Microsoft 365 Security Audit: What to Collect and Review

A Microsoft 365 security audit is an evidence-based review of how a tenant is actually configured: who has admin rights, which Conditional Access policies apply, which apps have consent, how mail flows, what is shared outside the company and what the logs show. The work is mostly collection: exports of identity, email, collaboration and device settings, the unified audit log and sign-in logs for the period in scope, and the output of baseline tools such as Maester and CISA ScubaGear. This page is the evidence list. For the settings themselves and the order to fix them, use our Microsoft 365 security best practices checklist, which this page does not repeat.

Audit here means a point-in-time review with a findings report, not a compliance certification. It is what NetSys performs at the start of a Microsoft 365 security hardening engagement, and it is also what an internal IT lead can collect before bringing anyone in. Everything below assumes authorization from the tenant owner and a defined period, usually the last 30 to 180 days depending on what each log still holds.

What should you set up before collecting anything?

1. Written authorization and scope. Which tenant, which workloads, which period, who approves changes, and whether anything may be changed during the audit at all (usually not).
2. A dedicated reviewer identity. A separate account or app registration for the audit, with read-oriented roles, MFA enforced, and a note of every permission granted so it can be removed afterward. Reviewing from the owner's own Global Administrator account mixes evidence with daily activity and leaves no clean record.
3. An evidence folder with a naming rule. Every export gets the date, the tenant, the source and the reviewer in its file name, and the folder lives somewhere with its own access control, because the exports describe exactly where the tenant is weak.
4. A log of what was collected. A simple sheet: item, source, date collected, file name, who collected it. That sheet is what makes the findings defensible later.

Which identity evidence should you collect?

Identity is where most Microsoft 365 compromises begin, so it gets the longest list. From Microsoft Entra ID, export or capture:

• The user list with sign-in status, last sign-in and license, including guests and shared or service accounts.
• Every directory role assignment, especially Global Administrator, and whether assignments are permanent or eligible through Privileged Identity Management.
• MFA registration status per user and the authentication methods policy.
• Every Conditional Access policy, including its state (on, off or report-only), assignments and exclusions. Exclusions are where the findings hide; the Conditional Access glossary entry explains the terms.
• Security defaults status, if Conditional Access is not licensed.
• Enterprise applications and app registrations with the permissions granted to each, who consented and when, plus the user consent settings.
• Named locations, break-glass accounts and their last use.
• The sign-in logs and Entra audit logs for the period available. Microsoft's Entra data retention reference says Entra ID Free keeps sign-in and audit logs for seven days and P1 and P2 keep them for 30 days, so export these on day one; risky sign-ins are kept 7, 30 or 90 days by edition.

Which email evidence should you collect?

From Exchange Online and Microsoft Defender for Office 365:

• Mail flow (transport) rules, inbound and outbound connectors, and accepted domains.
• Automatic forwarding settings at the tenant and mailbox level, and a report of inbox rules that forward or delete, the signature of a compromised mailbox.
• Anti-phishing, anti-spam, anti-malware, Safe Links and Safe Attachments policies, with the preset security policy status.
• DNS records for each sending domain: SPF, DKIM and DMARC, with the DMARC policy value.
• Shared mailboxes, their delegates and whether sign-in is blocked on them.
• Mailbox auditing status and any mailbox permissions granted to other users.

Which collaboration and device evidence should you collect?

• SharePoint and OneDrive tenant sharing settings, the default sharing link type, anonymous link expiration and the list of sites that allow external sharing. Site-level permission sprawl is a separate exercise covered in our SharePoint permissions audit checklist.
• Teams external access and guest access settings, and which apps are allowed.
• Intune enrollment and compliance status by device, the compliance policies, and whether Conditional Access requires a compliant device for anything.
• Microsoft Defender for Business or Defender for Endpoint onboarding status by device, and the tamper protection setting.
• Backup: which third-party backup covers the tenant, the last successful job and the last tested restore, because Microsoft's recycle bins are not a backup.

Which logs and tool outputs complete the picture?

Microsoft's audit solutions overview is explicit, as of October 2026, that Audit (Standard) is enabled by default and retains records for 180 days, and that keeping them longer needs Audit (Premium) or an export through the Office 365 Management Activity API into a SIEM. The Entra retention reference adds that the Entra sign-in and audit logs are separate from the unified audit log and follow Entra licensing instead. Microsoft's Secure Score documentation describes the score as "a measurement of an organization's security posture, with a higher number indicating more recommended actions taken," and states that it is not an absolute measurement of how likely a breach is; treat it as the ranked to-do list, not the grade. The two baseline tools are compared in our Maester vs ScubaGear guide.

How does the evidence become a findings list?

1. Compare each export against a named baseline: Microsoft's recommendation, the CIS Microsoft 365 Foundations Benchmark or the CISA SCuBA baselines, with the source and date recorded.
2. Write one finding per control, not per tool or per log line, and attach the evidence file name and the exact setting or event.
3. Rate each finding for risk and effort, and name the business consequence in one plain sentence.
4. Record exceptions the business chooses to keep, with the owner and a review date.
5. Have a second engineer validate findings rated high before the report goes out; a misread export is an expensive mistake.
6. Agree the remediation order and the approval for each change, then plan the rerun that will prove each fix.

What does NetSys collect and review?

A NetSys Microsoft 365 security review follows this list with a dedicated identity, an evidence log and a defined period, as the first phase of a hardening engagement or as a standalone audit. Engineers review the exports and tool reports with help from Claude, which groups results by control and drafts the first pass of each finding; every item is then verified in the tenant by an engineer before it enters the report. NetSys participates in Anthropic's Cyber Verification Program with Defense Access. You receive the findings list, the evidence index, an executive summary and a remediation plan with owners; remediation and the monthly reviews that keep the tenant from drifting are quoted after a scoping call. For an audit that goes beyond the tenant to endpoints, backups and your provider, see our IT audit checklist and the cybersecurity risk assessment.

Frequently asked questions

How far back can a Microsoft 365 security audit look?

As far as the logs go. The unified audit log holds 180 days on Audit (Standard) and up to a year for Entra, Exchange, SharePoint and OneDrive records on Audit (Premium). Entra sign-in logs hold 30 days on P1 and P2 and seven days on Free. Anything older exists only if someone exported it to storage or a SIEM, which is itself a finding if the answer is no.

What drives how long the audit takes?

The number of users and admins, how many third-party applications hold consent, how many Conditional Access policies and mail flow rules exist, the period in scope and whether the logs are still available. Collection for a small tenant is usually the shorter part once the reviewer identity exists; reading the exports against the baselines and validating the findings takes longer.

Which licenses change what there is to audit?

Conditional Access, Intune, Defender for Business and Defender for Office 365 Plan 1 come with Microsoft 365 Business Premium and not with Business Standard, so a Standard tenant has fewer controls to review and more gaps to report. Our Business Premium vs Standard comparison lists the differences.

Is Microsoft Secure Score enough on its own?

No. Secure Score ranks Microsoft's recommended actions and is useful for sequencing work, but Microsoft itself says it is not an absolute measurement of breach likelihood, and it does not produce the evidence an auditor or insurer asks for. Pair it with the exports above and a baseline tool run.

Do you need Maester or ScubaGear if you already review Secure Score?

Yes, for different reasons. Secure Score is Microsoft's view of its own recommendations. Maester and ScubaGear test the tenant against CISA and CIS baselines, produce repeatable reports you can compare run to run, and show exactly which setting failed and how to fix it.

Should the audit be done internally or by an outside firm?

Either can collect this evidence; the list is the same. An outside reviewer brings independence, which matters when the findings concern decisions the internal team made, and usually brings the tool experience to read the reports quickly. Whoever does it, the authorization, the dedicated identity and the evidence log are not optional.

NetSys engineers collect this evidence, validate every finding and hand you a remediation plan with owners. Request a Microsoft 365 security review with a NetSys engineer.