A Microsoft 365 security assessment reviews how your business protects accounts, email, devices and information. It should identify configuration gaps, test whether important controls apply to the right people, and deliver a prioritised remediation plan. A dashboard score alone cannot tell you whether the environment is secure.
For a Sydney business with 20–200 staff, the useful question is straightforward: could someone access a mailbox, approve a fraudulent payment or reach confidential client information because a control was missed? This guide explains what to ask an assessor, what a report should contain and how to turn the findings into practical improvements.
Why review Microsoft 365 security now?
Your environment changes every time a person joins, a supplier receives access, an application is connected or a team shares a document. Settings that suited the business two years ago may no longer match its structure. Buying a stronger licence does not prove that its protections have been deployed.
Planning for 2027, renewing cyber insurance, changing IT providers or preparing a Copilot rollout are useful triggers for a review. The assessment should examine your actual environment and business processes, rather than rely on a generic questionnaire. Finance teams, professional services firms and businesses holding client records should give particular attention to mailbox access and information sharing.
What should a Microsoft 365 security assessment include?
Agree the scope before anyone starts. A tenant is your organisation’s Microsoft 365 environment. A review of one tenant may still exclude endpoints, on-premises systems, third-party applications or backup arrangements. Those exclusions need to be visible in the proposal and final report.
1. Identity, MFA and administrator access
Review active and inactive accounts, administrator roles, authentication methods and the way access is removed when someone leaves. Ask whether multifactor authentication is enforced for the intended users and applications, rather than simply registered on their accounts.
Privileged access deserves its own review. Identify who can change security settings, why they need that access and how emergency access is protected and monitored. An assessor should document exclusions and dependencies before recommending a change that might lock out administrators or interrupt an essential application.
2. Conditional Access and device controls
Check which access policies are enabled, who they cover and whether exceptions have an owner. Review how managed and unmanaged devices are treated, together with device enrolment, patching, encryption and endpoint protection where included in scope.
Microsoft confirms that Business Premium includes access to Conditional Access capabilities. Availability still depends on the particular feature and licence: ask the assessor to verify current entitlements before proposing controls. A policy existing in the portal is not evidence that it applies to every intended sign-in.
3. Email protection and payment-fraud exposure
The review should examine email protection settings, forwarding rules, mailbox permissions and the treatment of suspicious messages. Domain authentication settings such as SPF, DKIM and DMARC should be reviewed with care for legitimate third-party senders.
Connect the technical findings to business processes. If a criminal impersonates your director or a supplier changes bank details, who verifies the request through a trusted channel? Email filtering supports that process; it does not replace independent payment verification.
4. SharePoint, OneDrive and external sharing
Ask how the assessor will identify broad access, anonymous links, stale guest accounts and sites without accountable owners. For a larger environment, confirm whether the work examines every site or a documented sample. A sample can be useful, but the report must explain what it cannot establish.
Classify information by business consequence. Payroll, legal matters and client financial records need different handling from a public brochure. Review sensitivity labels and data-loss prevention where licensed and relevant, including whether staff understand how to use them.
5. Connected applications and consent
Inventory applications that have been granted access to organisational data. Review their permissions, owners and business purpose. An abandoned application can remain connected after the person who introduced it has left.
Removing access without checking dependencies can also disrupt operations. The report should distinguish an application requiring urgent investigation from one requiring an owner’s approval and a planned change.
6. Logging, detection and recovery
Confirm which events are logged, how long relevant records are available under your configuration and licences, and who receives and investigates alerts. Ask what happens outside normal support hours. A notification sent to an unattended mailbox is not a complete response process.
Review recovery separately: which workloads are protected, what deletion or incident scenarios are covered, and when recovery was last tested. Record the agreed recovery requirements and any gaps. Do not assume that retention, version history and a separate backup service provide identical outcomes.
Is Microsoft Secure Score enough?
No. Secure Score is a useful source of recommendations, but it does not replace an assessment of business risk, coverage and exceptions. Microsoft states that it is not an absolute measure of the likelihood of a breach and does not guarantee protection.
Use the score to support investigation and track relevant improvements. Ask why a recommendation matters, whether another control addresses the risk and what evidence supports the assessor’s conclusion. Chasing points without considering operational impact can produce a better-looking dashboard without resolving your most important exposure.
Source: Microsoft Secure Score documentation.
How does Copilot change the assessment?
Copilot makes information access a timely discussion for businesses adopting AI. Microsoft explains that Copilot operates within existing permissions. That means an assessment should examine whether those permissions are appropriate before a broader rollout.
A permissions review should look for information that staff can already access unnecessarily. Agree which sites and sensitive information are checked, who approves access changes and how legitimate collaboration will continue. Agents and connected applications also need a defined review scope; they should not be assumed to be covered by a standard mailbox assessment.
Source: Microsoft’s Copilot security guidance. For the wider rollout process, use our Copilot readiness checklist.
What should you receive in the final report?
A useful report explains the business consequence of each material finding and the evidence behind it. It should separate observed problems from assumptions, recommendations and areas that could not be checked.
| Deliverable | What to ask for |
|---|---|
| Executive summary | Key exposures, business consequences and decisions requiring management approval. |
| Scope and evidence | Systems reviewed, dates, sampling, exclusions, access limitations and supporting observations. |
| Prioritised findings | Severity with reasoning, affected accounts or services, and recommended corrective actions. |
| Remediation plan | Named owners, dependencies, effort estimates, licence implications and change requirements. |
| Verification | How completed changes will be checked and which residual risks remain. |
For example, a finding that several administrators are excluded from an access policy needs more than an instruction to remove them. The assessor should establish why the exclusions exist, check emergency access arrangements and propose a safe implementation sequence. This is an illustrative scenario, not a reported Stanfield IT client result.
How much does a Microsoft 365 security assessment cost?
There is no useful universal price without a defined scope. Tenant complexity, the number of workloads and devices, hybrid identity, application integrations, evidence requirements and the depth of reporting all affect effort. A small configuration review and a detailed assessment with workshops and remediation validation are different pieces of work.
Ask for a written scope and fixed deliverables. Confirm whether the fee includes a findings workshop, implementation, licence changes and retesting. Separate the assessment fee from project work and any ongoing monitoring subscription so you can compare proposals fairly.
A free automated report can help start a conversation. Before relying on it, establish whether a qualified person reviews the output, checks exceptions and accepts responsibility for the recommendations. The value is in accurate findings and an achievable plan, rather than the length of the report.
How should you choose an assessment provider?
Choose a provider who can explain Microsoft 365 controls in the context of your business. Ask for an anonymised report example, the proposed assessment method and a clear description of access requirements. Use time-limited, least-privilege access where practical, with approval and removal arrangements agreed in advance.
Also ask how the provider handles findings about its own previous work. An existing MSP may have valuable operational knowledge; an independent assessor can provide another perspective. In either arrangement, evidence, transparent limitations and ownership of corrective actions matter.
For businesses with an internal IT team, agree who will validate findings and implement changes. For outsourced IT, establish how the assessor and incumbent provider will cooperate. Avoid a report that sits between suppliers while neither owns the next step.
Turn findings into a practical improvement plan
Deal with confirmed urgent exposures through your agreed security process. Schedule other improvements according to business impact, dependencies and change risk. A sensible plan may include quick configuration corrections, a separate device-management project and longer-term information governance work.
Recheck completed changes against the original finding. Record who approved any remaining risk and when it will be reviewed. Repeat the assessment after significant changes or at an interval suited to your risks; a one-off review cannot establish that an environment will stay secure.
Microsoft 365 security assessment FAQs
Is this the same as a penetration test?
No. A configuration and control review examines how the environment is set up and operated. A penetration test uses separately authorised testing to investigate exploitable weaknesses within an agreed scope. Ask which activities your proposal includes.
Does Business Premium mean our environment is secure?
No licence establishes that on its own. Review which capabilities you have, whether they are configured appropriately, which users and devices are covered, and who monitors the resulting alerts. Microsoft’s business security overview describes available protections.
Will an assessment disrupt staff?
A review can often focus on configuration and evidence collection, but access, testing and interviews still need coordination. Changes to access policies, email settings or sharing permissions should be separately approved and scheduled with appropriate safeguards.
Does the report certify Essential Eight or ISO 27001 compliance?
A Microsoft 365 review alone does not establish organisation-wide compliance or certification. If you need evidence against a particular framework, specify the requirements and assessment boundaries in the proposal.
Can we keep our current IT provider?
Yes. A review can support an existing IT team or MSP. Agree access, responsibilities and the remediation handover before starting, so the work leads to action.
Need a clear picture of your Microsoft 365 risks?
Stanfield IT supports businesses across Sydney and the Northern Beaches from Frenchs Forest. Our Microsoft 365 consulting and support can help connect configuration improvements with day-to-day operations.
Talk to Stanfield IT about a Microsoft 365 security assessment. Tell us your approximate staff count, current licences, IT support arrangement and what prompted the review. We can discuss an appropriate scope and the next steps. Call 02 9191 0333.
Technical sources checked 2 November 2026.
