Benchmark at Level 1 and Level 2, includes manual controls that need human judgement, and ends with a prioritised roadmap and a debrief call.

Can you fix what you find?

Yes, if you want that. Remediation is separate from the audit. A re-audit after fixes is included when Brocent did the remediation, and charged at the band price after in-house fixes.

Is there an ongoing option?

Yes. The managed option is US$6–10 per user per month and includes a quarterly re-audit, which suits tenants that change frequently.

Next steps for a Kent business

Start with two numbers: how many users your tenant has, and who your Global Administrator is. With those you can pick a band on the pricing page, arrange the 15-minute consent, and expect the report within 5–7 business days after that.

If you would rather talk it through first, contact us with your approximate headcount and what prompted the question, whether that is an insurance renewal, a client questionnaire or Cyber Essentials, and we will tell you which band applies and what to prepare.