Microsoft 365 Security Assessment: Entra ID, Exchange and Tenant Review

A Microsoft 365 security assessment shows how well your tenant would hold up if one password, one phone or one mailbox were compromised. We review the settings that decide that outcome (Entra ID sign-in rules, admin roles, Exchange Online mail flow, SharePoint and Teams sharing, and Defender protections) against Microsoft’s guidance and the CIS Microsoft 365 Foundations Benchmark. We then confirm the riskiest gaps by hand and give you a prioritised plan to close them.

It is the tenant-level part of our cloud penetration testing service, offered on its own because Microsoft 365 is where many organisations keep their email, files and identities. A single compromised mailbox can lead to invoice fraud, data loss or a foothold in the rest of your estate.

What is a Microsoft 365 security assessment?

It is an independent review of your side of Microsoft 365: the configuration, identities and data you control. Microsoft secures the service itself; you decide who can sign in, from where, with what, and what they can share. An M365 security assessment, also called an Office 365 security assessment, Office 365 security audit or tenant review, checks those decisions.

It combines two things. A configuration review reads your policies and settings across every workload in scope. Hands-on checks then use a standard test account to confirm what a compromised user could actually see, share, forward or consent to. Reviewing and testing your own tenant this way stays within Microsoft’s rules of engagement, which our guide to cloud penetration testing rules covers for Microsoft 365 as well as AWS and Azure.

What does a Microsoft 365 tenant review check?

Every area where a configuration choice changes your exposure:

Microsoft 365 security checklist: what we check first

These are the settings we look at first in every tenant, because each one decides how far a single compromised account could go. The last column shows where each check sits in the CIS Microsoft 365 Foundations Benchmark, which groups its recommendations by admin centre. Recommendation numbers change between benchmark versions, so the report cites the version used.

How do you assess Entra ID, conditional access and MFA?

We start with identity, because in Microsoft 365 the sign-in is the perimeter. The question is not whether MFA is switched on but whether every route into the tenant is covered by it.

That means reading each conditional access policy for its exclusions, since an excluded group or service account is often the gap. We check that legacy authentication is blocked, that the only exclusions are your emergency access accounts and that those are protected by strong credentials and monitored, and that administrators use phishing-resistant methods such as FIDO2 security keys, passkeys or Windows Hello for Business. We also look at who can register MFA methods and from where, how guest accounts are governed, and whether risky sign-ins trigger anything when your licences support it.

For admin roles we count standing Global Administrators, check that admin accounts are cloud-only and separate from day-to-day accounts, and review Privileged Identity Management if you have it. If you are working towards certification, our page on Cyber Essentials MFA requirements sets out which accounts the scheme says must use MFA.

How do you check Exchange Online and email security?

We look for the settings an attacker relies on after taking over a mailbox, and the gaps that let others impersonate you.

After a takeover, the usual next steps are a hidden inbox rule, a forward to an outside address or a quiet change to a supplier’s bank details: the classic route to business email compromise. We check outbound forwarding controls, mail flow rules, connectors, mailbox delegation and whether alerts fire when someone creates a forwarding rule. Our test account then tries the same moves so you can see what is blocked.

On the inbound and spoofing side we review anti-phishing and impersonation protection, Safe Links and Safe Attachments, and SPF, DKIM and DMARC for every domain you own, including domains that never send mail. The NCSC’s email security and anti-spoofing guidance explains how these records work together so that receiving servers can discard mail that fails the checks. Getting there means moving DMARC from monitoring to an enforcing policy, and we tell you what stands in the way.

What about SharePoint, OneDrive and Teams sharing?

Sharing settings decide how far your data can travel without anyone noticing. We review the organisation-wide sharing level, the default link type users get, expiry on anonymous links, and how site-level settings differ. In Teams we check guest access, external access to other organisations and how people outside the business can join meetings.

We then compare the settings with how the business actually works, because the right answer for a firm that collaborates with clients daily differs from one that never shares files externally.

Is Microsoft Secure Score or a free tool enough?

Secure Score and free configuration checkers are useful context, but they are not an assessment. Microsoft Secure Score measures how many of Microsoft’s recommendations you have adopted for your licences. Points can also be awarded when an action is marked as resolved through a third party or another mitigation, so the score may not match what is configured.

It also does not weigh exceptions, such as a conditional access policy that excludes a group of senior staff, or show what one compromised account could reach. We record your score at the start, explain which open recommendations matter for your risk and which you can reasonably accept, and report what the score cannot show.

Free tools work in a similar way. CISA’s ScubaGear, an open-source tool from the US Cybersecurity and Infrastructure Security Agency, compares a tenant with its Secure Cloud Business Applications (SCuBA) baselines, and community-built scripts do similar jobs. Running one before an assessment is worthwhile, and we can use its output as a starting point.

How does the assessment run?

The hands-on checks follow the five stages of penetration testing on a smaller scale, from planning and reconnaissance to analysis and reporting, applied to a single tenant.

What do you get in the report?

• An executive summary written for leadership and non-technical stakeholders.
• Each finding with a risk rating, the exact setting and where to change it, and any licence it depends on.
• A remediation plan in three tiers: fix now, fix next and plan for, so quick wins are not held up by larger projects.
• Notes on how findings relate to the controls you are audited against, such as ISO 27001:2022 Annex A 5.15 (access control), 5.23 (information security for use of cloud services), 8.2 (privileged access rights) and 8.5 (secure authentication).
• Where scoped, a retest of remediated findings and an updated report.

How does this fit with Cyber Essentials, Azure and phishing tests?

Microsoft 365 is a cloud service in Cyber Essentials scope, so the scheme’s requirements on MFA and administrator accounts apply to it, and our Cyber Essentials for Microsoft 365 guide maps the settings to each control. The assessment goes further than the question set, but fixing its findings usually makes certification easier.

Entra ID is shared with Azure, so if you also run workloads there, Azure penetration testing covers subscriptions, role assignments, storage and Key Vault. And because many tenant compromises start with a convincing email, a phishing simulation tests the people side alongside the configuration.

What affects the cost of a Microsoft 365 assessment?

We do not publish a set price, because effort depends on the tenant rather than the headcount:

Send us the basics through our penetration testing quote form and we will return a fixed price.

Why Sovereign Secure

• We are a PCI SSC-approved Qualified Security Assessor (QSA) company and ISO 27001 certified, so reports are written to stand as audit evidence.
• We are an IASME-licensed Cyber Essentials certification body, so we know how Microsoft 365 settings are judged in that scheme.
• Our testers cover cloud, web, API, network, mobile, social engineering and red team work, so a tenant finding that leads elsewhere can be followed up.
• Proposals are fixed-price, and a retest of remediated findings can be built in from the start.

Next step

Tell us which Microsoft 365 workloads you use, roughly how many users and domains you have, and whether you sync from on-premises Active Directory. We will confirm the scope and send a fixed-price proposal; we aim to reply within one working day.