Microsoft 365 security audit
Our Microsoft 365 security audit is a read-only review of your tenant. It ends in a written report: what's fine, what's at risk and what to fix first. It costs £395 fixed for up to 25 users, excluding VAT, credited in full if you move to Managed or Secure within 30 days. We change nothing while we look.
£395fixed, up to 25 users, excluding VAT. Credited in full if you move to Managed or Secure within 30 days.
About three minutes. We reply within 2 business hours, Monday to Friday.
- Read-only access through Microsoft's Global Reader role. We change nothing, and you remove our access when the report lands.
- A fixed price, excluding VAT, credited in full against Managed or Secure within 30 days
- A written report: what's fine, what's at risk and what to fix first
What we check
Eight areas of your tenant, read-only. The settings behind each one, and what they mean for your business.
- Sign-in and MFAWhich accounts use MFA, and whether older sign-in methods leave gaps. Since April 2026, missing MFA on a cloud service that offers it is an automatic Cyber Essentials fail, IASME says.
- Admin rolesWho holds admin rights, and whether they still need them.
- Conditional accessRules for where, how and from which devices people can sign in.
- External sharingWhat SharePoint, OneDrive and Teams share outside the business.
- Email securitySPF, DKIM and DMARC, and protection against phishing.
- DevicesWhich laptops and phones are managed, encrypted and up to date.
- Audit logging and retentionWhether activity is logged and data is kept as your obligations require.
- Licence wasteSeats paid for that nobody uses, and plans that don't fit the person.
One thing we look for: spare licences
An illustration of the licence check in the report. The figures are example data; your numbers will be different.
Our guide shows how to find unused Microsoft 365 licences yourself.
Licence check
Example data| Licence | Paid | In use |
|---|---|---|
| Business Premium | 24 | 21 |
| Business Standard | 12 | 12 |
| Exchange Online (Plan 1) | 8 | 3 |
| Copilot add-on | 6 | 2 |
12 seats paid for that nobody uses
An illustration of one thing the audit looks for. Your numbers will be different.
What you get
A written report: what's fine, what's at risk and what to fix first, in plain English and in priority order.
Where they apply, findings are mapped to Cyber Essentials and ISO 27001 controls, so you know what to fix before you apply. The report does not certify your business.
Fix it yourselves using the report, or ask us to. If you move to Managed or Secure within 30 days, the £395 is credited in full.
Planning Copilot? See the fractional Head of AI, whose Copilot readiness check starts from the same sharing and permissions findings.
The access we need
Read-only admin access, through Microsoft's Global Reader role. Microsoft describes it as a role that can read everything a Global Administrator can, but not update anything.
We change nothing while we look. You set up the access with us after you agree the quote, never through the form or by email. You can remove it as soon as the report is delivered.
Your IT company set things up? The audit is an independent check, not a judgement on them. The form asks who can approve the access.
Secure Score is not an audit
Microsoft Secure Score is a measurement of your security posture, where a higher number means more recommended actions taken. It is useful, and it comes with your tenant.
What it doesn't do: explain in plain English what each finding means for your business. It doesn't rank the fixes by the risk they remove, or spot licences you pay for and don't use. The report does.
Want to work through the settings yourself first? Our Microsoft 365 security checklist covers the ten that matter most. Our guides also explain the end of SMS and voice MFA and the password reset change.
What it costs
One fixed price for up to 25 users. Larger tenants are quoted. The fee is credited in full if you move to Managed or Secure within 30 days.
| Service | Price, excluding VAT |
|---|---|
| Microsoft 365 security audit | £395fixed, up to 25 users |
Fixed price for up to 25 users; larger tenants quoted. Credited in full if you move to Managed or Secure within 30 days.
The Secure support plan includes the audit every year. Managed and Secure keep MFA, conditional access where your plan allows, SPF, DKIM and DMARC in place. See IT support. Need the certificate afterwards? See Cyber Essentials.
About three minutes. We reply within 2 business hours, Monday to Friday.
Common questions
How much does a Microsoft 365 security audit cost?
Ours is £395 fixed for up to 25 users, excluding VAT, and larger tenants are quoted. The fee is credited in full if you move to Managed or Secure within 30 days. The Secure plan includes the audit every year.
What access do you need?
Read-only admin access, such as Microsoft's Global Reader role, which can read everything a Global Administrator can but change nothing. You can remove our access as soon as the report is delivered.
What does the audit check?
It covers sign-in and MFA, admin roles, conditional access and external sharing. It also checks email security (SPF, DKIM and DMARC), devices, audit logging and retention, and licences you pay for but don't use.
Is this the same as Microsoft Secure Score?
No. Secure Score is Microsoft's measurement of your security posture, where a higher number means more recommended actions taken. Our audit reads the settings behind it and gives you a written list of fixes in priority order, in plain English.
Will the audit get us Cyber Essentials?
No. The report does not certify your business. Where they apply, findings are mapped to Cyber Essentials and ISO 27001 controls, so you know what to fix before you apply.
Do you fix what you find?
You can fix it yourselves using the report, or ask us to. If you move to Managed or Secure within 30 days, the £395 is credited in full.
Guides that go deeper
Plain-English guides on the rules, the costs and the settings behind this service.
Microsoft 365 Security Checklist for Small Businesses (2026)
The 10 Microsoft 365 settings that matter most for a small business: MFA, admin roles, sharing, email security and backup, with where to check each.
Read the guide
How to Find Unused Microsoft 365 Licences You Are Paying For
Compare bought and assigned licences, find leavers and idle users, then cut spare seats. A step-by-step Microsoft 365 admin center guide for UK firms.
Read the guide
Microsoft 365 SMS and Voice MFA Is Ending: What to Do Now
Microsoft is retiring its own text and voice MFA codes for most users on 1 February 2027. Find who relies on them, choose a fix and move staff in time.
Read the guideWant an independent look at your Microsoft 365?
Tell us your user count and who can approve read-only access. We reply within 2 business hours, then send a written quote, and we change nothing while we look.
About three minutes. We reply within 2 business hours, Monday to Friday. Or email support@cloud365.io.