// Guide · Microsoft 365 security review · Updated November 2026
Microsoft 365 Security Review: What to Check, What You Should Get, and How to Keep It in Check
A Microsoft 365 security review tells you how well your tenant is protected today: who can sign in and how, who has admin rights, what your users can share, and whether you’d notice an attack. This guide explains what a review should check, what you should get from it, how often to do it, and how to keep your tenant in check between reviews with Mito.
- What a Microsoft 365 security review checks
- Why one-off reviews go out of date
- How to run a review in five steps
- What you should receive
- Security review or penetration test?
- Is MFA enough?
- Which benchmarks to measure against
- How often to review: a simple schedule
- Keep it in check every day with Mito
- FAQ
What a Microsoft 365 security review checks
Most Microsoft 365 incidents don’t start with a software flaw. They start with settings: an admin account left out of MFA, a Conditional Access exclusion nobody remembers, users allowed to approve any third-party app, or “anyone with the link” sharing. A good review looks at each area and at how the settings combine.
Identity and access (Entra ID)
MFA coverage and strength, Conditional Access policies and their exclusions, legacy authentication, the number of Global Administrators, break-glass accounts, and guest access.
Admin roles and privilege
Who holds which admin role, whether admins use separate cloud-only accounts, and whether just-in-time access with Privileged Identity Management is used where licensed.
Email (Exchange Online)
Anti-phishing and impersonation protection, Safe Links and Safe Attachments, SPF, DKIM and DMARC, external forwarding, and the mailbox rules attackers like to create.
Collaboration (SharePoint, OneDrive, Teams)
External and anonymous sharing, default link types, guest expiry, and Teams external access and meeting settings.
Apps and integrations
Whether users can consent to apps on their own, which apps hold high-privilege permissions, and app secrets that never expire.
Devices (Intune and Defender)
Device enrolment and compliance, encryption, protection for personal phones, and endpoint protection coverage.
Data protection (Purview)
Sensitivity labels, data loss prevention, retention, and oversharing that Microsoft 365 Copilot could surface.
Visibility and response
Audit logging, alert policies, who reviews them, and whether you have written steps for a compromised account.
Why one-off reviews go out of date
A review is a snapshot. The day after it’s finished, someone adds a new admin, creates a Conditional Access exclusion “just for this week”, approves a new app or changes a sharing setting to help a client. This is called configuration drift, and it’s how a tenant that passed its review quietly becomes risky again.
That’s why we recommend pairing a thorough review with automated daily checks. The review sets the baseline and the priorities; the daily checks tell you as soon as something moves.
How to run a Microsoft 365 security review in five steps
- Scope itAgree which tenants, workloads and licences are in scope, who the contacts are, and what matters most to the business: for example email fraud, data leaks or an upcoming audit.
- Connect with read-only accessUse read-only access only. With Mito, a Global Admin runs one script to create a read-only app registration, which takes about ten minutes.
- Assess against published baselinesCheck the tenant against the CIS Microsoft 365 Foundations Benchmark, CISA ScuBA and Microsoft’s own guidance. Mito runs 400+ read-only checks and ranks every failure by severity.
- Prioritise and fixStart with the high-risk findings that remove the most risk with the least disruption. Test changes such as Conditional Access in report-only mode first, then enforce them.
- Re-check and keep watchingConfirm each fix worked, then keep the checks running. Mito re-assesses the tenant every day and shows what is newly failing or fixed since the last run.
What you should receive from a review
- An executive summary that a manager can read in five minutes: overall risk, top issues and what they mean for the business.
- Findings ranked by severity, each with the evidence behind it, not just a tool export.
- Clear fix steps that match the licences you actually have.
- A walkthrough meeting to agree priorities and owners.
- A re-check after fixes, so you know each one worked.
- Ongoing evidence, such as daily history and framework mappings, that you can show to auditors and customers.
With Virtual Petals you get the review and walkthrough from our engineers, and Mito’s daily report, history and framework views afterwards. Each Mito finding links to guidance on how to fix it.
Security review or penetration test?
| Microsoft 365 security review | Penetration test | |
|---|---|---|
| Question it answers | Is our tenant configured to resist common attacks? | Can an attacker exploit the systems we run? |
| What it looks at | Entra ID, Exchange, SharePoint, Teams, Intune, Defender and Purview settings | Your web apps, APIs, Azure workloads and networks |
| Access needed | Read-only | Agreed test scope and rules of engagement |
| How often | Full review yearly, plus daily automated checks | Usually yearly or after major releases |
| Best for | Almost every business that uses Microsoft 365 | Organisations that build or host their own applications |
Is MFA enough?
MFA is the single most important control, but it isn’t enough on its own. Attackers now use phishing kits that capture a session after MFA, bombard users with MFA prompts until they approve one, use legacy protocols that skip MFA, trick users into consenting to malicious apps, or simply target the accounts left out of your policies. A review checks for these gaps: phishing-resistant MFA for admins, Conditional Access without loose exclusions, legacy authentication blocked, and app consent restricted.
Which benchmarks to measure against
- Microsoft Secure Score in the Defender portal: a quick view of Microsoft’s own recommendations.
- CIS Microsoft 365 Foundations Benchmark: the most widely used independent baseline. Mito maps its checks to CIS v7.0.0, and 104 of its 160 recommendations have a Mito check. How Mito checks the CIS benchmark.
- CISA ScuBA, EIDSCA and ORCA: detailed baselines for Entra ID and Exchange Online that Mito’s checks are built on.
- Framework evidence: Mito maps results to ISO/IEC 27001:2022 Annex A and the UAE IA Regulation v1.1, with mappings for Dubai ISR and ADHICS.
How often to review: a simple schedule
| When | What to do | Effort with Mito |
|---|---|---|
| Every day | Automated checks across the whole tenant; new failures and fixes highlighted. | Automatic |
| Every week | Look at anything newly failing at Critical or High severity and assign an owner. | About 10 minutes |
| Every month | Review the trend, close out fixes, and check new admins, guests and app consents. | About 30 minutes |
| Every quarter | Review Conditional Access exclusions, privileged roles and external sharing; share a summary with management. | An hour, or we do it with you |
| Every year, and after big changes | A full review: mergers, licence upgrades, hybrid identity changes or a Copilot rollout. | A short engagement with Virtual Petals |
Mito by Virtual Petals
Keep Microsoft 365 security in check, every day
Mito turns the security review into a daily habit. It runs 400+ read-only checks against your Microsoft 365 tenant every day, ranks what it finds by severity, and shows exactly what changed since yesterday, so you always know where to start.
- Set up in about 10 minutes: one script creates a read-only app registration in your tenant.
- Read-only by design: Microsoft Graph read permissions and the Global Reader role. It cannot change any setting, mailbox or file, and you can revoke it any time.
- Covers the whole tenant: Entra ID, Exchange Online, SharePoint, Teams, Defender, Intune and Purview.
- Evidence for audits: results mapped to CIS Microsoft 365 v7.0.0, ISO/IEC 27001:2022 Annex A and the UAE IA Regulation v1.1.
- Data stays in the UAE: assessments run and results are stored in Microsoft Azure UAE North, isolated per customer.
- Built for IT partners too: check every client tenant every morning with the same read-only setup. Mito for MSPs.
Microsoft 365 security review FAQ
What does a Microsoft 365 security review include?
A review checks how your tenant is configured: identity and Conditional Access, admin roles, email protection, SharePoint, OneDrive and Teams sharing, devices, data protection, app consents and audit logging. The output is a list of findings ranked by risk, with steps to fix each one.
How often should we review Microsoft 365 security?
Run a full review at least once a year and after big changes such as a merger, a licence upgrade, a move to hybrid identity or a Copilot rollout. Between reviews, automated daily checks catch drift, so a risky change is found the next day instead of at the next audit.
Is Microsoft Secure Score enough on its own?
Secure Score is a useful starting point, but it only covers Microsoft’s own recommendations and gives points rather than a full picture. A review also compares your tenant with independent baselines such as the CIS Microsoft 365 Foundations Benchmark and CISA ScuBA, and looks at how settings combine.
Is a Microsoft 365 security review the same as a penetration test?
No. A review checks the configuration of a software-as-a-service tenant you don’t host yourself. A penetration test tries to exploit systems you run, such as web apps, APIs or Azure workloads. Most small and mid-sized businesses get more value from a configuration review first.
What access does a review need?
Read-only access is enough. Mito uses an app registration in your tenant with read-only Microsoft Graph permissions and the Global Reader role, so it can read settings but cannot change anything. You can delete it at any time to end access.
Does a security review help with ISO 27001, the UAE IA Regulation or other frameworks?
Yes, as evidence for the technical controls. Mito maps its results to CIS Microsoft 365 v7.0.0, ISO/IEC 27001:2022 Annex A and the UAE IA Regulation v1.1, with mappings for Dubai ISR and ADHICS. Frameworks also need policies, processes and training, so a review supports compliance work but does not certify it.
How much does a Microsoft 365 security review cost?
It depends on the number of users and tenants, your licences, and whether you want us to fix the findings as well. Mito has plans for single businesses and for IT partners managing several tenants. Contact us and we’ll suggest the right option.
Related: Microsoft 365 security best practices and checklist · Microsoft 365 security services in the UAE · Microsoft 365 migration · Mito
Talk to us
Tell us about your Microsoft 365 or Azure environment and what you want to achieve. We reply within 24 hours on business days.
Phone: +971 2 409 3026
Email: contactus@virtualpetals.com
Office: Level 36, Etihad Towers 3, Abu Dhabi, UAE
Branch: Chennai, India