Microsoft 365 Security Review vs Audit vs Assessment: Same Work? Scope and Deliverables Compared

The short version: A Microsoft 365 security review, audit and assessment are usually the same work: a check of how your tenant is configured. What differs between providers is the baseline used, whether a person checks the manual controls, and what evidence you get. Ask those three questions and you will not pay twice for the same thing.

You ask three providers for help with Microsoft 365 security. One offers a "security review", one a "security audit", one a "security assessment". The names sound like three levels of depth, and it is tempting to assume the review is the light option and the audit the heavy one. Often they are the same work with different labels, and sometimes a "review" is deeper than an "audit".

This guide explains what each word usually implies, what a tenant security review and an identity security review cover, how to compare scope and evidence across offers, and which questions tell you what you are really buying.

Are a Microsoft 365 security review, audit and assessment the same thing?

In practice, mostly yes. All three normally describe the same core activity: someone reads the configuration of your Microsoft 365 tenant, compares it with a baseline, and tells you what is wrong and what to fix first. None of them is a penetration test, and none of them involves reading your mail.

At Brocent the three names describe one engagement, with one scope and one fixed fee by headcount. We do not sell a lighter "review" at a lower price and a heavier "audit" at a higher one. So when we use the words below, we are describing how they tend to be used in the market, so you can read other proposals with a clear head.

What does each word usually imply?

The words carry different expectations, even when the work underneath is similar.

Security review

"Review" usually signals an expert looking over your setup and giving advice. It may follow a published baseline or the reviewer's own checklist. The output can range from a short list of recommendations to a full report. The risk with a review is that the scope is whatever the reviewer decided, so two reviews of the same tenant may cover different things.

Security audit

"Audit" usually signals a check against a named standard, with evidence for each result. In Microsoft 365 that standard is most often the CIS Microsoft 365 Foundations Benchmark. Each control is marked pass, fail or not applicable, and the report can be shown to a third party. The word suggests rigor, but it is not a regulated term here: an "audit" is not the same as a statutory or financial audit, and nobody is certified by it.

Security assessment

"Assessment" usually signals judgment about risk. Beyond pass and fail, it says which findings matter most for your business and in what order to fix them. Many assessments use the same benchmark as an audit and add prioritization.

The useful conclusion: a good piece of work has all three qualities. It follows a named baseline (audit), it is read and judged by a person (review), and it ranks the findings by risk and effort (assessment).

What is a tenant security review?

A tenant security review looks at the whole Microsoft 365 tenant, not one service. In a well-scoped one, three areas are covered.

• Identity (Entra ID): MFA, Conditional Access, privileged roles, legacy sign-in methods, app consent and guests.
• Email (Exchange Online and Defender for Office 365): SPF, DKIM and DMARC, automatic forwarding, inbox rules, anti-phishing and attachment policies, mailbox auditing.
• Files and collaboration (SharePoint, OneDrive, Teams): external sharing, anonymous links, sensitivity labels, retention, data loss prevention and Teams external access.

A tenant review should also say what it did not cover: devices managed through Intune, on-premises Active Directory, firewalls, backup, and any third-party SaaS beyond the permissions granted to it in Entra ID. If a proposal does not say, ask. Our Microsoft 365 security audit checklist lists the areas one by one if you want to compare a proposal against it.

What is an identity security review?

An identity security review is a narrower piece that looks only at who can sign in and with what rights. In Microsoft 365 that means Entra ID. Because one weakly protected password can open mail, files and Teams to an attacker, it is usually the part with the highest return. A useful identity review checks:

• every user's MFA status, including accounts that were excluded "temporarily" and never put back
• emergency access ("break-glass") accounts: whether they exist, how they are protected, and whether anyone is alerted when they sign in
• Conditional Access policies and every exclusion in them
• who holds Global Administrator and other privileged roles, and whether those people use phishing-resistant sign-in
• legacy authentication and SMTP AUTH, which bypass MFA
• third-party apps users have consented to, and what data those apps can read
• guest accounts, their owners and whether they expire

Some providers sell this on its own. If you are choosing between an identity-only review and a full tenant review, check the price difference. When the scope is fixed and the price is set by headcount, as ours is, identity is already included and there is no saving in buying it separately.

How do they compare on scope, evidence and depth?

When you put proposals side by side, ignore the name on the front and compare these points.

Comparing three typical offers

• Advisory review: scope set by the reviewer; often no named baseline; evidence usually screenshots or notes; good for a quick opinion, weak if you must show the result to an insurer or customer.
• Automated scan sold as an audit: a named baseline, but only the controls a script can read; evidence is a tool export; cheap and fast, but it skips the manual controls and does not tell you what to fix first.
• Full assessment: named baseline and version, manual controls checked by a person, each finding graded with evidence and effort, a fix plan in priority order; this is the one that can stand up as a record.

The biggest single difference is manual controls. The CIS Microsoft 365 Foundations Benchmark includes controls that no API reports on cleanly, so a person has to open the admin centres and check. An offer that skips them is a scan, whatever it is called.

The second biggest is evidence. If you will hand the result to an insurer, an auditor or a customer, each finding needs a date and a source. Our walkthrough of a Microsoft 365 security assessment report shows what that looks like page by page.

What should you ask before you buy any of them?

Six questions separate a real assessment from a relabelled scan. Ask them whatever the offer is called.

1. Which baseline, and which version? "Best practice" is not an answer. Expect a named baseline such as the CIS Microsoft 365 Foundations Benchmark, with a version number, and ideally a second one such as CISA's SCuBA baselines as a cross-check.
2. Are manual controls included? If not, you are buying a scan.
3. What access do you need? A tenant review should need read-only access approved once by your administrator, not a shared admin password. Our article on read-only Microsoft 365 audit app permissions lists what such an app should and should not ask for.
4. Will anyone read our mail or files? The answer should be no. Configuration and metadata are enough.
5. What exactly do we receive? A report with graded findings and evidence, a fix plan, and ideally a workbook of every control. Ask for a sample.
6. Is fixing included, and is there a re-check? Most fixed-price work excludes fixing. Know that before you compare prices.

If the answers are the same, two offers are the same product, whatever they are called.

How does Brocent deliver it?

One engagement, whichever word you use:

• Baselines: the CIS Microsoft 365 Foundations Benchmark, Level 1 and Level 2, including manual controls, with CISA ScubaGear results per service as a cross-check and Microsoft Secure Score as the trend line.
• Access: a read-only application approved once by your Global Administrator, about 15 minutes; no account or password shared; mail and documents never opened.
• Timeline: written report 5–7 business days after access, then a debrief call.
• Deliverables: graded findings with evidence and effort, a Cyber Essentials readiness table, an insurer evidence pack, a phased fix plan and an Excel workbook of every control.
• Not included: making the fixes (quoted as a fixed fee afterwards), backup, penetration testing, phishing simulation and on-premises equipment.

The fee is fixed by headcount and shown on the Microsoft 365 security review page. You can read the full sample report before you decide; it uses a fictitious client. If you are new to the subject, start with what a Microsoft 365 security audit is.

FAQ

Is a Microsoft 365 security review cheaper than an audit?

It depends on the provider, not the word. Some sell a lighter review at a lower price; others use the words interchangeably. Compare baseline, manual controls and evidence instead. We sell one engagement under all three names at one fixed price by headcount.

What is the difference between a tenant security review and an identity security review?

A tenant review covers the whole tenant: identity, email, files and collaboration. An identity review covers only Entra ID: who can sign in, with which rights and protections. Identity decides who gets in at all, so it is the core of any tenant review.

Does a security review include a penetration test?

No. A review, audit or assessment reads configuration. A penetration test tries to break in. They answer different questions and are priced separately.

Can we show a review to an insurer or a customer?

Only if it names its baseline and gives dated evidence for each finding. That is the practical line between an advisory note and a record you can hand over. Each insurer decides what it accepts.

How often should a Microsoft 365 tenant be reviewed?

There is no single rule. A review after any big change, such as a merger, a new licence plan or a switch of IT provider, is sensible, plus a regular check to catch settings that drift over time.

Which one do we need for Cyber Essentials?

Any of them can help, provided it maps findings to the Cyber Essentials requirements and flags the automatic-fail items, such as a cloud account without MFA. Ours includes a Cyber Essentials readiness table. The certificate itself still comes from a certification body.

Does Brocent sell separate review, audit and assessment products?

No. It is one engagement with one scope and one fixed fee by headcount, whichever word you search for.

Your next step: send your user count through the Microsoft 365 security assessment page. We confirm the band and the fixed fee within one business day.