What Is a Microsoft 365 Security Audit? What It Checks, How Long It Takes and What It Costs

The short version: A Microsoft 365 security audit is a one-off review of how your tenant is actually configured, measured against the CIS Microsoft 365 Benchmark at Level 1 and Level 2, including the manual controls a scanner cannot read. The auditor reads configuration through a read-only app and never opens mail or documents. Brocent delivers a report and workbook 5-7 business days after consent, priced by headcount from US$450 for 1-10 users.

If you are asking what is a Microsoft 365 security audit, there is usually a question behind the question. A cyber insurance renewal form asked about multi-factor authentication. A large client sent a supplier security questionnaire. Or the owner read something and asked whether "our Microsoft 365 is secure". This article explains, from a small or mid-sized business's point of view, what the audit is, what it checks, how long it takes, what you receive and what it costs.

It covers the one-off audit only. If you already know you want one and are comparing how providers charge, read fixed price or hourly. If you want to know what drives the price, read the audit cost guide.

What is a Microsoft 365 security audit?

In one sentence: a tenant security audit compares the settings of your Microsoft 365 tenant, item by item, with a published baseline, and writes down every gap, why it matters, how to fix it and how much effort the fix takes.

Three words in that sentence deserve a closer look.

• Tenant, not computers. The subject is the cloud environment that holds your company's email, files, meetings and identities: Entra ID, Exchange Online, SharePoint, OneDrive, Teams, Defender and Purview. Staff laptops are the subject of a separate Intune device audit.
• Settings, not content. The audit reads configuration and metadata: which accounts have no MFA, which sharing links never expire, which admin roles are permanently assigned. It does not read the body of your email or open your documents.
• A baseline, not an opinion. Brocent measures against the CIS Microsoft 365 Foundations Benchmark at Level 1 and Level 2. The benchmark is public, so you can read it yourself, and the report names the version it was measured against.

Many people assume that because they pay Microsoft, Microsoft looks after security. Half of that is true: Microsoft runs the platform. How your tenant is configured is your side of the line, and its state is simply whatever it was set to on day one plus whatever anyone with rights has changed since. The audit's value is that someone finally looks at that state, once, properly.

What does a Microsoft 365 security audit check?

Following Brocent's published sample audit report, the scope breaks into these areas. Each maps to specific benchmark controls rather than to a vague "best practice".

1. Entra ID users and guests: every account, guest accounts, disabled and dormant accounts, and whether shared mailboxes can sign in.
2. Multi-factor authentication: registration status and method per user, who only has SMS, who has a phishing-resistant method, and which administrators have nothing at all.
3. Conditional Access: what existing policies cover, the exclusion groups, whether any policy has been left in report-only mode, and whether legacy authentication is blocked.
4. Privileged roles and PIM: how many Global Administrators there are, whether roles are permanent, whether admins use their everyday accounts, and whether emergency access accounts exist.
5. App registrations and consent: whether users can consent to third-party apps themselves, and which apps hold broad permissions over mail and files.
6. Exchange Online mail flow: forwarding rules, external auto-forwarding, SMTP AUTH, mailbox auditing and transport rules.
7. Anti-phishing and Defender for Office 365: preset policies, impersonation protection, and whether Safe Links and Safe Attachments actually cover every user.
8. SPF, DKIM and DMARC: the record for every accepted domain, whether DMARC is still at p=none, and whether anyone reads the reports.
9. SharePoint and OneDrive sharing: tenant and site-level external sharing, "anyone" links, default link types and guest expiry.
10. Teams: external access, guest access and the meeting policies that decide who can join and share.
11. Purview: data loss prevention policies, retention, sensitivity labels and audit log retention.
12. Secure Score and the ScubaGear baseline: included as reference points, not as conclusions.

Device compliance for Windows, Macs and phones is summarised only; the full device findings sit in the separate Intune device audit. If you want to walk through your own tenant first, the Microsoft 365 security audit checklist goes area by area.

What is a Microsoft 365 security audit not?

It is worth clearing up a few common confusions before you buy, so you do not pay for one thing and expect another.

Secure Score vs a CIS audit vs a penetration test

• Microsoft Secure Score: built into the tenant, automated, and limited to settings the API exposes. Useful as a trend line, but blind to manual controls such as whether the emergency access accounts are protected or whether admin roles are genuinely restricted. It is not an audit, and insurers and assessors do not treat it as a formal assessment.
• CIS Benchmark audit (the subject of this article): a person measures the tenant against the benchmark, including the manual controls Secure Score cannot see, and produces a report with evidence, priorities and effort estimates. The right choice when someone outside the company needs to see the result, or when you need an ordered list of fixes.
• Penetration test: a simulated attack that answers "can someone get in" rather than "are the settings right". The two complement each other and neither replaces the other; insurance questionnaires are usually asking about the former.

Two more things are not an audit either. A vulnerability scan looks for known weaknesses on servers and endpoints, not at tenant settings. A monthly security report is an ongoing service rather than a one-off check, and the difference is explained at the end of this article. For a deeper comparison of the tools, read Secure Score vs CIS Benchmark vs ScubaGear.

How does the audit work, and how long does it take?

From your side there are four steps, and your own time adds up to less than two hours.

1. Consent to a read-only app. One of your Global Administrators approves it once in Entra ID. It takes about 15 minutes. No Brocent account or password is created in your tenant and nothing is installed.
2. Reading and verification. The auditor reads configuration through Microsoft Graph and PowerShell. Anything read automatically is read again on the verification date. Settings that no API exposes are reviewed in the admin portal with you on a screen share.
3. The report. Counting from the day consent is granted, the report and workbook arrive in 5-7 business days.
4. The debrief. A video call walks through the findings, the order to fix them and how, scheduled in your time zone.

Consent can be withdrawn at any time by removing the app in Entra ID, and nothing is left behind.

What happens after the debrief?

The report is yours to act on in whatever order suits the business. Most companies fix the critical and high findings first, which in a typical small tenant means enforcing MFA for the accounts that lack it, removing permanent Global Administrator assignments, blocking legacy authentication and closing external auto-forwarding. Those are configuration changes that usually take an afternoon. The medium and low findings go into routine work, with the workbook as the tracking sheet. If you want the same auditor to re-read the tenant after the fixes, a re-check is a separate, smaller piece of work; if you would rather have a third party do the fixes, the report is written so that any competent provider can follow it.

What do you receive?

Two documents built from the same data.

• The audit report (PDF): a one-page executive summary, the scope and method including the benchmark version, a findings register sorted by severity and effort, and for each finding the observation, impact, fix steps, rollback and user impact, followed by a phased remediation roadmap and an evidence appendix.
• The audit workbook (Excel): pass or fail for every control, evidence references, and owner and status columns so you can track remediation yourself.

Both are designed to be used as evidence: when answering an insurance questionnaire, replying to a client's supplier questionnaire or preparing for a Cyber Essentials assessment, you can cite them directly. Two cautions: the audit does not grant any certification, and no insurer or assessor is obliged to accept it. The sample report walkthrough goes through the document section by section.

How much does a Microsoft 365 security audit cost?

The price depends on the number of users in the tenant. It is a one-off fee in US dollars, excluding tax: US$450 for 1-10 users, US$990 for 11-25, US$1,800 for 26-75 and US$2,900 for 76-150. Tenants above 150 users are quoted. The price is the same whether the audit finds three issues or thirty. Remediation is separate work, quoted per job, and is not part of the audit.

The full price list and what each band includes are on the Microsoft 365 security audit pricing page.

When do you need an audit?

Because the audit is a one-off, something usually triggers it. The five most common triggers:

• A cyber insurance renewal. When the form asks about MFA, admin accounts and email protection, you need dated evidence, not "we should have that".
• A client's supplier security questionnaire. Larger customers increasingly ask suppliers to show how their Microsoft 365 tenant is set up.
• Before applying for Cyber Essentials or a similar scheme. Find out how far the tenant is from the requirements before you scope the fixes.
• An acquisition or merger. Look before you take over a tenant someone else configured.
• Before rolling out Copilot. Copilot turns over-shared documents into answers anyone can ask for, so sharing settings deserve a review first.

If nobody has ever reviewed your tenant, you do not need a trigger. A few years of ordinary drift is usually enough to fill a findings list.

How does a one-off audit differ from a monthly security report?

A one-off audit is a photograph. It tells you how the tenant stands today. It does not stop someone creating a never-expiring sharing link next month, and it does not notice that a new starter was onboarded without MFA.

A monthly security report is part of a managed IT service: someone watches the tenant continuously and reports the changes and the state every month. The usual sequence is to audit first, fix the few findings that matter most, and then decide whether you want someone watching on an ongoing basis. For how the audit runs for a Hong Kong company specifically, see Microsoft 365 security audit in Hong Kong.

Frequently asked questions

Does a Microsoft 365 security audit read our email or documents?

No. It reads configuration and metadata: accounts, roles, policies, sharing settings and mail flow rules. Mail content and document content are explicitly out of scope.

How much of our time does it take?

About 15 minutes to grant consent, roughly an hour for the debrief, and possibly one screen-share session for the manual controls. Your total involvement is normally under two hours.

When do the 5-7 business days start?

From the day your Global Administrator consents to the read-only app, not from the day you sign.

Can we give the report to our insurer or a client?

Yes. The report and workbook are designed to be used as evidence: dated, with evidence references and the benchmark version stated. Whether they accept it is their decision; the audit itself guarantees nothing.

Does the audit include remediation?

No. Every finding comes with fix steps and a rollback, so you can do the work yourself or give it to any provider. Remediation by Brocent is quoted separately per job.

We have eight staff. Do we still need an audit?

A small headcount does not mean few settings. An eight-user tenant is measured against the same controls as an eighty-user tenant, and small companies are often the ones where a colleague set things up years ago and nobody has looked since. The price for 1-10 users is US$450.

Is this the same as the Intune device audit?

No. This article is about the tenant audit. Enrolment, compliance, encryption and update status for Windows, Mac, iPhone and Android devices are covered by the separate Intune device audit, which can be bought on its own or alongside.

Next steps

To see what the deliverable looks like, read the sample audit report. To get the price for your tenant, see the pricing page, or talk to a consultant with your user count and what triggered the question, and we will confirm the band and the delivery date.