Identity and privilege
Microsoft Entra ID roles, authentication methods, lifecycle, guests, applications, consent, identity risk, and governance features where licensed.
Evidence-led review for an assurance request
Answer a Microsoft 365 security audit request with traceable evidence and clear boundaries.
Built for a defined customer, insurer, board, or internal-audit question. The review connects current Microsoft 365 evidence to supported conclusions, open questions, and prioritized action without presenting itself as an attestation or certification.
What audit means here
A defined evidence question, answered with explicit boundaries.
TenantShield starts with the assurance or oversight request, reviews the Microsoft 365 evidence needed to answer it, validates material observations with stakeholders, and records supported conclusions and gaps. The word audit does not imply a statutory audit, formal attestation, or compliance certification.
Technical scope
Cross-service control coverage, adjusted for the tenant you actually operate.
The applicable control set depends on licensing, enabled services, architecture, user populations, regulatory or contractual context, accepted exceptions, and evidence available at the time of review.
Conditional Access
Policy state, assignments, exclusions, conditions, grant and session controls, authentication strengths, device dependencies, and rollout practices.
Messaging
Exchange Online mail flow, connectors, forwarding, delegates, applications, built-in protections, public email authentication, auditing, and operations.
Collaboration
SharePoint Online, OneDrive, and Microsoft Teams sharing, external collaboration, guest access, link defaults, application dependencies, and lifecycle controls.
Endpoint and applications
Microsoft Intune administration, enrollment, policy, compliance, endpoint security, device operations, enterprise applications, service principals, and credentials where applicable.
Threat protection
Microsoft Defender XDR and workload-specific protection, alerts, incidents, investigation, response, integrations, and security-operations ownership where licensed.
Data and audit
Relevant Microsoft Purview retention, sensitivity, data loss prevention, audit availability, evidence retention, and investigation dependencies where licensed and scoped.
Security operations
Ownership, exception handling, joiner-mover-leaver processes, privileged change control, monitoring, recovery, periodic review, and evidence of operation.
Questions this audit can answer
A tenant-wide view for a real business trigger.
Where is material risk concentrated?
Prioritize identity, access, messaging, collaboration, endpoint, application, data, and operational observations by impact, exposure, confidence, and dependency.
What can leadership rely on?
Separate configured controls from operating evidence, licensed capability from unavailable features, and verified facts from assumptions requiring owner confirmation.
What should happen next?
Build a sequenced action register that accounts for business impact, implementation effort, user experience, change risk, compensating controls, and validation.
Assessment process
A controlled review from scope to decision.
Define applicability
Confirm tenant relationships, services, licensing, populations, business drivers, stakeholders, evidence sources, exclusions, and intended use of the report.
Collect and normalize
Review agreed Microsoft 365 configuration and operational evidence with read-only methods where supported and record evidence limits.
Resolve material context
Discuss high-impact observations with accountable owners, identify compensating controls, document accepted exceptions, and distinguish facts from open questions.
Prioritize and communicate
Deliver executive and technical views, a sequenced action register, named dependencies, validation steps, and a stakeholder readout.
Deliverables
One evidence trail from technical detail to leadership action.
- Executive summary of material risk, dependency, evidence confidence, and recommended priorities
- Technical findings with affected service, observation, evidence reference, business relevance, and recommendation
- Applicability, exclusions, assumptions, compensating controls, and open-question register
- Prioritized 30-, 60-, and 90-day action register with accountable owners and validation steps
- Stakeholder readout suitable for IT, security, risk, and leadership audiences
Boundaries
Clear scope protects the quality of the answer.
- Not a statutory audit, attestation, legal opinion, penetration test, or compliance certification
- Only applicable, licensed, configured, evidenced, and agreed Microsoft 365 capabilities are assessed
- Point-in-time evidence cannot guarantee future configuration or prevent every attack
- No production change or remediation implementation is included in the audit
- Third-party systems and on-premises infrastructure require explicit inclusion in scope
Frequently asked questions
Questions to resolve before the work begins.
Is a Microsoft 365 Security Audit a formal financial, statutory, or certification audit?
No. TenantShield uses audit in the practical sense of an independent configuration and control review. The engagement is not an attestation, legal opinion, statutory audit, penetration test, or compliance certification.
Which Microsoft 365 services are included?
The scope is agreed from the services, licenses, tenant architecture, business questions, and evidence available. Microsoft Entra ID, Conditional Access, Exchange Online, SharePoint Online, OneDrive, Microsoft Teams, Microsoft Intune, Microsoft Defender, Microsoft Purview, and operational controls are included only where applicable and licensed.
Does the audit make configuration changes?
No. The audit establishes evidence, observations, risk, and recommended action. Implementation is a separate engagement with explicit authorization, change safeguards, rollback planning, and validation.
Can the audit support a customer, insurer, board, or internal-audit request?
It can provide a structured, evidence-based view of Microsoft 365 configuration and control priorities for those conversations. It does not replace the specific assurance, legal, or attestation work another party may require.
How is the audit different from Microsoft Secure Score?
Microsoft Secure Score is one useful posture signal. The audit also considers applicability, evidence quality, business dependencies, privilege, policy interaction, exceptions, operational ownership, change risk, and controls that are not represented by a single score.
Related services and evidence
Continue with the level of review that fits the question.
Specialist services
Choose a deeper product-specific review when the risk or decision is already concentrated in one Microsoft 365 service.
Assessment methodology
See how applicability, evidence, validation, prioritization, and reporting are handled.
Free security checker
Run a directional browser-based review before deciding whether a professional audit is the right next step.
Start with the decision your team needs to make.
Share the business trigger, relevant Microsoft 365 licensing, approximate environment size, and decision deadline. No credentials or tenant exports are needed for the first conversation.