Entra ID security audit
Understand identity lifecycle, privileged roles and the paths that connect your people, applications and tenant.
MICROSOFT 365 / INDEPENDENT SECURITY ASSESSMENT
Microsoft 365
security audit.
Clarity. Then action.
Find the gaps between the controls you intended and the access your tenant actually allows. Get a clear, prioritised plan for identity, email, data and devices.
See a sample audit report
Build your RFP Four steps · Email at the end
Licence-aware scopeEvidence-linked findingsPractical remediation
BY ATLANT SECURITYIndependent of Microsoft
YOUR ENVIRONMENT. YOUR REQUIREMENTS.
Plan your Microsoft 365 audit.
Your licences. Your workloads. A useful scope.
See the review priorities before sharing your email.
START WITH WHAT IS PUBLIC / FREE
What does your email domain reveal?
Check public mail routing, SPF, DMARC and common Microsoft DKIM selectors. No login, email address or tenant access required.
Use the part after @ in your work email. Only DNS is queried through Cloudflare. You can skip this check and use the planner below.
How the check works and its limits
We query six public DNS names through Cloudflare’s resolver: MX, SPF, DMARC, two common Microsoft DKIM aliases and Autodiscover. We do not connect to your website or tenant, send test mail, or change settings. Results stay in this page until you choose to submit an enquiry; then we recheck the domain and include the observations for our team.
This is a starting point for discussion. It cannot establish MFA, administrator privileges, mail forwarding, data sharing or device security. It does not fully validate SPF, discover every DKIM selector, or resolve DMARC inheritance for subdomains. A lookup failure is reported as unknown.
Reference: Microsoft guidance on SPF, DKIM and DMARC. See our public-domain check privacy notice.
REQUEST RECEIVED
Your RFP is with our team.
Atlant Security has received your requirements. We’ll review the scope and contact you at .
If you attached an NDA, it is included for review. Submission does not accept its terms or authorise testing.
Preview the Microsoft 365 sample audit report ↗The guided builder needs JavaScript for its security check. Send your employee range, scope and requested outcomes to sales@ms365securityaudit.com, with your NDA/RFP if available.
01 / FOLLOW THE ACCESSIdentity → email → information → devices
Your tenant is connected.
Your audit
should be too.
A Microsoft 365 security audit examines configuration, effective access and supporting records across your agreed workloads.
We look at the people and applications behind the settings: who is included, who is excluded, who owns the exception and what evidence supports the conclusion.
Use one focused workstream or agree a broader tenant review. Your licence assignments and available records shape the scope.
Inside the serviceConditional Access review
Examine which people, applications and sign-in situations your policies actually cover.
Exchange Online security audit
Review mail flow, forwarding, authentication and effective protection for the recipients that matter.
SharePoint, OneDrive & Teams security audit
Trace external sharing and collaboration back to the information, owners and access decisions behind them.
Intune security audit
Connect device inventory, policy assignment and compliance signals to real access decisions.
Microsoft 365 Copilot security readiness
Review information access and governance before expanding how employees discover organisational knowledge.
OAuth app & consent permissions audit
Review the non-human access paths that remain outside a simple user-and-MFA checklist.
Purview audit & logging review
Establish which questions your current audit evidence can answer, for which users and over what period.
02 / A FINDING SHOULD EXPLAIN ITSELF
From a setting
to a decision.
“MFA is enabled” leaves important questions unanswered.
The report should identify the population, actual coverage, exception and business implication. Each recommendation needs an owner, a dependency check and a way to validate closure.
Explore the deliverablesILLUSTRATIVE FINDING / IDENTITY
The policy exists.
The excluded users remain.
- Observed condition
- A broad exception group bypasses the intended policy in the example tenant.
- Evidence to examine
- Policy state, group membership, owner approval and representative sign-ins.
- Action to agree
- Validate business dependencies, reduce the exception in a controlled rollout and review the resulting sign-ins.
Reporting example only. No claim about your tenant or a real client.
03 / CONTROLLED ACCESS. CLEAR OUTPUTS.
You keep control of your tenant.
- 01
Agree the boundary
Confirm tenants, licences, workloads, evidence dates, report audience and NDA requirements.
- 02
Review the evidence
Work through supervised sessions or approved read-only exports. Record what was examined and what was unavailable.
- 03
Validate the finding
Discuss business context and factual accuracy. Distinguish a missing record from an absent control.
- 04
Prioritise the change
Set owners, dependencies, rollout safeguards and closure evidence. Agree implementation or revalidation separately.
No credentials in the website form. No automatic tenant connection. No production changes implied by an enquiry.
BEYOND A SINGLE NUMBER
Secure Score is a signal.
The audit adds context.
Microsoft Secure Score tracks recommended actions. An independent review connects those actions with exclusions, business dependencies, effective access and evidence limitations.
Compare the two| A useful input | The next question |
|---|---|
| Recommended action | Which population and exceptions does it cover? |
| Configured policy | Was it enforced in the relevant scenario? |
| Available capability | Is the right licence assigned to the relevant user? |
| A closed task | What evidence demonstrates the change works? |
Secure Score does not express breach probability. Microsoft’s explanation.
KNOW WHAT YOU ALREADY OWN
Recommendations that respect your licences.
Configure what is available
Identify gaps in controls your tenant already includes. Confirm assignments, coverage and operational ownership before proposing new products.
Separate the dependencies
Conditional Access, risk-based identity protection and advanced audit features have different entitlements. Mark those dependencies clearly.
Keep unknowns visible
Mixed plans and add-ons are common. An unknown licence or missing record becomes a scoping question, not an invented finding.
SEE THE STANDARD OF EVIDENCE
A Microsoft 365 audit.
Open for inspection.
A fictional assessment of Meridian Advisory Group AG: tenant architecture, licence assumptions, evidence excerpts, eight findings and a remediation register.
Preview the sample reportEight pages visible before the form. Original illustrative report; not a claim of client work.
04 / BEFORE YOU COMMISSION AN AUDIT
The practical questions.
Do you need our Global Administrator credentials?
No credentials belong in this form. We can start with supervised sessions led by your team. Any additional read-only access or export permissions are separately agreed for the selected workloads.
How much does an audit cost?
Tenant count, workloads, hybrid identity, evidence availability and reporting requirements drive effort. We agree a written scope and price before access. Our pricing guide links Atlant’s current published starting prices.
Will the audit change our settings?
The default engagement is an assessment. Remediation implementation, active validation, phishing simulations and production changes need their own agreed scope and approvals.
Can we send an NDA or RFP first?
Yes. Attach a PDF or DOCX up to 2 MiB through the planner or contact form, or email sales@ms365securityaudit.com. A person reviews documents and signatures.
PRACTICAL GUIDANCE / PRIMARY SOURCES
Ask better questions of your tenant.
AUDIT PREPARATION4 min read
A Microsoft 365 security audit checklist that asks for evidence
Prepare a tenant review around populations, exceptions, evidence and owners, rather than a list of enabled features.
Read the perspectiveASSURANCE4 min read
Why Microsoft Secure Score is a starting point for an audit
Use Secure Score constructively without treating a percentage as evidence of tenant-wide protection.
Read the perspectiveIDENTITY4 min read
Conditional Access: audit the exclusions, not just the policy names
Review policy coverage, privileged identities, emergency access and licence dependencies in Entra ID.
Read the perspectivePREPARE WITH ATLANT SECURITY
Evidence before the first meeting.
Use the preparation checklist and find Atlant’s published Microsoft 365 auditing tools.
LET’S START A CONVERSATION
Define the scope.
Take the next step.
Your audit objectives, control boundaries and evidence period. A useful starting point for your assessment.
Discuss your requirements