Français
Nederlands
DeutschMicrosoft 365 security audit
Email, Teams, SharePoint and OneDrive hold most of an SME's data, and many frauds start with a compromised Microsoft 365 account. We review your environment's configuration against recognised baselines, with read-only access, and give you fixes ranked by priority.
Who it is for, and when
- SMEs using Microsoft 365 without a dedicated security team.
- After a fraud attempt, a fake-IBAN invoice or a hacked mailbox.
- Before a NIS2, CyFun or ISO 27001 audit, or to answer an insurer's questionnaire.
- After a migration, a merger or a change of IT provider.
What we check
Identities and access
Multi-factor authentication for every account, legacy authentication blocked, conditional access, number and protection of administrator accounts.
Email
Protection against phishing and spoofing, SPF, DKIM and DMARC, automatic forwarding to external addresses.
Logging
Audit log enabled, retention of sign-ins and activities, alerts: what you will need on the day of an investigation.
Sharing and collaboration
Anonymous links, external sharing in SharePoint and OneDrive, guest access in Teams.
Applications and consent
Third-party applications allowed to read your emails or files, and user consent settings.
Retention and backup
What is kept, for how long, and what could not be recovered after a deletion or a ransomware attack.
How it works
The audit relies on public baselines: the CIS Microsoft 365 Foundations Benchmark, the SCuBA baselines of the US agency CISA and Microsoft Secure Score. Every gap is verified and interpreted in your context, not simply copied from a tool.
Scoping
Tenant, licences and services in use. You grant read-only access (Global Reader role, supplemented if needed by a Microsoft Purview read-only role): we change nothing.
Collection
Configuration extracted with recognised tools, complemented by a manual review of the points those tools cover poorly.
Analysis
Comparison with the baselines, then prioritisation according to the real risk, your licences and the effort required.
Report and walkthrough
Gaps ranked by priority, step-by-step fixes and a summary for management. On request, we support the remediation with your provider.
Frequently asked questions
Do you need an administrator account?
No. Read-only roles are enough: they let us read the configuration, not change it. You assign and remove them yourself.
How long does the audit take?
It depends on the size of the tenant and the services in use. The timeframe is set in the written proposal before we start.
Why do logs matter so much?
Without an Entra ID P1 or P2 licence, Entra ID sign-in logs can only be viewed for 7 days, whereas fraud is often discovered weeks later. The audit checks what is kept and how to export it in time.
Is the audit useful for NIS2 or CyFun?
Yes. Multi-factor authentication, access management, logging and email protection are among the expected measures. The report provides dated findings you can show to an auditor.
Do you fix the gaps?
The report gives step-by-step fixes for your provider or your team. If you wish, we support their implementation and then check that they are effective.