Microsoft 365 Security Audit in Singapore: Scope, Timeline and Fixed Prices

The short version: A Microsoft 365 security audit for a Singapore company is a fixed-price review of how your tenant is configured, measured against the CIS Microsoft 365 Benchmark Level 1 and 2. Brocent delivers it remotely: one-time prices in US dollars excluding tax run from US$450 for 1–10 users to US$2,900 for 76–150 users, and the report arrives 5–7 business days after read-only access is granted. This page explains the scope, the timeline and what to ask before you buy.

If you run IT for a Singapore firm, you are probably reading this because someone has asked a question about your Microsoft 365 setup. It may be a client's security questionnaire, an insurer's renewal form, a new group CIO, or simply a worry that nobody has looked at the tenant since it was set up. A Microsoft 365 security audit in Singapore answers that question with evidence instead of opinion.

This page is a buyer's guide. It explains what the audit reads, what it does not, how long it takes, what it costs, and how to decide between a one-off review and a recurring one. It does not make claims about any Singapore regulation; where regulation matters, it points to separate guides.

What does a Microsoft 365 security audit in Singapore cover?

The audit reviews configuration across the parts of Microsoft 365 that decide who can get in and what they can do once inside. Brocent's scope is the same in every price band:

• Benchmark: the CIS Microsoft 365 Benchmark, Level 1 and Level 2, including the manual controls that cannot be read from an API.
• Areas: Entra ID (sign-in, MFA, Conditional Access, privileged roles, guests), Defender, Purview (retention and labelling settings), Exchange Online (mail flow, authentication, forwarding), SharePoint and Teams (sharing and external access).
• Evidence: material designed to be used as evidence for common cyber-insurance questionnaire and Cyber Essentials questions.
• Output: a prioritised roadmap with effort estimates, so your team can decide what to fix first, and a debrief call to walk through it.

For how the 12 review areas break down, see the Microsoft 365 security audit checklist. For what the finished report looks like, see the sample report (English page).

What the audit does not do is also part of the scope. It reads configuration through a read-only Microsoft Graph app, so it never reads mail or document content. It does not change anything in your tenant, and it is not a penetration test or a vulnerability scan of your network. If you are unsure which of those a client is asking for, our guide on fixed price or hourly scoping explains how scope is set.

How much does a Microsoft 365 security audit cost in Singapore?

Prices are fixed by headcount, one-time, in US dollars and exclude tax. The scope does not change between bands.

• 1–10 users: US$450
• 11–25 users: US$990
• 26–75 users: US$1,800
• 76–150 users: US$2,900
• More than 150 users: quoted

We list prices in US dollars only and do not publish Singapore-dollar conversions, because the exchange rate moves and the quote you accept is the one in US dollars. The figures exclude tax. The pricing page always holds the current list: Microsoft 365 Security Audit pricing.

A managed option exists for firms that want the review repeated: US$6–10 per user per month with a quarterly re-audit. Separately, a re-audit after fixes is included when Brocent did the remediation. If your own team did the fixes, the re-audit is charged at the band price.

For a deeper look at what drives these numbers and how they compare with hourly work, read how much a Microsoft 365 security audit costs.

How long does it take, and what do you need to prepare?

The report is delivered 5–7 business days after read-only access is granted. The access step is quick: a Global Administrator consents once to a read-only Microsoft Graph app, which takes about 15 minutes. You can remove the app in Entra ID whenever you wish.

A typical sequence looks like this.

1. Choose your headcount band and confirm scope. Confirm how headcount is counted for your band, and tell us about any other Microsoft 365 tenants your group runs.
2. Grant read-only access. Your Global Administrator consents to the app. Ask for the exact permission list in writing beforehand, and check what was granted in Entra ID after you consent.
3. Collection and review. The app reads configuration, and a reviewer works through the manual controls with you where a setting cannot be read.
4. Report and debrief. You receive the report and the roadmap, then a call to go through the findings and priorities.

Because the service is delivered remotely, there is no site visit to schedule. If you want your IT lead on the debrief call, agree a time when sending the access request.

Which questions should a Singapore firm ask before buying?

The tenant belongs to you, wherever your people sit, so the questions are the same as anywhere. These are the ones worth putting to any provider.

• What exactly is in the price? Ask whether the benchmark levels, manual controls, roadmap and debrief are all included, and whether anything is quoted per job afterwards.
• What access do you need, and can I see it? A read-only configuration app is very different from a tool that reads mail. Ask for the permission list before consenting.
• What do I receive? A raw export is not a report. Ask for a sample, then compare it with the one above.
• Who fixes things? Some providers audit and fix; some only audit. Know which you are buying, and what a re-audit costs after fixes.
• What can the report be used for? Be wary of any promise that a report will be accepted, certified or approved by a third party. A good report is designed to be used as evidence; acceptance is the decision of whoever reads it.

What about Singapore regulations and group requirements?

An audit of Microsoft 365 configuration is evidence about one system. It does not, by itself, make an organisation compliant with any law or regulator's guidance, and we do not claim it maps onto any specific rule.

If your firm sits under regulator or data-protection obligations, treat the audit as one input and read the right guide for the rest. Our checklist for outsourced IT and cyber security under MAS TRM and our PDPA checklist for IT outsourcing in Singapore cover those questions as outsourcing checklists.

If you are weighing a provider more broadly, see how to choose a cybersecurity provider in Singapore. If the Microsoft 365 question arises from an acquisition or a merged tenant, read our write-up of a post-acquisition Microsoft 365 tenant migration in Singapore.

What situations usually lead a Singapore firm to commission one?

The trigger is rarely curiosity. In practice it is one of a handful of events, and knowing which one you are in helps you decide what to ask for.

• A client or partner sends a security questionnaire. Questions about MFA, administrator accounts, logging and external sharing need answers taken from the tenant, not from memory. The audit gives you evidence for those answers, and our guide to the Microsoft 365 evidence behind cyber-insurance questionnaires shows what that evidence looks like.
• An insurance renewal asks for controls. Forms commonly ask whether MFA covers every user, whether legacy sign-in is blocked and how long logs are kept. The audit reports what your tenant is set to do today.
• A new owner or group IT lead takes over. A fresh pair of eyes wants a baseline before changing anything. A fixed-price report is quicker to approve than an open-ended engagement.
• Two tenants are about to become one. After an acquisition or restructure, you inherit another team's settings. Reviewing them before consolidating avoids carrying old risks forward.
• The tenant has simply never been reviewed. Many small firms set Microsoft 365 up once, then add people and apps for years. A review finds what has accumulated: stale accounts, broad guest access and forgotten forwarding rules.

None of these needs a regulator to be involved. They are ordinary business reasons, and they are the reason the report is written for a reader who is not an administrator.

One-off review or recurring audit?

A one-off audit is a snapshot of the tenant on the day it was read. That is what most firms need first: a baseline, a prioritised list and a date. Whether to repeat it depends on how much changes.

• Choose a one-off if the tenant is small and stable, you have a specific reader waiting for the report, or you want to see the value before committing.
• Consider the managed option if people, devices and apps change often, if you must keep showing evidence each year, or if you would rather not remember to re-check. It is US$6–10 per user per month with a quarterly re-audit.
• Plan a re-audit after fixes whichever you pick. It is how you show that the findings were closed. It is included when Brocent did the remediation, and charged at the band price after in-house fixes.

If you are still deciding between hourly help and a fixed scope, the fixed price vs hourly guide sets out the trade-offs, and if you also have a Hong Kong entity, the Hong Kong version of this page covers the same scope and prices.

What to have ready before you ask for a quote

Gathering these makes the first conversation short.

1. The number of licensed users, and which Microsoft 365 plan each group holds.
2. The name of the Global Administrator who can consent, and a second person who can approve if they are away.
3. Whether you have more than one tenant, and which entities use each.
4. The reader of the report and what they asked, such as a client questionnaire or an insurer's form, so the findings can be framed for that purpose.
5. Any change planned in the next month, such as a migration or a new MFA rollout, so timing can avoid it.

How is this different from running Secure Score yourself?

Secure Score is useful, and you should look at it. It measures against Microsoft's own recommendations and does not give you a prioritised roadmap, effort estimates or a reviewer's judgement. The CIS Benchmark includes controls that depend on how your people work, which a dashboard cannot decide. See Secure Score vs the CIS Benchmark vs ScubaGear for the differences.

An audit is most worth buying when you need a document someone else will read: a client, an insurer, a board member, or a new owner. If you only want to tidy your own tenant, start with Secure Score and the checklist, and buy an audit when you need an independent view.

Frequently asked questions

How much is a Microsoft 365 security audit in Singapore?

Brocent's prices are US$450 for 1–10 users, US$990 for 11–25, US$1,800 for 26–75 and US$2,900 for 76–150, one-time and excluding tax. Over 150 users is quoted. The scope is the same in every band.

How long does the audit take?

The report is delivered 5–7 business days after read-only access is granted. Granting access takes a Global Administrator about 15 minutes.

Do you need to visit our office?

No. The service is delivered remotely. Access is through a read-only Microsoft Graph app, and the debrief is a call.

Does the audit read our emails or files?

No. The app reads configuration only and never reads mail or document content. You can see what was granted in Entra ID and remove the app at any time.

Will the audit make us compliant with Singapore regulations?

No audit can promise that. The report and workbook are designed to be used as evidence for common cyber-insurance questionnaire and Cyber Essentials questions. They do not grant or guarantee certification, and what a regulator, insurer or assessor accepts is their decision.

Is a re-audit after fixes included?

When Brocent did the remediation, yes. If your own team made the fixes, a re-audit is charged at the band price.

Is there a recurring option?

Yes. The managed option is US$6–10 per user per month and includes a quarterly re-audit.

Next steps

Count your licensed users, then check the price for your band on the Microsoft 365 Security Audit pricing page. If you would like to confirm scope or ask for a quote for more than 150 users, contact us. To see what you would receive, open the sample report (English page), and for the wider IT review service see IT assessment and audit.