it-service@brocent.com
Microsoft 365 Security Audit
A one-off CIS Benchmark audit of a whole Microsoft 365 tenant: graded findings with evidence, a phased fix plan, Cyber Essentials readiness and an evidence pack for the insurer. This sample uses a fictitious 14-person UK firm.
Read the full sample on this page
This page is the online preview: the same fictitious client and the same figures as the files. To download the PDF and Excel versions, tell us who you are.
Thank you — your downloads are ready
Fair shape and no sign of compromise, but three critical gaps to close in two weeks
Acme Capital's Microsoft 365 tenant is in fair shape for a 14-person firm run by a part-time IT lead. There is no sign of compromise: no risky sign-ins in the last 30 days, no malicious inbox rules and no unknown admin accounts.
The gaps that matter are concentrated in three places: two accounts that can still sign in without MFA (one of them a Global Administrator break-glass account with a password set in 2023), client identity documents that can be shared through anonymous 'Anyone' links, and personal phones that reach mail and files with no app protection.
Each of these would be a question an insurer or a Cyber Essentials assessor asks directly, and two of them are automatic fails under Cyber Essentials v3.3.
All three critical findings can be closed within the first two weeks with configuration already included in Business Premium. No additional licences are needed for anything in Phases 0 and 1 of the roadmap.
The tenant at a glance
Collected from a read-only scan on 12 Oct 2026 and re-checked on 14 Oct 2026. Projected scores assume Phases 0 and 1 are completed: risk score 78, Secure Score 71%.
The 3 critical and 7 high findings
Evidence. The 'All users — require MFA' policy excludes the group 'CA-Exclude'. It contains bg-admin@acmecapital.co.uk (Global Administrator, password last set 14 Mar 2023, no MFA method registered) and scanner@acmecapital.co.uk (licensed user account used by the office multifunction printer for scan-to-email).
Impact. Anyone who obtains the break-glass password, for example from an old password manager export, has full control of the tenant with no second factor. Cyber Essentials v3.3 fails an applicant where MFA is available on a cloud service but not used.
Recommendation. (1) Register two FIDO2 security keys for bg-admin and store them in separate locations; rotate the password to 32+ random characters. (2) Replace the exclusion group with a dedicated break-glass policy: exclude only bg-admin from 'All users — require MFA', and add a sign-in alert for that account. (3) Move scan-to-email to SMTP relay through a connector restricted to the office IP (see F-03), then remove the scanner account from the exclusion group. (4) Re-run the MFA coverage export and attach it to the insurer evidence pack.
Evidence. The CA policy 'Block legacy auth' is in report-only mode since 2 Feb 2026. Sign-in logs show 214 IMAP and SMTP AUTH sign-ins in 30 days, all from the scanner account and one user's Thunderbird client. SMTP AUTH is enabled at organisation level.
Impact. Legacy protocols do not support MFA, so they let a stolen password work even when MFA is required for everyone else.
Recommendation. (1) Move scan-to-email to a connector-based SMTP relay restricted to the office IP. (2) Move the remaining user from Thunderbird to Outlook (IMAP is no longer needed). (3) Switch 'Block legacy auth' to On; disable SMTP AUTH at organisation level (Set-TransportConfig -SmtpClientAuthenticationDisabled $true).
Evidence. Tenant sharing is set to 'Anyone'. The 'Client Onboarding' site, which holds 1,214 passport, driving licence and proof-of-address scans, uses 'Anyone with the link' as its default link type. 37 active anonymous links exist on that site; 11 have no expiry.
Impact. A forwarded link gives access to a client's identity documents without sign-in or audit trail. This is a reportable personal data breach risk under UK GDPR.
Recommendation. (1) Set the tenant to 'New and existing guests'; set the default link to 'Specific people'. (2) On Client Onboarding, set sharing to 'Only people in your organisation' and use a client file-request or guest link per matter. (3) Expire the 37 anonymous links; keep a CSV of them as evidence. (4) Apply a 'Confidential – Client ID' sensitivity label to the library (see F-16).
Evidence. 12 staff rely on Microsoft Authenticator push with number matching; 2 have passkeys. All 3 Global Administrators use push notifications. SMS is still an enabled method in the Authentication Methods policy and 4 users have it registered as a fallback.
Impact. Push and SMS can be defeated by adversary-in-the-middle phishing kits that are now common in invoice fraud against professional services firms.
Recommendation. (1) Enable passkeys (device-bound, Microsoft Authenticator) in the Authentication Methods policy. (2) Require phishing-resistant authentication strength for all admin roles through Conditional Access. (3) Run a 30-minute guided session for staff to register a passkey; then disable SMS and voice as methods. (4) Extend the phishing-resistant requirement to all users once 100% have registered.
Evidence. The managing partner, the IT lead and bg-admin hold Global Administrator permanently. The first two are the same accounts used daily for mail and Teams. Privileged Identity Management (PIM) is not available on Business Premium without Entra ID P2.
Impact. An everyday account that reads email and opens attachments is the most likely to be phished; when it is also a Global Administrator, one click compromises the tenant.
Recommendation. (1) Create cloud-only admin accounts (adm-<name>@acmecapital.onmicrosoft.com) without mailboxes for the IT lead and the managing partner. (2) Assign the least-privileged role each needs (the managing partner likely needs none day to day; the IT lead needs User and Exchange Administrator). (3) Keep 2 Global Administrators: bg-admin and adm-itlead. Remove Global Administrator from the daily accounts. (4) Optional (Phase 2): add Entra ID P2 for 2 admins to get PIM just-in-time activation.
Evidence. User consent is allowed for apps from verified publishers. 3 apps hold delegated Mail.ReadWrite or Files.ReadWrite.All: a PDF signing tool (in use), a calendar scheduler (last used Feb 2025) and an unverified 'Mail Merge Pro' app (consented by 1 user, Nov 2024).
Impact. Consent phishing gives an attacker persistent access to mailboxes that survives a password reset and bypasses MFA.
Recommendation. (1) Set user consent to 'Do not allow'; enable the admin consent workflow with the IT lead as reviewer. (2) Revoke the grants for the unused scheduler and 'Mail Merge Pro'. (3) Keep the PDF signing tool; record it in the approved-apps register.
Evidence. One mailbox (a partner's) forwards all mail to a personal Gmail address through an inbox rule created on 3 Jun 2026. The outbound spam policy allows automatic forwarding ('On').
Impact. Client correspondence, including identity documents, leaves the tenant without DLP or retention. Automatic forwarding is also a classic sign of mailbox takeover.
Recommendation. (1) Confirm with the partner that the rule is intentional (it is: travel convenience). Remove it and offer the Outlook mobile app instead. (2) Set automatic forwarding to 'Off' in the outbound spam policy; allow exceptions only through a named remote domain if a business case exists.
Evidence. acmecapital.co.uk: v=DMARC1; p=none; rua to a mailbox nobody reads. acme-capital.com (parked) has no SPF, DKIM or DMARC.
Impact. Attackers can send email that appears to come from acmecapital.co.uk; clients' mail systems will not reject it. Invoice redirection is the most common resulting fraud.
Recommendation. (1) Point DMARC aggregate reports to a reporting service (included) and review for 2 weeks. (2) Move to p=quarantine, then p=reject within 30 days once legitimate senders (CRM, e-signature) are aligned. (3) Publish 'v=spf1 -all', a null DKIM record and 'p=reject' on the parked domain.
Evidence. No DLP policy exists. The built-in sensitive information types for UK passport number, UK driving licence and UK National Insurance number match 1,980 files across SharePoint and OneDrive in content explorer (counts only; content was not opened).
Impact. Identity documents can be emailed or shared externally without warning or record.
Recommendation. (1) Create a DLP policy 'UK identity documents' for Exchange, SharePoint, OneDrive and Teams in test mode with policy tips. (2) After 2 weeks, block external sharing of matching content except with approved client domains, with override and justification.
Evidence. 7 personal iPhones and Android phones sign in to Outlook, Teams and OneDrive. No app protection policy exists and Conditional Access does not require one.
Impact. Client data on personal phones is not PIN-protected or encrypted at app level and cannot be selectively wiped when a phone is lost or a person leaves.
Recommendation. (1) Create iOS and Android app protection policies (PIN, block copy to unmanaged apps, selective wipe). (2) Add a CA policy: mobile platforms require an approved client app with app protection. (3) Full detail and settings: Intune Device Audit, findings I-01 and I-02.
Findings register, CIS results and readiness packs
What is already in good shape
- Security defaults were replaced by Conditional Access in 2025 and 4 policies are enabled.
- Microsoft Defender for Office 365 Plan 1 is active with Safe Links and Safe Attachments on all users.
- Unified audit logging is on and mailbox auditing is enabled for every mailbox.
- SPF and DKIM are correctly configured for the primary domain.
- Only 3 Global Administrators; no service principals hold privileged roles.
- Teams external access is limited to an allow-list of 6 client domains.
Findings register (24)
Every finding with its domain, severity, effort (S under half a day, M up to 3 days, L more) and the roadmap phase that closes it. Confidence says how the setting was verified.
| ID | Domain | Finding | Severity | Effort | Phase | Confidence |
|---|---|---|---|---|---|---|
| F-01 | Identity & access | Two accounts can sign in without MFA, including a Global Administrator | CRITICAL | S | P0 | Verified |
| F-02 | Identity & access | Only 2 of 14 staff have a phishing-resistant sign-in method | HIGH | M | P1 | Verified |
| F-03 | Identity & access | Legacy authentication is not blocked; SMTP AUTH is enabled tenant-wide | CRITICAL | S | P0 | Verified |
| F-04 | Identity & access | Global Administrators are permanently assigned and use their everyday accounts | HIGH | S | P1 | Verified |
| F-05 | Identity & access | Users can consent to third-party apps; 3 apps hold broad mail and file permissions | HIGH | S | P1 | Verified |
| F-06 | Identity & access | Sign-in risk and user risk are not used in Conditional Access | MEDIUM | S | P1 | Verified |
| F-07 | Identity & access | 9 guest accounts inactive for more than 90 days; guests never expire | MEDIUM | S | P1 | Verified |
| F-08 | Mailbox forwarding to an external address is active for one user | HIGH | S | P0 | Verified | |
| F-09 | DMARC is published with p=none and no reports are reviewed | HIGH | M | P1 | Verified | |
| F-10 | Anti-phishing impersonation protection covers no users or domains | MEDIUM | S | P1 | Verified | |
| F-11 | External sender tagging is off | LOW | S | P2 | Verified | |
| F-12 | Defender & threat protection | Alert notifications go to a mailbox nobody monitors | MEDIUM | S | P1 | Verified |
| F-13 | Defender & threat protection | Defender for Business is missing on 2 company Macs and incomplete on 2 more | MEDIUM | M | P2 | Confirmed with client |
| F-14 | SharePoint, OneDrive & data | 'Anyone' links are allowed and are the default on the Client Onboarding site | CRITICAL | S | P0 | Verified |
| F-15 | SharePoint, OneDrive & data | No data loss prevention policy for UK identity documents | HIGH | M | P1 | Verified |
| F-16 | SharePoint, OneDrive & data | Sensitivity labels are not published | MEDIUM | M | P2 | Verified |
| F-17 | SharePoint, OneDrive & data | No retention policy; client files kept indefinitely | MEDIUM | S | P2 | Confirmed with client |
| F-18 | SharePoint, OneDrive & data | OneDrive is accessible from unmanaged devices with full download | MEDIUM | S | P1 | Verified |
| F-19 | Teams | Anonymous users can join meetings and bypass the lobby | LOW | S | P2 | Verified |
| F-20 | Tenant hygiene & logging | 2 leavers' accounts are still enabled with licences | MEDIUM | S | P1 | Verified |
| F-21 | Tenant hygiene & logging | Audit log retention is 180 days; insurer asks for 12 months | LOW | S | P2 | Verified |
| F-22 | Devices (summary) | Personal phones access mail and files without app protection | HIGH | M | P1 | Verified |
| F-23 | Tenant hygiene & logging | Self-service password reset uses only security questions as the second method | LOW | S | P2 | Manual review |
| F-24 | Tenant hygiene & logging | Power BI and Fabric are not used | INFO | S | P3 | Verified |
CIS Microsoft 365 Benchmark results by section
118 controls assessed: 72 pass, 31 fail, 9 need manual review and 6 are not applicable. Pass rate is pass divided by pass, fail and manual.
| Section | Benchmark area | Pass | Fail | Manual | N/A | Pass rate |
|---|---|---|---|---|---|---|
| §1 | Microsoft 365 admin center | 9 | 3 | 1 | 0 | 69% |
| §2 | Microsoft Defender | 13 | 4 | 1 | 1 | 72% |
| §3 | Microsoft Purview | 4 | 5 | 1 | 0 | 40% |
| §4 | Microsoft Intune admin center | 2 | 2 | 0 | 0 | 50% |
| §5 | Microsoft Entra admin center | 19 | 9 | 2 | 1 | 63% |
| §6 | Exchange admin center | 12 | 4 | 1 | 0 | 71% |
| §7 | SharePoint admin center | 7 | 3 | 2 | 0 | 58% |
| §8 | Microsoft Teams admin center | 6 | 1 | 1 | 1 | 75% |
| §9 | Microsoft Fabric (Power BI) | 0 | 0 | 0 | 3 | — |
| All | Total | 72 | 31 | 9 | 6 | 64% |
CISA ScubaGear baseline results
| Baseline | Pass | Fail | Warning |
|---|---|---|---|
| Entra ID (AAD) | 14 | 9 | 3 |
| Exchange Online (EXO) | 17 | 5 | 2 |
| Defender / Security Suite | 21 | 4 | 3 |
| SharePoint & OneDrive | 5 | 3 | 1 |
| Teams | 15 | 2 | 3 |
| Power Platform | 4 | 2 | 2 |
Cyber Essentials v3.3 readiness (Microsoft 365 view)
| Requirement area | Control tested | Status today | Notes and finding refs |
|---|---|---|---|
| Firewalls | Boundary firewall and cloud service firewall settings | PARTIAL | Out of M365 scope; office router not assessed. Defender firewall on Windows enforced (Intune report). |
| Secure configuration | Remove unnecessary accounts and software; anonymous sharing | NOT MET | F-14, F-20. Closed in Phase 0–1. |
| Secure configuration | Device unlocking (PIN ≥ 6, lockout ≤ 10 attempts) incl. BYOD | NOT MET | Personal phones have no app PIN (F-22, Intune I-01). |
| User access control | MFA on all cloud services where available | NOT MET — AUTO-FAIL | F-01 (2 accounts without MFA). Closed in Phase 0. |
| User access control | Separate administrative accounts, least privilege | NOT MET | F-04. Closed in Phase 1. |
| User access control | Remove or disable unused accounts | NOT MET | F-20, F-07. |
| Malware protection | Anti-malware on all in-scope devices | PARTIAL | 2 Macs without Defender (F-13, Intune I-04). |
| Update management | Critical and high updates within 14 days | PARTIAL | 3 Windows laptops and 2 Macs over 14 days (Intune I-06). |
Cyber Essentials covers more than Microsoft 365. This table shows only what the tenant and its connected devices evidence.
Insurer evidence pack
The questions cyber-insurance forms ask most, the honest answer today and after the fixes, and the dated export that proves each answer.
| Insurer question | Answer | Evidence |
|---|---|---|
| Is MFA enforced for all users on email and cloud apps? | Yes after Phase 0 (14 of 16 enabled accounts today). | EV-03 MFA coverage export, EV-05 CA policy list with exclusions |
| Is MFA enforced for all privileged/admin accounts? | Yes after Phase 0; phishing-resistant after Phase 1. | EV-07 privileged role assignments with methods |
| Is legacy authentication disabled? | Yes after Phase 0. | EV-05, EV-06 (30-day sign-in extract showing zero legacy sign-ins) |
| Is email filtered for malware and phishing; are SPF/DKIM/DMARC in place? | Yes; DMARC at reject after Phase 1. | EV-11 DNS records, EV-12 Defender policies |
| Is EDR deployed on all endpoints and monitored? | Windows yes; Macs after Phase 2; alerts routed in Phase 1. | EV-13 Defender device inventory |
| Are backups of Microsoft 365 data taken and tested? | Outside this audit's scope. No Microsoft 365 backup is in place today; Brocent can propose one separately. | — |
| How long are logs retained? | 180 days; 12 months after Phase 2. | EV-19 audit configuration |
| Is sensitive personal data protected (DLP, access controls)? | After Phase 1 (DLP) and Phase 2 (labels, retention). | EV-14, EV-15, EV-16 |
The phased fix plan
| Ref | Risk | Severity | Owner | Due | Status | Next action |
|---|---|---|---|---|---|---|
| P0 | Phase 0 — Stabilise — ≈ 1.5 days. F-01 Close MFA gaps; secure the break-glass account; F-03 Block legacy authentication and SMTP AUTH; F-08 Remove external forwarding; turn automatic forwarding off; F-14 Remove 'Anyone' links on Client Onboarding. | CRITICAL | Brocent + Acme IT lead | Days 0–14 | Proposed | Success measure: 0 accounts without MFA; 0 legacy sign-ins in 7 days; 0 anonymous links on sensitive sites. |
| P1 | Phase 1 — Harden — ≈ 4 days. F-02 Passkeys and phishing-resistant MFA for admins; F-04 Separate admin accounts; F-05 Admin consent workflow; F-09 DMARC to p=reject; F-10, F-12 Defender impersonation and alert routing; F-15 DLP for UK identity documents; F-22 App protection for personal phones (with the Intune roadmap); F-06, F-07, F-18, F-20 Hygiene items. | HIGH | Brocent + Acme IT lead | Days 15–60 | Proposed | Success measure: CIS L1 pass rate ≥ 85%; Secure Score ≥ 70%; DMARC at reject; 100% of mobile sign-ins with app protection. |
| P2 | Phase 2 — Govern — ≈ 2 days. F-16 Sensitivity labels; F-17 Retention for client identity documents; F-21 12-month log retention; F-11, F-19, F-23 Remaining low items; F-13 Defender on remaining Macs. | MEDIUM | Brocent + Acme IT lead | Days 60–120 | Proposed | Success measure: All critical and high findings closed; labels on all client libraries; free verification re-audit issued. |
| P3 | Phase 3 — Sustain — Quick Audit Pack. Quarterly Quick Security Check with change report against this baseline; Guest and admin access review; Cyber Essentials and insurer questionnaire support; Tracking of new Microsoft and CIS changes. | LOW | Brocent + Acme IT lead | Quarterly | Proposed | Success measure: No regression between quarters; any new critical item fixed within 14 days. |
How this report was produced
| Source | Extracted | Records | Used for |
|---|---|---|---|
| CIS Microsoft 365 Foundations Benchmark | v7.0.0 | — | Level 1 and Level 2, E3 and E5 profiles applicable to Business Premium |
| CISA SCuBA baselines (ScubaGear) | v2.0.0 | — | Entra ID, Exchange Online, Defender / Security Suite, SharePoint & OneDrive, Teams, Power Platform |
| Microsoft Secure Score | Live, 12 Oct 2026 | — | Identity, Data, Devices, Apps |
| Cyber Essentials requirements | v3.3 (Danzell) | — | Cloud services, user access control, secure configuration, malware protection, update management |
Method and definitions
Access. Read-only audit application, admin consent granted by a Global Administrator; no Brocent accounts or passwords in the tenant.
In scope. Entra ID: users, guests, MFA registration and methods, Conditional Access, privileged roles and PIM, app registrations, consent, sign-in risk; Exchange Online: mail flow, forwarding, SMTP AUTH, auditing, anti-phishing, SPF / DKIM / DMARC for all accepted domains; Microsoft Defender for Office 365 and Defender for Business (portal configuration); SharePoint Online and OneDrive: tenant and site sharing, link defaults, guest expiry, sensitive sites; Microsoft Teams: external access, guest access, meeting policies; Microsoft Purview: DLP, retention, sensitivity labels, audit retention; Microsoft Secure Score and ScubaGear baseline results; Intune: summarised here; full device findings are in the separate Intune Device Audit report (BCS-INTA-2026-0148).
Out of scope. Content of documents and mailboxes (the audit reads configuration and metadata only); Penetration testing, phishing simulation and social engineering; Third-party SaaS applications outside Microsoft 365 (except their OAuth grants in Entra ID); Physical security and on-premises network equipment.
Severity. Critical: Likely to be exploited and would give an attacker tenant-wide access or expose regulated data. Fix within 14 days; High: Realistic attack path or a control that insurers and Cyber Essentials test directly. Fix within 30 days; Medium: Weakens defence in depth or detection. Fix within 90 days; Low: Hygiene or best practice. Schedule with routine work; Info: Observation, no action required.
Effort. S: Under half a day, configuration only; M: Half a day to 3 days, may need user communication; L: More than 3 days or needs a project (devices, licences, process).
Confidence. Verified: Read from the tenant through Microsoft Graph or PowerShell and re-checked on the verification date; Confirmed with client: Configuration read automatically; business context confirmed with Acme Capital's IT lead; Manual review: No API exposes the setting; reviewed in the admin portal with the client on a screen share.
Acme Capital Limited is a fictitious client. Every name, domain, user, device and figure in this sample is invented for illustration and describes no real tenant. The downloadable PDF and Excel workbook use exactly the same data.
BCS Support Center · it-service@brocent.com
Questions about this audit
- Can I see a sample audit report?
- Which audit depth suits a business of about 15 people?
- What permissions does your read-only audit application ask for?
- When you re-scan, do we get a list of changes or a complete new report?
- Which parts of the audit report do insurers accept as evidence?
- Does the audit help with Cyber Essentials?
- Does remediation include staff guides and user support?
- We have Macs, Windows laptops, iPhones and Android phones, some of them personal. How do you audit and secure that mix?
More Report Central samples
Want this for your own tenant?
The audit is read-only. Your Global Administrator approves access once, which takes about 15 minutes; you then receive a dated report and workbook like these.