Your M365 tenant is what everyone will ask about next.
An M365 audit is an independent third-party assessment of your Microsoft 365 tenant. Accounts, permissions, mail flow, file sharing, security configuration, and license use, measured against the rules your industry actually has to follow. We do not certify. We document where you sit.
Built by a CISSP. Sold by Agate. Delivered through Computer Concepts Inc., the insured delivery entity. Mapped against at least three frameworks per engagement. Honest evidence you can hand to your carrier, your auditor, your board, or your buyer in a deal.
One deliverable. Six audiences.
Most M365 audits answer one question. Ours answers six. Independent third-party evidence of your tenant's posture is the same document your cyber insurance carrier wants to see, your formal auditor wants to start from, your board wants on file, and your buyer wants in the data room. We write it once. You use it everywhere.
Cyber insurance applications & renewals
Carriers now routinely ask for "annual M365 baseline" or "documented configuration review." Independent third-party evidence answers the question without your IT having to assemble it.
Cyber insurance claim defense
If an incident happens later, a documented baseline assessment shows due care. That can be the difference between a covered claim and a denied one.
HIPAA Risk Analysis evidence
Required under 45 CFR § 164.308(a)(1)(ii)(A). M365 baseline is a major piece of the technical safeguards review. The deliverable is yours to file.
Supplement to formal audits
SOC 2, HIPAA, ISO 27001, PCI scope review. Auditors prefer to start from a current third-party baseline. Reduces audit time and surprise findings.
Board / executive assurance
Annual M365 baseline becomes the board pack appendix that proves the cybersecurity program is real, ongoing, and externally validated.
Deal & vendor diligence
Pre-acquisition due diligence, vendor security questionnaires, investor diligence packets. A current third-party assessment closes deals faster.
Not a browser. Not a script you can buy.
This is not a configuration review you could run with a browser and a checklist. Each engagement uses scripted forensics, deep configuration tracing, license usage analysis, and discovery patterns chosen for your tenant, your data flows, and the frameworks relevant to your industry.
The specific tooling stack is selected per engagement and is not disclosed publicly. We use read-only access only, through your scoped admin process. We do not modify your tenant. We do not get standing access. We do not retain your data after the engagement closes.
No security assessment can guarantee discovery of every issue. Findings reflect what was assessed within the agreed scope and access window. Conditions in your tenant may change between assessment and remediation. Your IT team's execution of the remediation list determines the final exposure. Read the Service Terms before you commit.
Three frameworks per engagement. Minimum.
Most M365 audits speak one framework. Yours probably needs at least three. We map findings to the frameworks your industry, your customers, and your regulators actually use. Below is the default starting stack by client type. We adjust to fit.
Practices & clinics
- CIS M365 Benchmark v6
- HIPAA Security Rule (45 CFR § 164.312)
- NIST Cybersecurity Framework 2.0
- NIST AI Risk Management Framework (if AI in use)
Firms & CPAs
- CIS M365 Benchmark v6
- FTC Safeguards Rule (16 CFR Part 314)
- NIST Cybersecurity Framework 2.0
- NIST AI Risk Management Framework
Professional services
- CIS M365 Benchmark v6
- NIST Cybersecurity Framework 2.0
- NIST AI Risk Management Framework
- State privacy laws applicable to you
Federal vendors
- CIS M365 Benchmark v6
- NIST 800-171 / CMMC 2.0 Level 2
- NIST Cybersecurity Framework 2.0
- NIST AI Risk Management Framework
50–500 user tenants
- CIS M365 Benchmark v6
- NIST Cybersecurity Framework 2.0
- ISO 27001 control overlay
- Industry-specific framework
These are starting stacks. We add or substitute frameworks to fit your specific industry, your customers' requirements, and the regulators you answer to. The Scoping engagement confirms the right framework set before the audit begins.
No one ever passes. That's not the point.
We are not selling pass.
The frameworks are what they are. No tenant we have ever assessed has passed everything on the first review. The value of the audit is knowing exactly where you sit, with honest evidence, and a remediation roadmap your IT team can actually execute.
Five findings show up in nearly every M365 tenant we audit. We document them, name them, prioritize them, and hand off. Your IT or your trusted partner makes the changes.
Then the next year, the assessment shows what changed. That delta is what your board, your carrier, and your auditor want to see.
-
1
No MFA on admin accounts (or partial coverage)
-
2
Legacy authentication still enabled
-
3
No DMARC reject policy on outbound mail
-
4
Over-permissive SharePoint or OneDrive sharing
-
5
No unified audit logging or insufficient retention
Six categories. Every engagement.
The scope is consistent. The depth scales with your tenant size, the frameworks applied, and the regulatory overlay your industry requires.
Compliance gaps
Configuration deltas against the frameworks selected for your industry. Where you sit on each control, with evidence.
Dormant & orphaned accounts
Stale users, former employees with active credentials, mailboxes still receiving mail, accounts with admin rights nobody remembers.
Permissions audit
Role assignments, conditional access policies, privileged identity practices, group memberships, and what should be added or removed.
Exchange mail issues
Transport rules, auto-forwarding to external addresses (compromise indicator), retention configuration, mail flow visibility, DMARC, DKIM, SPF.
SharePoint & OneDrive
Site ownership, sharing settings, external guest access, sensitivity labels, broken inheritance, public links, sites no one owns.
License usage & cost
Per-license utilization, assignment patterns, overlapping features, recommendations to reduce M365 spend without losing capability your team actually uses.
Four deliverables. One document set.
Written, structured, and yours to keep. Hand them off to your IT team, your insurance broker, your auditor, your board. The same document set serves all of them.
Findings report
Written assessment of your tenant against the frameworks selected. Where you sit on each control, with evidence and context.
Prioritized remediation list
Every finding ranked by exposure and effort. Sequenced so your IT team can work top-down without guessing what to fix first.
License optimization analysis
Per-license utilization, overlapping features, assignment patterns. Recommendations your finance team can validate against the next Microsoft renewal.
Stakeholder walkthrough
A scheduled session with owner, admin, and your IT team. We answer questions, explain trade-offs, and confirm the handoff is understood.
Four steps. Read-only access. Hands off at the end.
We do not start with the audit. We start with the scope. Then we get authorized, scoped, time-limited access. Then the work. Then we hand it off. We do not remediate. Your IT does.
Scoping
Paid $1,500 intake. We size the tenant, confirm frameworks, and produce a written quote and timeline.
Authorization
Signed scope letter, read-only admin access through your PIM or temporary admin process. You retain Global Admin.
Audit
30-day minimum. Scripted forensics, configuration tracing, license review across all six categories.
Handoff
Deliverables, walkthrough, prioritized remediation list. Your IT executes. Access closes.
What this audit is not.
Honest scope boundaries protect both sides. Read these before you commit. Every one of them is also in the Service Terms.
- Not a remediation engagement We document findings and hand off the prioritized list. Your IT team or trusted partner executes the changes. We do not modify your tenant.
- Not a compliance certification We document indicators against the frameworks you select. We do not certify HIPAA, FTC Safeguards, ISO, SOC 2, or any other regulatory or industry standard.
- Not a guarantee of complete discovery No security assessment can guarantee discovery of every issue. Findings reflect what was assessed within the agreed scope and access window.
- Not legal or regulatory advice We do not interpret laws or regulations on your behalf. Your privacy officer, compliance team, and counsel make those determinations.
- Not a substitute for formal audit A SOC 2, HIPAA, ISO, or PCI auditor performs work we do not perform. Our deliverable supplements their work; it does not replace it.
- Not an insurance carrier opinion We do not opine on whether findings will satisfy any specific cyber insurance carrier's requirements. Hand the deliverable to your broker or carrier.
Visible. Scoped. Honest.
Starting prices anchor the engagement size. The final scope and price are confirmed in the Scoping engagement. We do not price multi-system tenant work as if it were a template.
M365 Tenant Scoping — $1,500
Paid intake. 60-minute call with owner or admin. Read-only Secure Score capture. Tenant sizing. Framework confirmation. Written next-step recommendation with budget class. Credits toward the audit if you sign within 30 days.
Start the Scoping →CIS Benchmark v6 alignment plus one regulatory overlay. Single domain. Standard handoff.
- 6 audit categories
- 3 frameworks mapped
- 30-minute walkthrough
- License optimization
Full multi-framework overlay tuned to your industry. Detailed remediation roadmap with effort estimates.
- 6 audit categories
- 3+ frameworks mapped
- 60-minute walkthrough + Q&A
- Single point of contact
- Effort-estimated roadmap
Multi-domain or multi-tenant scope, full regulatory overlay, stakeholder workshops, executive presentation.
- Multi-domain or multi-tenant
- 4+ frameworks mapped
- Stakeholder workshops
- Executive presentation
- 30-day clarification window
What people ask before they call.
Does this make me HIPAA compliant?
Will the deliverable satisfy my cyber insurance carrier?
What if you miss something?
Do you remediate the findings?
Do you need Global Admin access?
How long does an engagement run?
What tools do you use?
Why is the engagement delivered through Computer Concepts Inc.?
What industry are you in?
Helps us confirm the framework stack for the Scoping engagement.
Rough tenant size?
User count, single domain or multi-domain. Anything you know.
Where should we reach you?
We respond within one business day. The Scoping engagement is paid and scoped before any access is granted.
By sending this you agree we may reply by email. We do not sell or share your information. See the Privacy Notice.
Thanks. We will reply within one business day.
If the Scoping engagement is the right next step, you will hear directly from us.