Microsoft 365 Security Audit Guide for 2026: Steps, Checklist & Best Practices

A Microsoft 365 security audit in 2026 is more than a Secure Score review. It validates identity controls in Microsoft Entra ID, email and collaboration protection in Microsoft Defender, endpoint posture in Intune, data governance in Microsoft Purview, audit logging, Copilot readiness, and licensing alignment. This guide gives the nine steps, the thresholds we audit against, how to read Secure Score, and which fixes come first.

What Is a Microsoft 365 Security Audit?

A Microsoft 365 security audit is a structured review of your tenant configuration, identities, devices, data controls, applications, and monitoring capabilities. The goal is to identify misconfigurations, excessive access, unmanaged devices, weak authentication, data exposure, and gaps in threat detection.

In 2026, a complete audit covers these Microsoft security areas:

• Microsoft Entra ID for identity, access, Conditional Access, MFA, guest access, PIM, and risky sign-ins.
• Microsoft Defender XDR and Microsoft Defender for Office 365 for email, collaboration, endpoint, and incident protection.
• Microsoft Intune for device compliance, configuration, app protection, endpoint privilege, and BYOD controls.
• Microsoft Purview for sensitivity labels, DLP, retention, eDiscovery, audit, insider risk, and Compliance Manager.
• Microsoft Secure Score for security posture tracking and prioritized improvement actions.
• Microsoft 365 admin center for tenant settings, licensing, roles, domains, and service health.

Why Microsoft 365 Security Audits Matter in 2026

Microsoft 365 environments change constantly. New users, guests, Teams, SharePoint sites, OAuth applications, devices, mailbox rules, Copilot adoption, and license changes can all introduce risk. A periodic audit finds and fixes these issues before they become incidents.

A strong audit helps you:

• Reduce account takeover risk by improving identity and authentication controls.
• Detect excessive admin privileges and stale privileged accounts.
• Harden email against phishing, impersonation, spoofing, malware, and malicious links.
• Reduce SharePoint, OneDrive, and Teams oversharing.
• Prepare data controls for Microsoft 365 Copilot and AI-powered search experiences.
• Improve Microsoft Secure Score with business-appropriate actions.
• Align controls with frameworks such as GDPR, HIPAA, ISO 27001, NIST, and internal governance requirements.
• Confirm that licensing under Microsoft NCE and add-on subscriptions matches your security requirements.

2026 Microsoft 365 Security Audit Framework

Use a framework instead of a one-time checklist. A practical Microsoft 365 audit reviews eight domains:

1. Identity and access: Entra ID, MFA, Conditional Access, privileged access, guests, access reviews, and risky sign-ins.
2. Devices and endpoints: Intune compliance, configuration baselines, Defender for Endpoint integration, local admin rights, and unmanaged device access.
3. Email and collaboration: Defender for Office 365, Exchange Online Protection, SharePoint, OneDrive, Teams, external sharing, and mailbox rules.
4. Data protection: Microsoft Purview sensitivity labels, DLP, retention, eDiscovery, audit, and Copilot data exposure readiness.
5. Applications and OAuth: enterprise apps, app registrations, service principals, consent policies, and SaaS governance.
6. Threat detection and response: Defender XDR incidents, alert tuning, audit logs, Sentinel integration, and response workflows.
7. Compliance and governance: Compliance Manager, records management, lifecycle policies, insider risk, and policy ownership.
8. Licensing and cost alignment: Business Premium, Microsoft 365 E3/E5, Entra ID P1/P2, Defender, Intune, Purview, and NCE subscription fit.

Step 1: Establish Your Security Baseline

Start by documenting the current state of the tenant. Do not change controls blindly until you understand business impact, licensing, and dependencies.

Baseline checks:

• Review Microsoft Secure Score and identify high-impact recommendations.
• Confirm whether security defaults are enabled or whether Conditional Access policies are used instead.
• Inventory global admins, privileged roles, emergency access accounts, and delegated partner access.
• Review tenant-wide settings in the Microsoft 365 admin center, Entra admin center, Defender portal, Purview portal, and Intune admin center.
• Export key policy settings for Conditional Access, MFA, Defender for Office 365, sharing, DLP, retention, and device compliance.
• Verify audit logging, alerting, and log retention requirements.

The output is a baseline report that separates urgent security gaps from optimization items.

How to Read Microsoft Secure Score

Secure Score lives in the Microsoft Defender portal at security.microsoft.com/securescore. It evaluates configuration signals across Microsoft 365 identities, devices, apps and data and lists improvement actions, each with a point value, implementation guidance, the users or devices affected, and a status you set: to address, planned, risk accepted, resolved through third party, or completed. It is separate from the secure score in Microsoft Defender for Cloud, which scores Azure subscriptions and cloud workloads, so a tenant can have both numbers.

Read it with three rules. The highest point value is not the first action: identity actions with manageable user impact come first even when a Purview action scores more. A recommendation that needs a license you do not hold is a licensing decision, not a configuration task; mark it and move on. Document every accepted risk with the reason and a review date, because the risk accepted status is where tenants quietly decay. Use the history view to show leadership the direction and to catch drift after a change, and review the score monthly. Our improve Secure Score without chasing points article works an example; the pass criteria below are what the audit actually scores against.

Step 2: Audit Identity and Access in Microsoft Entra ID

Identity is the most important control plane in Microsoft 365. If attackers compromise identities, they can reach email, files, Teams, applications, and admin portals.

Review these identity controls:

• Multifactor authentication: require MFA for all users, with stronger requirements for admins and sensitive roles.
• Phishing-resistant authentication: evaluate passkeys, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, or authentication strengths where appropriate.
• MFA configuration: confirm number matching, remove weak or unused methods, and use Temporary Access Pass for secure onboarding and recovery.
• Conditional Access: enforce risk-based, location-aware, device-aware, and app-aware access policies.
• Legacy authentication: block legacy protocols that bypass modern MFA protections.
• Privileged Identity Management: use Microsoft Entra PIM for just-in-time admin activation where licensing supports it.
• Admin roles: remove standing Global Administrator access when narrower roles are sufficient; Microsoft Learn recommends fewer than five Global Administrators.
• Break-glass accounts: maintain two or more cloud-only emergency access accounts, exclude them from Conditional Access policies that block sign-in, and alert on every use.
• Risky users and sign-ins: review Entra ID Protection findings and remediation workflows.
• Guest and external users: review B2B collaboration, guest access, stale guests, cross-tenant access settings, and access reviews.
• Entitlement management: use access packages and approval workflows for repeatable access governance when available.

Microsoft now enforces part of this itself: per Microsoft Learn (3 April 2026), MFA has been required for the Azure portal and the Entra, Intune and Microsoft 365 admin centers since late 2024 and early 2025, and for Azure CLI, PowerShell and API changes since 1 October 2025. Critical identity fixes are the first remediation priority.

Step 3: Audit Email Security and Collaboration Protection

Email remains one of the most common entry points for phishing, malware, business email compromise, and credential theft. Review both Exchange Online Protection and Microsoft Defender for Office 365 settings.

Email and collaboration checks:

• Confirm SPF, DKIM, and DMARC are configured correctly for accepted domains.
• Review Defender for Office 365 preset security policies and determine whether Standard or Strict presets fit the organization.
• Validate anti-phishing, impersonation protection, spoof intelligence, anti-spam, anti-malware, and zero-hour auto purge settings.
• Review Safe Links and Safe Attachments policies where licensed.
• Review quarantine policies and user notification settings.
• Identify risky mailbox forwarding, inbox rules, transport rules, and connectors.
• Review allow/block lists and remove unnecessary permanent allows.
• Review attack simulation training availability and results where Defender for Office 365 Plan 2 or Microsoft 365 E5 capabilities are licensed.
• Review Teams, SharePoint, and OneDrive external collaboration settings together, not in isolation.

Licensing matters here: Defender for Office 365 Plan 1 and Plan 2 provide different capabilities, and Microsoft 365 Business Premium, E3, E5, and add-on plans should be mapped against required protections.

Step 4: Audit SharePoint, OneDrive, Teams, and Copilot Data Exposure

Modern Microsoft 365 security audits must include collaboration and oversharing risk. This is especially important before enabling or expanding Microsoft 365 Copilot, because Copilot respects existing permissions and can surface content users already have access to.

Review these controls:

• External sharing settings for SharePoint and OneDrive.
• Anonymous or anyone links, default link types, link expiration, and download restrictions.
• Site owners, Teams owners, guest members, private channels, and shared channels.
• Sensitivity labels for files, emails, groups, Teams, and SharePoint sites.
• Data Loss Prevention policies for Exchange, SharePoint, OneDrive, Teams, endpoints, and supported apps.
• Overshared sites, stale Teams, orphaned groups, and public access exposure.
• Restricted SharePoint search or site access controls where appropriate for Copilot readiness.
• Microsoft Purview Data Security Posture Management capabilities if available in the tenant.

The goal is not to block collaboration. The goal is to make sharing intentional, governed, and visible.

Step 5: Audit Microsoft Purview Compliance and Data Governance

The former Microsoft 365 Compliance Center capabilities are now positioned under Microsoft Purview. A 2026 audit uses the Microsoft Purview portal to review data protection, compliance, retention, and investigation controls.

Purview checks:

• Compliance Manager improvement actions and assessment templates.
• Sensitivity labels and label publishing policies.
• Data Loss Prevention policies and false-positive handling.
• Retention labels, retention policies, records management, and data lifecycle management.
• eDiscovery configuration and role assignments.
• Purview Audit Standard or Audit Premium availability and retention requirements.
• Communication Compliance policies if applicable.
• Insider Risk Management policies if applicable and legally approved.
• Content search permissions and auditability.
• Regulatory alignment for GDPR, HIPAA, FINRA, ISO, or industry-specific requirements.

Compliance settings should be tied to actual business policies. Avoid enabling sensitive monitoring features without HR, legal, and privacy approval.

Step 6: Audit Devices and Endpoint Security with Intune

A strong Microsoft 365 tenant can still be exposed if users access it from unmanaged, noncompliant, or compromised devices. Microsoft Intune and Microsoft Defender for Endpoint should be reviewed together.

Device and endpoint checks:

• Intune enrollment status for Windows, macOS, iOS, Android, and shared devices.
• Compliance policies for encryption, OS version, jailbreak/root detection, firewall, antivirus, and device health.
• Conditional Access rules that require compliant or hybrid joined devices for sensitive access.
• Intune configuration profiles and security baselines.
• Microsoft Defender for Endpoint onboarding and endpoint detection coverage.
• Attack surface reduction rules, endpoint firewall, antivirus, and tamper protection.
• Local administrator control and Microsoft Intune Endpoint Privilege Management where licensed.
• App protection policies for unmanaged or BYOD devices.
• Windows Autopatch readiness and update rings where appropriate.
• Access restrictions for unmanaged devices downloading files from SharePoint and OneDrive.

This section is especially important for hybrid work, contractors, mobile users, and organizations with BYOD policies.

Step 7: Audit Apps, OAuth Consent, and SaaS Governance

Third-party applications and OAuth permissions are a frequent blind spot. A user-approved app can sometimes access mail, files, calendars, or directory data long after the original business need is gone.

Application governance checks:

• Enterprise applications and app registrations in Microsoft Entra ID.
• Service principals with high privileges or unused credentials.
• OAuth permissions and delegated access grants.
• Admin consent workflow and user consent restrictions.
• Publisher verification and app risk review.
• Expiring client secrets and certificates.
• Unused or stale applications.
• Defender for Cloud Apps discovery, app governance, and session controls where licensed.

Remove unused applications, restrict user consent where appropriate, and document business owners for approved apps.

Step 8: Audit Threat Detection, Logs, Alerts, and Response

Security controls are incomplete without monitoring and response. The audit confirms that the organization can detect suspicious activity, investigate it, and respond quickly.

Monitoring checks:

• Microsoft Defender XDR incidents, alert policies, and automated investigation settings.
• Microsoft Defender for Office 365 alerts for phishing, malware, and user-reported messages.
• Microsoft Defender for Endpoint alerts and device exposure insights.
• Microsoft Entra sign-in logs, audit logs, risky users, and risky sign-ins.
• Microsoft Purview Audit retention and search requirements.
• Exchange, SharePoint, OneDrive, Teams, and admin activity audit events.
• Alert routing, severity definitions, and response ownership.
• Microsoft Sentinel integration if centralized SIEM/SOAR monitoring is required.
• Executive dashboards for open risks, remediation status, and Secure Score trends.

A good audit identifies not only missing alerts but also noisy alerts that teams ignore.

Step 9: Review Licensing, NCE Commitments, and Security Coverage

Security audits include licensing because many Microsoft 365 controls depend on specific plans. Under Microsoft New Commerce Experience, subscription term choices, monthly or annual commitments, and add-on decisions affect flexibility and cost.

Review:

• Whether Microsoft 365 Business Premium, E3, E5, or frontline plans match user risk profiles.
• Whether Entra ID P1 or P2 is needed for Conditional Access, Identity Protection, PIM, or access governance scenarios.
• Whether Defender for Office 365 Plan 1 or Plan 2 is required for email security needs.
• Whether Intune is available for device and app protection requirements.
• Whether Microsoft Purview capabilities meet DLP, eDiscovery, audit, and compliance requirements.
• Whether Defender for Endpoint, Defender for Cloud Apps, or Microsoft Sentinel are needed for detection and response goals.
• Unused licenses, overassigned licenses, disabled users with licenses, and security add-ons assigned to the wrong users.

The prices that decide most of these, Microsoft list price, October 2026 price list, annual term, per user per year: Microsoft 365 Business Premium $264.00 ($22.00 per month), Microsoft 365 E3 $468.00 ($39.00), Microsoft 365 E5 $720.00 ($60.00), Microsoft Entra ID P1 $84.00 ($7.00), Entra ID P2 $120.00 ($10.00), Microsoft Defender for Office 365 Plan 1 $24.00 ($2.00) and Plan 2 $60.00 ($5.00), Microsoft Defender for Endpoint Plan 1 $36.00 ($3.00) and Plan 2 $62.40 ($5.20), Microsoft Intune Plan 1 $96.00 ($8.00). The objective is not to buy every security product. The objective is to align risk, licensing, and operational capability.

Pass Criteria: The Thresholds We Audit Against

A checklist without thresholds produces a report nobody can act on. These are the pass criteria IT Partner applies to a 10-to-500-user tenant; the two Microsoft figures come from Microsoft Learn.

Domain	Pass	Fail
MFA coverage	Every enabled user is covered by Conditional Access requiring MFA or by security defaults; zero successful legacy-authentication sign-ins in the last 30 days	Any user with a password-only sign-in in the last 30 days
Admin roles	Fewer than five Global Administrators (Microsoft's recommendation), each with a separate admin account and phishing-resistant MFA; PIM where Entra ID P2 is licensed	Standing Global Administrator on a daily-use account
Emergency access	Two or more cloud-only emergency access accounts, excluded from blocking Conditional Access policies, with an alert on every sign-in	One account, a synced account, or no alert
Conditional Access	Policies require compliant or hybrid-joined devices for Exchange Online, SharePoint and Teams; every exclusion has a named owner and an expiry date	Exclusion lists with no owner, or trusted locations covering unmanaged VPN egress
Email authentication	SPF, DKIM and DMARC published for every accepted domain, DMARC at p=quarantine or p=reject	DMARC missing or still at p=none after ninety days
Mail flow	External auto-forwarding blocked; Standard or Strict preset applied; no permanent allow entries older than ninety days	Any mailbox forwarding to a personal domain
Sharing	Anyone links disabled or expiring; guest accounts reviewed in the last ninety days; no site shared with Everyone except external users holding regulated data	Anyone links without expiry on sites holding client data
Devices	Every Windows and macOS device that reaches company data is Intune-enrolled, compliant, encrypted and onboarded to Defender	Any unmanaged laptop with full access to SharePoint downloads
App consent	User consent limited to verified publishers for low-impact permissions, or admin consent workflow on; no enterprise app with mailbox-wide application permissions and no owner	Users can consent to any app
Audit	Purview Audit enabled and searchable; alert policies routed to a named mailbox or ticket queue	Audit off, or alerts going to an unmonitored address
Licensing	No licensed disabled users; no security add-on assigned to a user who does not need it	Disabled accounts still holding paid seats

Prioritized Remediation Plan

After the audit, convert findings into a remediation roadmap. Prioritize by risk, business impact, licensing, and implementation effort, and attach a deadline to each priority:

1. P1, within seven days: MFA for every user, legacy authentication blocked, Global Administrator count reduced, emergency access accounts created and monitored, external auto-forwarding blocked, risky sign-ins reviewed.
2. P2, within thirty days: Conditional Access device and app policies, Defender for Office 365 presets, DMARC moved toward enforcement, Safe Links and Safe Attachments, quarantine and transport rule cleanup, user consent restricted, stale guests and apps removed.
3. P3, within ninety days: sensitivity labels, DLP, retention, Copilot readiness, Intune compliance and Defender for Endpoint onboarding for every device, local admin control, Purview Audit and alert routing, Sentinel integration if needed.
4. Ongoing: recurring access reviews, monthly Secure Score review, policy ownership, and executive reporting.

Each remediation item carries an owner, priority, affected users, licensing dependency, implementation steps, rollback plan, and target completion date.

Common Mistakes to Avoid

• Treating Secure Score as the only audit result instead of one useful input.
• Enabling Conditional Access policies without testing exclusions, emergency access, or user impact.
• Keeping too many permanent Global Administrators.
• Allowing legacy authentication or weak authentication methods to remain active.
• Ignoring guest users, shared channels, and cross-tenant access settings.
• Reviewing email security without checking SPF, DKIM, DMARC, forwarding, and mailbox rules.
• Assuming SharePoint and Teams permissions are safe before enabling Copilot.
• Leaving user consent to third-party apps unrestricted.
• Reviewing compliance features without legal, privacy, and records stakeholders.
• Buying security licenses without operational ownership for the controls they unlock.

Recommended Audit Cadence

For most organizations, a Microsoft 365 security audit should be performed at least annually, with focused reviews more often for high-risk areas.

Suggested cadence:

• Weekly: review critical Defender incidents, risky users, high-risk sign-ins, and urgent Secure Score changes.
• Monthly: review admin roles, external sharing, mailbox forwarding, OAuth apps, device compliance, and the Secure Score trend.
• Quarterly: review Conditional Access, guest access, access reviews, DLP events, Defender policies, and endpoint posture.
• Semiannually: run phishing simulations, tabletop incident exercises, and Copilot data exposure reviews.
• Annually: complete a full tenant security audit, licensing review, compliance review, and executive risk report.

Frequently asked questions

How often should we audit a Microsoft 365 tenant?

A full audit once a year, the P1 items (MFA, admin roles, forwarding, legacy authentication) monthly, and Secure Score and Defender incidents weekly. A tenant that just changed partners, merged, or enabled Copilot gets a full audit at that moment.

What is a good Microsoft Secure Score?

There is no passing number. Secure Score counts the actions you have completed against the actions available to your licenses, so two well-run tenants with different licenses show different scores. Audit against the pass criteria above and use the score trend to prove the direction.

Does a high Secure Score mean we are compliant?

No. Secure Score is a configuration benchmark, not a compliance certification. Frameworks such as HIPAA, SOC 2 or CMMC need policies, evidence and recurring reviews on top of the configuration; our SOC 2 on Microsoft 365 article maps one framework to the same controls.

Sources

• Best practices for Microsoft Entra roles — Microsoft Learn, ms.date 1 June 2026, read from the MicrosoftDocs GitHub source on 2026-10-11 (fewer than five Global Administrators)
• Manage emergency access accounts in Microsoft Entra ID — Microsoft Learn, ms.date 4 June 2026, read from the MicrosoftDocs GitHub source on 2026-10-11 (two or more emergency access accounts)
• Mandatory multifactor authentication for Azure sign-in — Microsoft Learn, ms.date 3 April 2026, read from the MicrosoftDocs GitHub source on 2026-10-11
• Microsoft, US commercial price list, October 2026 (all Microsoft list prices above)

Key takeaways

• A 2026 Microsoft 365 security audit covers Entra ID, Defender XDR, Intune, Purview, Secure Score, apps, data exposure, logging, and licensing, and it scores against thresholds, not impressions.
• Identity fixes come first: MFA for everyone, legacy authentication blocked, fewer than five Global Administrators, two or more emergency access accounts, and Conditional Access exclusions with owners.
• Secure Score is one input, read for its actions and its trend; it is separate from the Defender for Cloud secure score and it is not a compliance certificate.
• Email security needs Defender presets, SPF, DKIM and DMARC at enforcement, and forwarding and transport rule cleanup, not just Safe Links and Safe Attachments.
• The audit ends with a P1 (seven days), P2 (thirty days), P3 (ninety days) remediation roadmap with named owners.

If you want an objective review against the pass criteria above, IT Partner's Microsoft 365 Security Audit - Baseline is $525 per project, quoted in writing before work begins, and returns the baseline report with the P1-to-P3 roadmap; the Microsoft 365 Security Baseline and Secure Score Remediation engagement ($3,450 per project) then does the fixes.