What is included in a Microsoft 365 security assessment?

Key facts

• Most real tenant risk sits in identity: MFA gaps, legacy authentication and too many standing admins.
• Secure Score is an input to an assessment, not the assessment itself.
• A useful report ranks findings by risk and effort and says what each fix could break.
• Assessments should be read-only; changes come later, in a planned remediation phase.
• Plan to repeat the review at least yearly and after any major change such as a merger or migration.

What the assessment covers

A good assessment looks at the tenant the way an attacker would and the way an auditor would. It starts with who can sign in, how, and with what privileges, then moves to where data lives and who it is shared with.

The review is usually done with read-only admin access, using the Microsoft Entra admin center, Microsoft Defender portal, Microsoft Purview portal, Exchange admin center and PowerShell exports. Open-source baselines such as the CISA ScubaGear tool can speed up evidence gathering, but a person still has to interpret the results in the context of your business.

• Identity: MFA coverage, authentication methods, legacy authentication, password policy, guest accounts and stale users.
• Conditional Access: policy coverage, exclusions, break-glass accounts and report-only policies left in place.
• Privileged access: Global Administrator count, role assignments, Privileged Identity Management use and admin account hygiene.
• Email: SPF, DKIM and DMARC, anti-phishing and impersonation settings, Safe Links and Safe Attachments, automatic external forwarding.
• Data: SharePoint and OneDrive external sharing, anonymous links, Teams guest access, sensitivity labels and DLP.
• Devices: Intune enrollment, compliance policies, encryption, update rings and unmanaged device access.
• Monitoring: unified audit log, sign-in log retention, alert policies and who actually watches them.
• Applications: enterprise app consent settings, high-privilege app registrations and OAuth grants.

Secure Score versus a real assessment

Microsoft Secure Score is a helpful checklist built into the Defender portal. It shows which recommended controls are on and estimates the effect of turning on others. It does not know your business context, which exclusions are justified, or whether a control is configured in a way that leaves gaps.

For example, Secure Score can credit you for an MFA policy that excludes a large group of users or a service account with broad rights. An assessment looks for those exceptions, checks the sign-in logs for real usage, and tells you whether the control works as intended.

How the work usually runs

Most assessments for SMB and mid-market tenants take one to three weeks of elapsed time, depending on tenant size, licensing, the number of connected systems and how quickly stakeholders are available. The scope and schedule should be agreed after a short discovery call.

• Kickoff: confirm scope, licensing, compliance drivers and read-only access.
• Evidence collection: configuration exports, policy reviews, sign-in and audit log sampling.
• Interviews: how admins work, how users share files, how vendors and partners connect.
• Analysis: map findings to risk and to frameworks the business cares about, such as NIST CSF or CIS benchmarks.
• Readout: walk through the report with IT and leadership and agree a remediation order.

What the deliverable should look like

The report should be usable by the people who will fix things. Each finding needs a plain description, the evidence, the risk if left alone, the recommended change, the license it needs, and the likely user impact.

A short executive summary should explain the top risks in business terms. A remediation roadmap should group fixes into quick wins, planned changes that need communication, and longer projects such as device management or data governance.

Common findings in SMB and mid-market tenants

The same issues show up again and again. Security defaults or Conditional Access was set up once and never revisited. Several people hold Global Administrator for convenience. A shared mailbox or service account still uses legacy protocols. Anonymous sharing links are allowed by default. DMARC exists but sits at a monitoring policy. Audit data is collected but nobody reviews alerts.

None of these require exotic tools to fix. They require a clear owner, a tested change plan and enough communication that users are not surprised.

How Accred Consulting approaches it

Accred Consulting runs security assessments as a fixed-scope engagement. Discovery confirms licensing, compliance drivers and access, then the proposal sets a clear scope, fixed price and timeline. US-based specialists review the tenant with read-only access, interview your admins and deliver a prioritized findings report with evidence, risk, fix and user impact for each item. The readout includes a remediation roadmap your team can run, or Accred can deliver it as a follow-on project, as it did for a roughly 350-user manufacturer that moved to MFA and Conditional Access in 6 weeks. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions