Microsoft 365 Advanced Security Audit Using SCuBA — Baseline Compliance Assessment

The Microsoft 365 Advanced Security Audit is a security assessment that uses the Security Configuration Baseline Assessment, or SCuBA, framework to evaluate a Microsoft 365 tenant against Microsoft security baselines. IT Partner uses the scan results to produce a report with findings and recommendations so the organization can understand which settings are compliant or non-compliant.

This service is for organizations that want to understand the current security configuration of their Microsoft 365 services and identify settings that should be remediated. It is relevant when an organization needs a baseline view of its Microsoft 365 tenant security posture across core Microsoft 365 services.

The SCuBA-generated report may include recommendations across Microsoft 365 suite offerings such as Azure AD, Exchange, Teams, Defender, OneDrive, SharePoint, and Power Platform. The exact findings depend on the tenant configuration and the results returned by the SCuBA scan.

The deliverables include a SCuBA-generated report on the tenant’s compliance with Microsoft security baselines, an easy-to-understand version of the report for the client, and findings with recommendations based on the scan results. The service is focused on assessment, reporting, and guidance from the SCuBA results.

The stated scope includes scanning the tenant, analyzing results, generating the report, and reporting findings and recommendations. Remediation work is not specifically listed in the service deliverables, so any implementation of recommended changes should be confirmed separately with IT Partner.

The listed duration for this service is 10 days. During that period, IT Partner runs the SCuBA assessment, analyzes the results, generates the report, and presents findings and recommendations.

The listed price for the Microsoft 365 Advanced Security Audit using the SCuBA framework is $1500 per project.

The SKU for this service is ITPWW140SECOT. The service is categorized under Security and Protection for Office 365 and Microsoft 365.

The engagement includes a kickoff meeting, a SCuBA scan of the Microsoft 365 tenant, analysis of the scan results and report generation, and reporting of findings and recommendations. This process is designed to give the client a clear view of the tenant’s current alignment with Microsoft security baselines.

The client must grant access to the Microsoft 365 tenant and provide the related permissions needed for the SCuBA scan. The exact permission details should be coordinated during kickoff because access must be sufficient to assess the relevant Microsoft 365 service configurations.

The client is responsible for granting access to the Microsoft 365 tenant and related permissions. The client must also provide a dedicated point of contact to work with IT Partner during the assessment.

IT Partner is responsible for using SCuBA to generate a report on the tenant’s compliance with Microsoft security baselines. IT Partner also provides the report to the client in an easy-to-understand format and reports the findings and recommendations.

The service description identifies the work as an assessment, scan, analysis, and reporting engagement, not a production migration or configuration change project. Downtime or user impact is not listed as part of the service, but any operational concerns should be confirmed with IT Partner before the scan is scheduled.

The stated service scope is to assess the tenant configuration using SCuBA and provide findings and recommendations. It does not state that IT Partner will change tenant settings as part of the engagement, so clients should not assume remediation or configuration changes are included unless separately agreed.

The report shows the tenant’s compliance with Microsoft security baselines based on SCuBA scan results. It includes findings and recommendations that help identify non-compliant Microsoft 365 settings that should be reviewed or remediated.

The stated success criterion is that the current status of Microsoft 365 services is analyzed through a comprehensive review. In practical terms, the engagement is successful when the SCuBA scan has been completed, results have been analyzed, and the client receives the report with findings and recommendations.

After the report is delivered, the client has a documented view of Microsoft 365 security baseline compliance and recommended changes to consider. The service scope does not include post-assessment remediation or ongoing monitoring by default, so follow-up implementation, ongoing monitoring, 24/7 support, or ongoing maintenance should be discussed separately with IT Partner as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.

No, this service is specifically an assessment using the SCuBA framework to evaluate Microsoft 365 tenant configuration against Microsoft security baselines. It provides findings and recommendations, but the service does not include continuous monitoring, 24/7 support, ongoing maintenance, managed detection and response, or a broader security operations program by default. Those capabilities are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.

Before kickoff, the client should be ready to provide Microsoft 365 tenant access, related permissions, and a dedicated point of contact for coordination. This preparation matters because IT Partner needs tenant access to run the SCuBA scan and a client contact to resolve questions during the engagement.