Microsoft 365 Tenant Audit
Know exactly where your Microsoft 365 tenant stands.
A read-only review of your identity, security, collaboration and Exchange configuration, scored on the evidence and mapped to the frameworks that matter, with clear priorities for what to fix first.
- ✓ Read-only
- ✓ No agents or installs
- ✓ Access approved in minutes
What’s covered
Over 60 checks across your whole tenant
Every check reports what the evidence shows. Anything the audit couldn’t read is marked Unknown, never assumed to be fine.
Your report includes
- Configuration posture score across identity, privileged access, apps and external exposure, with evidence coverage shown alongside
- Framework alignment mapped to recognised frameworks
- Migration assessment for tenant-to-tenant or consolidation projects, if you need one
- Prioritised roadmap of findings, ordered by risk and effort
- Executive PDF, PowerPoint and remediation workbook for your leadership and delivery teams
Microsoft MVP · Identity & Access
Identity & access
Conditional Access coverage, MFA registration, authentication methods, security defaults and named locations.
Privileged access
Directory and PIM role assignments, standing admin access, break-glass accounts and admin units.
External exposure
Guests, cross-tenant access, OneDrive and SharePoint sharing, and stale or never-used accounts.
Apps & consents
App registrations, enterprise apps, OAuth grants, expiring secrets and over-privileged applications.
Exchange Online
Mailbox delegation, forwarding, inbox rules, transport rules and shared and resource mailboxes.
Devices & data
Intune configuration and app protection policies, sensitivity labels, retention and eDiscovery.
Collaboration
Teams, channels, SharePoint sites, Microsoft 365 groups and distribution lists.
Licensing & readiness
Licence usage and optimisation, plus migration complexity scoring if you’re moving tenants.
Mapped to: UK Cyber Essentials · NCSC Cyber Assessment Framework · CIS Microsoft 365 Foundations Benchmark · NIST SP 800-53 · ASD Essential Eight · EU NIS2 Directive
How it works
From request to report, without the back-and-forth
- 1
Request
Tell us about your organisation using the form below. It takes a minute.
- 2
Grant read-only access
You’ll get an email to approve access, either in one click via Microsoft’s consent screen or with your own app registration.
- 3
Audit
Andy runs the audit against your tenant. Nothing is installed and nothing is changed.
- 4
Report & walkthrough
You get scored findings and a prioritised roadmap, with Andy on hand to talk them through.
Security & your data
Built so your security team can say yes
The audit uses application permissions that can only read. You decide how access is granted, what it covers and when it ends.
- Read-only Microsoft Graph permissions. The audit cannot change anything in your tenant.
- You approve access on Microsoft’s own screen, and can remove it at any time from Entra ID.
- Prefer to stay in control? Your security team can create and own the app registration instead.
- Exchange access is optional and uses least-privilege Exchange roles assigned to the app only.
- Audit data is held encrypted in the EU and removed from the audit service after 30 days. Your reports stay in your portal for 12 months, and Andy Kemp Consulting keeps a confidential record of the engagement.
- Delivered by a Microsoft MVP in Identity & Access.
Get started
Request your Microsoft 365 audit
Use your work email. If it belongs to the tenant you’re asking about, the setup email arrives straight away.