Microsoft 365 Security Audit vs Penetration Test: Which One Does Your Insurer, Auditor or Board Actually Want?

The short version: A Microsoft 365 security audit reviews how your tenant is configured against a published benchmark and tells you what to fix. A penetration test has a tester try to get in and shows what an attacker could actually reach. Insurance questionnaires mostly ask about configuration (MFA, admin accounts, email security, logging), so the audit answers them. Some auditors and frameworks name penetration testing explicitly. Boards usually want both, in that order: fix the configuration first, then test it.

Sooner or later someone outside the IT team asks for "a security test". It might be the cyber-insurance renewal form, a client's supplier questionnaire, an external auditor or a director who read about a breach. The request rarely says which kind of test, and the two most common answers, a Microsoft 365 security audit and a penetration test, are different products that produce different evidence.

This guide compares the Microsoft 365 security audit vs penetration test question from the buyer's side: what each one examines, what the person asking usually means, and how to sequence them so you are not paying for a test that only rediscovers settings an audit would have listed. If you need the broader picture of continuous scanning and patching, our guide to vulnerability management vs penetration testing covers that; this article stays with the Microsoft 365 tenant.

What does a Microsoft 365 security audit actually check?

A Microsoft 365 security audit is a configuration review. There are no servers of yours inside Microsoft 365 to probe, so the scope is the tenant's settings and who can reach its data. A good audit works through a published benchmark, usually the CIS Microsoft 365 Foundations Benchmark, and records for each control whether the tenant meets it, with evidence.

In practice the review covers three areas:

• Identity in Entra ID: MFA coverage per user including service and break-glass accounts, Conditional Access policies and their exclusions, privileged roles, legacy authentication, third-party app consent and guest accounts.
• Exchange Online and Defender for Office 365: SPF, DKIM and DMARC on every domain, external auto-forwarding and inbox rules, anti-phishing and Safe Links policies, mailbox auditing and audit log retention.
• SharePoint, OneDrive, Teams and data: external sharing and "Anyone" links, sensitivity labels and retention, Teams external access, and personal devices that reach company files.

The output is a findings register graded by severity, the evidence behind each finding and a prioritised remediation plan. It is designed to be used as evidence when you answer a questionnaire; it does not certify anything. Our sample Microsoft 365 audit report shows what that looks like on a fictitious client.

What an audit does not do is attempt an attack. It can tell you that twelve accounts have no MFA registered; it does not try to log in as one of them.

What does a penetration test of Microsoft 365 involve?

A penetration test is an authorised, time-boxed attempt to compromise something, carried out by a tester who documents each step that worked. For most small and mid-sized organisations a "penetration test" covers the internet-facing perimeter, the internal network or a web application. Our penetration testing service lists the usual types: external, internal, web application and social engineering.

Microsoft 365 is a special case because you do not own the platform. Microsoft publishes the Microsoft Cloud Unified Penetration Testing Rules of Engagement, which apply to its cloud services including Microsoft 365. Testing must stay within your own tenant and accounts you are authorised to test; denial-of-service testing and testing other customers are prohibited. So a penetration test that involves Microsoft 365 is really a test of your identities, your configuration and your people: can a tester obtain a valid credential, does MFA stop them, can a phished session reach mail and files, can a low-privilege account escalate.

That is valuable, but notice how much of it depends on configuration. If the audit would show legacy authentication still enabled or admins without phishing-resistant MFA, the tester will find the same thing, and you will have paid for a slower route to a finding you could have fixed first.

Microsoft 365 security audit vs penetration test vs vulnerability scan at a glance

The three side by side

• Question it answers: the audit asks "is the tenant configured the way the benchmark recommends?"; the penetration test asks "could someone actually get in, and how far?"; a vulnerability scan asks "which known weaknesses are visible on these systems right now?"
• Method: the audit is a read-only review of settings and logs; the penetration test is an authorised attack within agreed rules; the scan is automated and repeatable.
• Scope in Microsoft 365: the audit covers every tenant workload; the penetration test covers your identities, configuration and people within Microsoft's rules of engagement; a network scan does not look inside Microsoft 365 at all.
• Typical output: the audit gives a graded findings register, evidence and a fix plan; the penetration test gives an attack narrative with proof of each step; the scan gives a list of vulnerabilities by severity.
• Best evidence for: the audit suits insurance questionnaires and configuration questions; the penetration test suits frameworks or contracts that name penetration testing; the scan suits ongoing hygiene on servers and endpoints.
• When it goes stale: all three describe a point in time; the audit and scan are cheap to repeat, a penetration test less so.

What is your cyber insurer usually asking for?

Read the renewal form literally. Most cyber-insurance proposal forms ask about controls: is MFA enforced for email and remote access, are administrator accounts separate and protected, is legacy authentication blocked, are backups taken and tested, how long are logs kept. Those are configuration questions, and a Microsoft 365 audit produces a dated answer to each one. Our article on answering a cyber insurance questionnaire with Microsoft 365 evidence goes through the common questions one by one.

Where a form asks "have you had a penetration test in the last 12 months?", it usually wants to know about your internet-facing systems, and a "no" is often acceptable for a small firm if the control questions are answered well. If the form or your broker makes a penetration test a condition, buy one, but scope it on the systems they mean, and fix the configuration findings first so the test report does not open with avoidable basics.

Two rules for any evidence you hand an insurer: keep it dated, and never describe it as approved by the insurer. The insurer makes its own decision on what you send.

What does an external auditor or a framework want?

It depends on the framework, and the honest answer is to read the clause.

• Frameworks that name penetration testing: PCI DSS v4.0.1, Requirement 11.4, calls for internal and external penetration tests at least once every 12 months and after significant changes. If you are in PCI scope, an audit does not replace that.
• Frameworks that ask for control evidence: ISO 27001 surveillance audits, SOC 2 reports and most client supplier questionnaires mostly want to see that controls exist and operate: access reviews, MFA, logging, configuration standards. A configuration audit, with its dated exports, is usually closer to what the auditor samples.
• Cyber Essentials (UK): the scheme's questions are about configuration, such as MFA on cloud services, admin accounts and secure configuration. The audit report includes a readiness view for the Microsoft 365 side; the certification body makes its own decision.
• Regulated financial firms in Asia: supervisory guidance often expects periodic penetration testing of critical systems. Our vulnerability management vs penetration testing guide covers the Hong Kong and Singapore triggers.

If the request is vague ("evidence of security testing"), ask the auditor which control they are sampling. The answer usually decides it in one sentence.

What does a board actually need?

A board is not asking for a methodology. It wants to know three things: how exposed are we, what are we doing about it, and how will we know it worked. The two products answer different halves of that.

The audit answers "how exposed are we and what do we fix first": a graded list, a short remediation roadmap and an effort estimate per item, which translates into a board paper without much editing. The penetration test answers "would it hold up against someone trying": a narrative of what an attacker could reach, which is persuasive but narrow, because it describes the paths one tester found in a fixed number of days.

For most boards of small and mid-sized firms the sensible request is: audit now, fix the high-severity findings, then commission a penetration test to validate the result. That sequence also gives the board a before-and-after it can understand.

Which should you do first?

In almost every Microsoft 365 environment we see, the audit comes first, for three reasons.

1. It is cheaper per finding. Configuration gaps (MFA exclusions, legacy protocols, open sharing) are found faster by reading settings than by attacking them.
2. It makes the test better. A tester working against a hardened tenant spends their days on the harder paths, which is what you are paying for.
3. It gives you something to fix immediately. Most audit findings are configuration changes that do not need new licences.

Commission the penetration test first only when a contract, a framework or an insurer names it as a condition with a deadline. Even then, a quick configuration review before the tester starts is worth it.

Buying from the UK or Australia?

The Microsoft 365 audit is delivered remotely: a Global Administrator approves a read-only application, the report follows in 5–7 business days, and the debrief is booked in your business hours. The audit pricing page has a section on how the audit fits Cyber Essentials and insurer questionnaires for UK and Australian buyers. If you also want ongoing IT support, see our pages for IT support in the UK and IT support in Australia.

What does each cost and how long does it take?

The audit is a fixed one-time fee set by Microsoft 365 headcount, with the same scope at every size. The current list prices, and any seasonal offer while it runs, are on the Microsoft 365 security audit pricing page. The written report arrives in 5–7 business days after tenant access is granted.

A penetration test is scoped per engagement, because the effort depends on what is in scope: how many external addresses, whether an internal network or web application is included, and whether social engineering is allowed. Expect a scoping call, a written rules-of-engagement document and a test window measured in days, followed by the report and a retest of fixed findings.

Frequently asked questions

Is a Microsoft 365 security audit the same as a vulnerability assessment?

For Microsoft 365, mostly yes. Because there is no infrastructure of yours to scan inside the tenant, a "vulnerability assessment of Microsoft 365" is in practice a configuration review against a benchmark. A vulnerability scan of your own servers, firewalls and laptops is a separate service.

Can you penetration test Microsoft 365 without Microsoft's permission?

You test within Microsoft's published rules of engagement rather than asking for case-by-case approval. The rules limit testing to your own tenant and authorised accounts and prohibit denial-of-service testing and anything aimed at other customers. Any reputable tester will put those limits in the written scope.

Will a penetration test find the same issues as an audit?

Some of them. A tester who finds an account without MFA will use it, so that gap appears in both. But a test stops at the paths that worked in the time available, while an audit lists every control that fails, including ones that only matter in combination.

Our insurer asked for a penetration test. Can we send the audit instead?

Only if the insurer or broker agrees. Send the audit evidence for the control questions in any case, and ask in writing whether a penetration test is a condition of cover or a scoring question. If it is a condition, scope a test on the systems they mean.

How often should each be done?

An audit is worth repeating annually and after major changes such as a merger, a new tenant or a licence change. A penetration test is usually annual where a framework requires it, and after significant changes to the systems in scope.

Does the audit fix anything?

No. The audit is read-only and produces findings and a remediation plan. Fixing them is a separate piece of work, done by your own team, your current provider or by us on a per-job quote.

Next step

If you are holding a questionnaire, an auditor's request or a board action that says "security test", send it to us and we will tell you which of the two it is asking for. Ask a consultant, or start with the Microsoft 365 security audit and add a penetration test once the findings are closed.