BCS Platform · IT Audit
BCS IT Security Auditor — automated Microsoft 365 security posture assessment
An enterprise-grade module natively built into the BCS platform. Connect customer Azure AD tenants, run automated scans across identity, access, applications, endpoints, and threat detection — then translate results into risk scores, findings, interactive reports, remediation plans, and synchronized asset inventories.
Why BCS
Beyond one-off scripts and disconnected audit tools
- ✓Persistent multi-tenant scan history with trend analysis across runs
- ✓Customer-linked operations aligned with BCS records, contracts, and asset management
- ✓Role-based access control integrated with BCS permissions
- ✓Encrypted credential storage with operator step-up authentication for sensitive operations
- ✓Formal remediation workflows with approval gates and exportable remediation reports
- ✓Directory and device synchronization from scan snapshots into BCS asset and identity views
Audit engine
14 domain-specific assessment modules
Scans run asynchronously via Celery with real-time progress. Individual module failures are logged and skipped — only catastrophic authentication failures mark a run as failed. Intune and Defender modules activate based on active Microsoft 365 SKUs. Two modules are optional extensions, enabled by separate written agreement.
Identity & MFA
Assess identity hygiene and multi-factor authentication posture across all enabled users — MFA gaps, stale passwords, and directory snapshots for asset sync.
Critical · High · MediumRisky Users & Sign-ins
Surface Identity Protection risk signals and anomalous authentication activity from risky users and elevated sign-in events in the past seven days.
High · MediumPrivileged Roles
Audit membership in high-impact Azure AD directory roles — Global Administrator, Security Administrator, and other privileged roles with excessive admin detection.
Critical · High · InfoApplication Permissions
Identify over-permissioned enterprise applications and risky OAuth2 delegated consent grants exposing dangerous application or delegated scopes.
Critical · HighConditional Access Gaps
Evaluate Conditional Access policy coverage — legacy authentication blocks, MFA enforcement, and risk-based policy presence against best practices.
Critical · High · MediumIntune Device Compliance
Assess endpoint management posture for Intune-managed devices — compliance failures, encryption gaps, stale sync, and missing compliance policies.
High · MediumMicrosoft Defender — Security Alerts
Surface active threat detection signals from Microsoft Defender XDR — open critical and high alerts and ongoing security incidents.
Critical · HighDefender for Endpoint
Deep endpoint vulnerability and exposure assessment via the Defender for Endpoint API — exposure scores, critical CVE instances, and fleet-wide risk.
Critical · HighLegacy Authentication
Surface actual legacy-protocol sign-ins observed in the last seven days — the gap Conditional Access policy review alone can't confirm is really closed.
Critical · HighGuest Governance
Inventory external guest accounts and flag those inactive for 90+ days — a common, rarely-reviewed source of standing external access.
Medium · LowMicrosoft Secure Score
Pull the tenant's current vs. maximum Secure Score and surface the highest-impact unimplemented recommendations.
InfoLicense Governance
Compare prepaid vs. consumed seats per SKU to flag unused-license spend — a cost finding, not just a security one.
Medium · InfoPhishing Simulation
Consent-gated simulated phishing campaigns via Microsoft Attack Simulation Training, paired with non-punitive remedial training for users who click through.
High · MediumExchange / SharePoint Deep Checks
Deeper mail and file-sharing posture review — external-redirect mail rules, auto-forwarding, and external-sharing configuration.
High · MediumBefore you start
What we need from your tenant
Consolidated here so first-time visitors see it before they ask — this replaces having the same information split across two FAQ answers below.
Register a dedicated Azure AD app in your own tenant
Read-only permissions only, via a step-by-step runbook. Nothing is granted beyond what scanning needs.
Complete admin consent, once
A tenant admin approves the app one time; no ongoing access is required from your side after that.
Confirm licensing for the gated modules you want enabled
Entra ID Premium P1/P2 for identity-depth checks; Intune / Defender licensing for the three license-aware modules above. Unlicensed modules are marked as such, not scored.
Name a point of contact to review the remediation plan
Someone who can approve findings and move items through the workflow after each scan.
Written consent, for Phishing Simulation only
Plus Defender for Office 365 Plan 2 / E5 licensing — this extension is opt-in and billed separately.
Certificate-based access, for Exchange / SharePoint Deep Checks only
A stronger auth method than the standard app registration, used only for this optional extension.
Benefits
Production-ready posture management for MSPs and enterprises
Unlike standalone audit scripts or one-off PowerShell reports, BCS IT Security Auditor provides a unified, auditable, customer-aware security workflow integrated directly into daily BCS operations.
14
Audit domains
0–100
Risk score scale
PDF + Excel
Export formats
24/7
Scheduled scan queue
- ✓Penalty-based 0–100 risk score with Good, Moderate, Poor, and Critical bands
- ✓Trend indicators comparing each scan to the previous completed run
- ✓Online reports, PDF (WeasyPrint), and multi-sheet Excel exports
- ✓Scheduled daily or weekly scans plus on-demand triggers per tenant
- ✓Findings management with acknowledge workflow and customer navigator sidebar
- ✓Remediation plans with Draft → Submitted → Approved → In Progress → Completed lifecycle
Use cases
Built for teams who audit Microsoft 365 at scale
Primary users include security auditors, MSP engineers, IT administrators, and compliance officers managing Microsoft 365 and Entra ID tenant security posture.
Managed service providers
Run automated security scans across many customer Azure AD tenants with persistent history, customer-linked findings, and exportable audit reports for client deliverables.
Enterprise security teams
Maintain continuous M365 posture visibility with scheduled scans, trend analysis, and formal remediation tracking aligned with internal security governance.
Compliance officers & auditors
Produce structured findings, risk-ranked reports, and remediation sign-off documentation for regulatory and internal audit programs.
Typical workflow
From tenant registration to measurable improvement
Register M365 tenant
Add tenant configuration with Azure AD app registration credentials, optional BCS customer link, and scan schedule (daily, weekly, or manual).
Run security scan
Trigger on-demand or let scheduled Celery jobs queue scans. Progress and current module name update in real time in the dashboard.
Review findings & risk score
Filter findings by severity, module, and customer. Open the interactive online report with executive summary and module statistics.
Sync assets & directory
Push Intune devices into BCS Assets and upsert Azure AD users and groups from scan snapshots.
Create remediation plan
Select Critical and High findings, submit for approval, track per-item resolution, and export remediation PDF with sign-off.
Re-scan & measure trends
Run follow-up scans and compare risk score trends across the last five completed runs to verify improvement.
Reports & remediation
Actionable intelligence — online, PDF, and Excel
Every completed scan produces structured output for stakeholders at every level — from executive summaries to per-finding remediation guidance.
Interactive online report
Full-width assessment with risk gauge, severity cards, module statistics, collapsible finding panels, and five-scan trend timeline.
PDF audit report
Professional A4 export via WeasyPrint with customer logo, executive summary, module grids, and finding cards aligned with the online report.
Excel workbook
Multi-sheet export with summary, all findings, and per-module sheets for identity and access domains.
Remediation plan governance
Transform audit findings into managed remediation programs with approval gates before work begins.
This scan engine also powers Brocent's human-delivered Quick Security Check. See Microsoft 365 Security Audit pricing →
Security & trust
Enterprise credential and access controls
Customer tenant credentials are never returned in API responses. Sensitive operations require operator Microsoft 365 re-authentication with a 30-minute step-up session.
- ✓Client secrets encrypted at rest with Fernet symmetric encryption
- ✓Operator step-up authentication for Test Connection and credential add/edit flows
- ✓BCS dynamic RBAC — granular permissions for view, read, run, export, and remediation approval
- ✓Scan results stored in BCS database; Graph API calls made from BCS backend to customer tenants
- ✓Separation of operator identity (who runs BCS) from audited tenant credentials
BCS platform
Deep integration across daily operations
The module is designed for production MSP and enterprise use — not a standalone tool disconnected from customer and asset records.
Customers
Tenant configs link to BCS customer records; findings and assets filterable by customer with aggregate severity badges.
Assets (MVServices)
Intune device sync creates or updates Asset records with intune_device_id mapping and compliance-based status.
User Management
Dynamic RBAC permissions registered via data migrations; M365 MFA status visible on user detail pages.
Help Center
Seven contextual IT Audit articles seeded under the IT Audit category — credentials, permissions, and specialist guides.
FAQ
Common questions
How is this different from Brocent's IT Assessment & Audit service? +
Brocent IT Assessment & Audit is a human-led consulting service with fixed-scope project audits and APAC compliance mapping. BCS IT Security Auditor is an automated software module inside the BCS platform for continuous Microsoft 365 tenant scanning, multi-tenant history, and remediation workflow management. Many teams use both — automated BCS scans for ongoing posture and Brocent consultants for deep compliance programs.
Which Microsoft 365 licenses are required? +
See “Before you start” above for the full checklist. In short: core identity, access, and application modules run against any tenant with appropriate Graph API permissions. Intune Device Compliance activates when SKUs include Intune, EMS, M365, or Business plans. Defender modules activate with Defender, ATP, M365, or Business SKUs. If SKU detection fails, conditional modules default to enabled and degrade gracefully when permissions are missing.
Where is scan data stored? +
Scan results, findings, and remediation plans are stored in the BCS PostgreSQL database. Microsoft Graph and Defender API calls are made from the BCS backend to customer tenants — data residency follows your BCS deployment.
What scan schedules are supported? +
Per-tenant configuration supports daily, weekly, or manual-only schedules. Celery Beat runs a daily queue at 02:30 HKT for eligible configurations. On-demand scans can be triggered from the dashboard at any time.
What Azure AD permissions are required? +
See “Before you start” above for the full checklist. In short: each customer tenant needs an app registration with application permissions (not delegated) for Microsoft Graph — including User.Read.All, Directory.Read.All, Policy.Read.All, and module-specific permissions for Intune and Defender. Admin consent must be granted in the customer tenant. Contact us for the full specialist permission checklist.
Related services
Complement automated scans with expert delivery
Pair BCS IT Security Auditor with Brocent's human-led security and audit services for end-to-end posture improvement.
See BCS IT Security Auditor in action
Request a demo to explore multi-tenant Microsoft 365 security scanning, risk scoring, and remediation workflows integrated into your BCS operations.