Microsoft 365 Security Assessment Report: What It Should Contain, Walked Through With Our Sample

The short version: A good Microsoft 365 security assessment report has an executive summary a non-technical owner can act on, a clear scope and method, findings that say what was seen, why it matters, how to fix it and how to undo the fix, and a prioritised roadmap. Brocent publishes a sample report, with an invented client, so you can check any provider's report against it before you buy.

Most people who search for a Microsoft 365 security assessment report want to know one thing: what will I actually be handed at the end? Providers describe the process at length and almost never show the result. That makes it hard to tell a useful report from a long export of settings.

We publish a sample Microsoft 365 security audit report (English page) for a fictitious firm, so this article walks through it section by section. Everything quoted from it is invented to show structure and depth: the client, the domains, the users and every number are fictional, and none of it is real tenant data. If you are still choosing a provider, the walkthrough doubles as a checklist, and the Microsoft 365 Security Audit pricing page shows what the real engagement costs.

What should a Microsoft 365 security assessment report contain?

At minimum, six things:

1. An executive summary that fits on one page.
2. A statement of scope and method, including which frameworks and versions were used.
3. A findings register with severity, effort and a recommended order.
4. For each finding, enough detail to fix it without guessing.
5. Evidence you can hand to someone else.
6. A remediation roadmap with phases.

The sample is 27 pages long, and it follows that shape. The rest of this article takes it in order.

How does the report open?

The first pages are document control: a reference number, version, classification, the dates data was collected, verified and issued, and who prepared and reviewed it. This sounds bureaucratic, but it answers questions that matter later. If an insurer asks when the configuration was read, or someone asks whether the report you are holding is the final version, the answer is on page two.

Look for two details. First, a gap between "data collected" and "findings verified". In the sample, findings marked as verified were read again from the tenant two days after collection and before issue, which protects you against settings that changed mid-audit. Second, a confidentiality statement. A report that lists your weaknesses should say who may see it.

What does the executive summary look like?

One page, aimed at the person who will approve the work and does not read admin portals. In the sample it contains:

• A single posture score with a grade, plus the CIS Benchmark pass rate, Microsoft Secure Score and MFA coverage side by side.
• A count of findings by severity, so you can see at a glance whether the picture is mostly critical or mostly housekeeping.
• The top five risks in plain language, each with a one-line "why it matters" and a pointer to the finding.
• What is working, which is easy to leave out and important to include. It tells you what not to touch.
• One decision requested, in the sample a short first phase of work to close the critical items.

The test of an executive summary is whether the owner can say, after reading it, what they are being asked to approve. If the summary is a paragraph about the importance of cybersecurity, it is not doing its job.

How should scope and method be stated?

Directly, with an in-scope list and an out-of-scope list. In the sample, in scope are Entra ID, Exchange Online, Defender, SharePoint and OneDrive, Teams, Purview, Secure Score and the Intune summary. Out of scope are mailbox and document content, penetration testing, phishing simulation, third-party applications outside Microsoft 365 and physical security.

It also names how access was obtained: a read-only audit application consented to by a Global Administrator, with no consultant accounts or passwords left in the tenant. That sentence is what a careful IT lead or director will look for first.

Then the framework versions appear in a table of their own. The sample cites the CIS Microsoft 365 Foundations Benchmark v7.0.0 at Level 1 and Level 2, the CISA SCuBA baselines, a dated Microsoft Secure Score and Cyber Essentials v3.3. Version numbers are not decoration. A report that says "aligned with CIS" without a version cannot be reproduced or compared with next year's.

Finally, three scales explain how to read everything that follows: severity with a target time to fix, effort from under half a day to more than three days, and confidence: verified from the tenant, confirmed with the client, or manual review where no API exposes the setting. Manual controls are the ones a purely automated scan misses, so a report should say which findings came from a human looking at a screen.

What does the posture overview show?

A summary of results before the detail. In the sample, CIS results are broken down by section, covering the admin centre, Defender, Purview, Intune, Entra, Exchange, SharePoint, Teams and Fabric, with pass, fail, manual and not applicable counts. Beside it are Secure Score by category against peers and results by product from the SCuBA baselines.

Three independent views are better than one because they disagree usefully. A tenant can look different on Secure Score and on the CIS controls, because Secure Score does not measure everything the benchmark does. Seeing the three together shows where the picture is solid and where it depends on which ruler you use.

What does a good finding look like?

This is the part that decides whether the report is usable. In the sample every finding is a card with the same layout:

• A title, severity, effort, phase and confidence, so findings can be sorted and planned.
• Framework chips showing the matching CIS recommendation, SCuBA policy, Cyber Essentials requirement and Secure Score action. A dash means there is no direct mapping.
• Observation, the specific thing seen, with names and settings rather than generalities.
• Impact, why it matters in terms of an attacker's actual path.
• Remediation, numbered steps in the order you would do them.
• Rollback, how to undo the change if something breaks.
• User impact, what staff will notice.
• Evidence reference, pointing to an exported file in the appendix.

Take the first finding in the sample. A policy that requires MFA for all users excludes a group that contains an administrator break-glass account and a scanner account. The card says exactly which group, which accounts (one of them an administrator with no MFA method registered), what an attacker could do with it, four fix steps, how to reverse them and how long the printer change takes. A reader can act on it without a follow-up call.

The rollback and user-impact boxes are the ones most reports leave out. They are also the ones that make a busy IT lead willing to change a production setting on a Tuesday.

How are Exchange Online findings treated?

Like everything else, but the email findings are worth singling out because email is where most small-business incidents begin. In the sample, the Exchange Online findings include an external mailbox forwarding rule, a DMARC policy published in monitoring-only mode, anti-phishing impersonation protection that covers no users, and the absence of external sender tagging. SMTP AUTH and legacy authentication appear in the identity section because they bypass Conditional Access.

Each of these is the kind of line item an Exchange Online security assessment should contain. If a provider's sample or report has no mail-flow, forwarding, authentication-records and auditing findings, it is not an Exchange assessment, whatever the title says.

What is the evidence pack, and who is it for?

The sample includes a section that restates the questions cyber insurance renewal forms commonly ask (is MFA enforced for all users and admins, is legacy authentication disabled, are SPF, DKIM and DMARC in place, how long are logs retained) and gives the answer the evidence supports today, with a reference to the exported file behind it.

An important caveat. This is evidence, not approval. Our reports are designed to be used as evidence, and what an insurer or a Cyber Essentials assessor accepts is entirely their decision. The same section is honest about gaps: where something is outside the audit's scope, it says so and does not claim it. For more on the insurance side, see our guide to cyber insurance requirements.

What should the remediation roadmap do?

Turn the findings into a plan with dates. The sample orders work into four phases: the first two weeks for the critical items, up to day 60 for hardening, up to day 120 for governance, and then a quarterly cycle. Each phase lists the findings it covers, an effort estimate in days (except the ongoing quarterly phase) and a success measure, such as zero accounts without MFA or zero legacy sign-ins in seven days.

Estimates are what make the roadmap budgetable. A list of fifty findings with no effort attached cannot be turned into a project plan.

What belongs in the appendices?

The raw material that supports the findings: the Conditional Access policies with their state and exclusions, privileged role assignments, email authentication records by domain, pseudonymised MFA coverage, an evidence index, a glossary and a methodology and disclaimer page. The sample also ships with a workbook so the findings can be filtered and assigned. The appendices are what allow another engineer to verify what the report says.

How can you judge any security assessment report?

Use this as a quick filter, whoever wrote the report:

• Is the scope written down, with an out-of-scope list?
• Are framework versions named?
• Does each finding say what was seen, not only what to do?
• Are there fix steps, a rollback and user impact?
• Is there an effort estimate and a priority order?
• Is it clear which results are verified and which are manual?
• Can someone else check it from the exported evidence?
• Does it avoid overclaiming, that is, claiming compliance, certification or insurer approval?

A report that fails more than two of these is closer to a scan export than an assessment.

Frequently asked questions

What is in a Microsoft 365 security audit report?

An executive summary, scope and method, a posture overview, individual findings with severity, effort, fix steps and rollback, evidence for common insurance and Cyber Essentials questions, a phased roadmap and appendices with the supporting exports.

How long is a typical report?

The Brocent sample is 27 pages for a small fictitious firm, plus a workbook. Length depends on the tenant, but the findings should be the bulk, not the introduction.

Is the sample report real client data?

No. The client, domain, users, devices and every number in the sample are invented to show structure and depth. It contains no real tenant data.

How long until I receive the report?

Brocent delivers the report 5–7 business days after read-only access is granted. The access step takes a Global Administrator about 15 minutes.

Does the report read our mail or documents?

No. The audit reads configuration through a read-only Microsoft Graph application, never mail or document content. You can remove the application in Entra ID afterwards.

What does the audit cost?

One-off and excluding tax, in US dollars, priced by headcount: US$450 for 1–10 users up to US$2,900 for 76–150 users, with over 150 quoted. The scope is the same in every band. See the pricing page for the list and the guide on fixed price versus hourly for how to compare quotes.

Does the report guarantee Cyber Essentials or insurance approval?

No. It is designed to be used as evidence and lists what to change. Certification and insurance decisions belong to the assessor and the insurer.

Next steps

Open the sample report, read the executive summary and one finding card, and ask whether any provider you are considering can show you the equivalent. The Microsoft 365 Security Audit pricing page shows the band for your headcount. If you would like to talk it through, contact us with your approximate headcount and what prompted the audit, and we will tell you which band applies and what to prepare.