How to Audit Microsoft 365 Security Properly

A compromised Microsoft 365 account can give an attacker far more than access to email. It can expose financial information, client records, internal files and executive conversations, often without triggering an obvious disruption. Knowing how to audit Microsoft 365 security helps your organisation find those weaknesses before they become an incident.

For mid-sized businesses, the challenge is not simply turning on every available security setting. Microsoft 365 contains a wide range of controls, and the right configuration depends on your staff, data, devices, compliance obligations and appetite for risk. A useful audit focuses on the controls that protect the business while keeping people productive.

Start with the business risks, not the settings

Before reviewing technical controls, identify what Microsoft 365 supports in your organisation. For most businesses, that includes email in Exchange Online, files in SharePoint and OneDrive, collaboration in Teams, and identities managed through Microsoft Entra ID.

Consider the consequences if each area were misused or unavailable. A finance team may be particularly exposed to invoice fraud and payment diversion. A school may need stronger protections around student and staff information. A professional services firm may hold sensitive client documents that should never be shared outside the organisation.

This context helps prioritise the audit. There is little value in producing a long checklist of minor configuration issues while an administrator account has no multi-factor authentication or former employees still have active access.

How to audit Microsoft 365 security by priority

A practical Microsoft 365 security audit should examine identity, access, data sharing, devices, email protection, monitoring and recovery. Work from the highest-impact risks down, documenting what is configured, what is missing and who owns the remediation.

Review identities and privileged access

Identity is the front door to Microsoft 365. Start by reviewing all user accounts, paying close attention to accounts with elevated permissions. Global Administrator rights should be tightly limited and assigned only to people who genuinely need them to manage the environment.

Look for dormant accounts, shared logins, duplicate identities and accounts belonging to former staff, contractors or suppliers. Each should be disabled, removed or reviewed promptly. Shared accounts make accountability difficult, so named user accounts are usually the safer option.

Multi-factor authentication should be enabled for all users, with stronger controls for administrators. The audit should also review Conditional Access policies, which can require additional verification when a sign-in is risky, comes from an unfamiliar location or uses an unmanaged device.

There is a balance to strike. Restricting access too aggressively can frustrate travelling staff or disrupt legitimate work. The objective is to apply proportionate controls, supported by a clear process for staff who need an exception.

Check email security and impersonation risks

Email remains one of the most common entry points for cybercrime. Review Microsoft Defender for Office 365 settings, including anti-phishing, anti-spam and malware protection. Confirm that suspicious attachments and links are being scanned and that the organisation has suitable policies for quarantining messages.

Pay particular attention to impersonation protection. Attackers frequently pose as directors, finance personnel or trusted suppliers to request urgent payments or sensitive information. Your audit should test whether protection policies cover key executives, finance addresses and important external domains.

Also review mail forwarding rules. Automatic forwarding to external addresses can be legitimate in limited cases, but it is often abused after an account compromise. Where possible, block external forwarding by default and investigate any approved exceptions.

Examine file sharing and guest access

SharePoint, OneDrive and Teams make collaboration easier, but broad sharing settings can expose data without anyone noticing. Review whether users can share files anonymously, invite guests without approval or create external sharing links that do not expire.

Your policies should reflect the sensitivity of the information being shared. A marketing document may reasonably be available to an external agency, while payroll records and commercial contracts need much tighter access. Confirm that teams and sites containing sensitive information are appropriately restricted.

Guest accounts deserve separate attention. Review who has external access, what they can access and whether their access is still required. Set guest access reviews on a regular schedule, particularly for project-based work and supplier relationships.

Assess device management and endpoint protection

Microsoft 365 security is not limited to cloud settings. A staff member accessing company email from an unpatched personal device presents a different risk from someone using a managed, encrypted company laptop.

Review the devices connected to Microsoft 365 and establish whether they meet your minimum security standard. This typically includes supported operating systems, screen locks, disk encryption, security updates and endpoint protection. Mobile devices should have appropriate controls for company data, particularly where staff use their own phones.

For organisations using Microsoft Intune, check compliance policies and Conditional Access rules together. A compliance policy has limited value if non-compliant devices can still access sensitive files and email without restriction.

Review data protection and retention

An audit should identify where sensitive data sits and how it is protected. Microsoft Purview capabilities can help classify information, apply sensitivity labels and prevent accidental sharing of confidential content. The exact approach depends on your licensing and regulatory requirements, but the principle is consistent: not all data should be treated the same way.

Check whether retention policies align with operational and legal needs. Deleting records too soon can create compliance issues, while retaining everything indefinitely increases the volume of information exposed in a breach. Finance, HR and client records may each require different retention periods.

Data loss prevention policies can provide another layer of protection by detecting information such as bank details, tax file numbers or personal data before it is sent outside the business. These policies need careful testing. Overly sensitive rules can generate false alerts and lead staff to work around the system.

Test visibility, alerts and response readiness

A security control that no one monitors is unlikely to deliver its intended value. Review audit logging, sign-in logs and security alerts to ensure the organisation can identify unusual activity, investigate it and respond quickly.

Key alerts should cover suspicious sign-ins, unexpected administrator changes, mass file downloads, risky inbox rules and changes to multi-factor authentication methods. Confirm who receives these alerts and what happens after one is raised. A generic mailbox that no one checks is not an incident response plan.

It is also worth running a controlled test. For example, check whether an unusual sign-in event is visible, whether the right person is notified and whether they know how to contain the account. This reveals the gap between having a policy on paper and being ready to act under pressure.

Confirm backup and recovery arrangements

Microsoft provides platform resilience, but that is not the same as a complete backup strategy for your organisation. Accidental deletion, malicious activity, misconfigured retention and compromised accounts can all affect access to critical data.

Review what Microsoft 365 data is backed up, how long backups are retained, who can restore them and how often restoration is tested. Ensure backup access is itself protected with strong authentication and limited administrator privileges. A backup that cannot be restored quickly when needed does not reduce business risk.

Turn findings into a realistic remediation plan

The final audit report should not be a technical wish list. It should rank findings by business impact, likelihood and effort to fix. Critical items such as missing multi-factor authentication, excessive administrator access or open external sharing should be addressed first.

For each finding, assign an owner, target date and clear outcome. Some changes can be completed quickly, while others may require a staged rollout, staff communication or licensing changes. Keep a record of accepted risks where immediate remediation is not practical, and review those decisions regularly.

Many organisations benefit from an independent perspective, particularly where internal teams are already managing day-to-day support. Invotec can help translate Microsoft 365 security findings into a practical roadmap that strengthens protection without creating unnecessary disruption.

A Microsoft 365 audit is most valuable when it becomes a regular management discipline rather than a one-off response to a scare. As staff, devices, suppliers and business priorities change, reviewing your controls gives you the confidence that your everyday tools are still working in your organisation’s best interests.