Microsoft 365 audit checklist

Make the scope specific

The word audit can describe very different pieces of work. Ask whether the proposal is a configuration review, a licence review, a compliance assessment or a combination. Record the tenant and services covered, the evidence the reviewer will use and whether implementing fixes is included.

Explain how people actually work: remote access, shared mailboxes, external collaborators and applications that depend on Microsoft 365. A recommendation needs to make sense for your organisation. Ask for disruption, cost and prerequisites to be explained alongside the security benefit.

Use Secure Score as context

Microsoft describes Secure Score as a way to track recommended security actions. It is not a prediction of whether you will be breached or a guarantee of protection. See Microsoft’s Secure Score guidance. Ask the reviewer to explain relevant findings and exceptions instead of treating one number as the entire outcome.

Agree a written deliverable before granting access. You should be able to understand what was checked, what could not be checked, what needs attention and who will make the decision. Keep the review report with your business records and agree a date to revisit unresolved actions.

Bring this to your next conversation

Your practical checklist

Tick a row when you have recorded an answer and any follow-up. These ticks are planning notes, not a pass mark. They stay on this page and are not saved or sent.

Review owner: ____________________

Review date: ____________________

Define what the review should answerIs the priority account security, sharing, licence use or all three? List the Microsoft 365 services and business concerns in scope, plus anything explicitly excluded.
Owner / evidence / next action:
Record subscriptions and responsibilitiesWhich plans do you own, who manages billing and who approves changes? Ask the reviewer to distinguish features you already have from recommendations requiring additional licences.
Owner / evidence / next action:
Review identity and administrator accessAsk how sign-in protection, privileged accounts, recovery access and joiner/leaver processes will be checked. Include external partners and explain any business-critical exceptions.
Owner / evidence / next action:
Check email and collaboration scopeWhich mail protection, forwarding, guest access and external-sharing settings will be reviewed? Ask for the business impact of proposed changes before tightening settings.
Owner / evidence / next action:
Ask about recovery and retentionIdentify the data you need to recover and the circumstances that matter. Ask what current retention and recovery arrangements cover, and where separate backup work may be needed.
Owner / evidence / next action:
Agree safe, limited accessName the authorised reviewer, required permissions and access period. Ask how evidence is handled and access removed. Do not send passwords or recovery codes in an enquiry.
Owner / evidence / next action:
Specify the report and follow-upRequest findings with evidence, business impact, recommended action and owner. Separate urgent issues from improvements, record limitations and agree how completed actions will be checked.
Owner / evidence / next action:

Start with a scoped conversation

The Microsoft 365 audit enquiry goes directly to Dead Simple Computing. It does not connect your tenant or grant access. The enquiry is free; any review or remediation is scoped and quoted separately. You can also choose another MSP in the directory.

Microsoft 365 audit checklist

Make the scope specific

Use Secure Score as context

Your practical checklist

Start with a scoped conversation

Useful for your team or customers?