Cyber Security Services- Securing Fortune 100 companies since 2014
Penetration Testing

Microsoft 365 Security Assessment

Microsoft 365 holds most organizations’ email, files and identities, and a few default or legacy settings are behind many account takeovers and data leaks. Our Microsoft 365 security assessment reviews your tenant against the CIS Microsoft 365 Foundations Benchmark and Microsoft’s own recommendations, and gives you a prioritized list of changes. It is one of our risk assessments.

What we review

Identity and access (Entra ID)
  • MFA coverage and phishing-resistant methods for administrators
  • Conditional access policies and legacy authentication
  • Global administrator count, privileged roles and break-glass accounts
  • Guest users, external collaboration and stale accounts
  • SPF, DKIM and DMARC
  • Anti-phishing, safe links and safe attachments policies
  • Mailbox forwarding rules and auditing that reveal compromised accounts
  • SharePoint, OneDrive and Teams external sharing settings
  • Data loss prevention and sensitivity labels where licensed
  • Third-party and AI apps with consent to your tenant’s data

We confirm that audit logging is enabled and retained, that alerts for risky sign-ins and admin changes reach someone, and how your Microsoft Secure Score compares with what your licenses make possible.

How Our Microsoft 365 Security Assessment Works

Scoping & Access

We agree on the tenant and services in scope and use a read-only reviewer account, so the assessment makes no changes to your environment.

Penetration testing scoping and rules of engagement

Configuration Review

We review identity, email, sharing, device and logging settings against the CIS Microsoft 365 Foundations Benchmark.

Penetration testing reconnaissance phase

Risk Analysis

We look for signs of past compromise, such as suspicious forwarding rules, and prioritize findings by real-world attack likelihood.

Penetration testing exploitation phase

Report & Roadmap

You receive a report with each finding, why it matters, its priority and the exact setting to change, plus quick wins your team can apply right away.

Penetration test reporting icon

Remediation Support

We help your team or MSP plan and apply changes safely, especially conditional access, and verify the results.

Penetration Testing

Lock Down Microsoft 365

Schedule a call to review your Microsoft 365 tenant and get a prioritized list of fixes.

Get a Quote

Tell us what you need and a senior consultant will reply within one business day with next steps or a quote. Prefer to talk? Book a call.

Frequently Asked Questions

What access do you need for a Microsoft 365 security assessment?

A read-only account with the Global Reader and Security Reader roles is usually enough. The assessment does not change any settings.

The CIS Microsoft 365 Foundations Benchmark, along with Microsoft's own security recommendations and Secure Score, adjusted to the licenses you have.

Yes. An independent review gives you and your MSP a clear, prioritized list of improvements, and we can work directly with your MSP on the changes.

No. This is a configuration review. If you also want to test what an attacker could do in your tenant, see our cloud penetration testing.

Pricing depends on the size of your tenant and the services in scope. We provide a fixed quote after a free scoping call.

Reviewed by Matt Santill, CISSP, founder of Cyber Security Services and an original contributor to the NIST Cybersecurity Framework. Last updated .