Microsoft 365 security audit for MSPs: the settings to check at client onboarding

A Microsoft 365 security audit for MSPs should check five things in every new tenant before you accept responsibility for it: MFA coverage per user, whether legacy authentication is still allowed, who holds admin roles, which mailboxes forward mail externally, and which licences are paid for but unused. Run them in the same order every time, record the evidence, and report the findings to the client in plain language with a remediation plan. Here is that audit, item by item.

Why the onboarding audit matters more than the contract

The moment a client signs, every weakness in their tenant becomes yours in the client's eyes. If a director's mailbox was quietly forwarding invoices to a stranger for months before you arrived, you want a dated record showing you found it, not a client who assumes you caused it.

That is the real job of the onboarding audit: a baseline. It protects the client, it protects you, and it turns a vague "we will look after your Microsoft 365" into a list of specific, priced pieces of work. Whether the tenant belongs to a client or to your own company, the checks are the same.

The five checks in a repeatable Microsoft 365 audit

1. MFA coverage, user by user

"MFA is on" is the least useful sentence in IT. The question is which accounts can sign in without a second factor, and why.

• Find the method of enforcement. Security defaults, Conditional Access policies or legacy per-user MFA each behave differently, and tenants that have been through several admins often have a mix. Note which is in force.
• List every account that is excluded. Break-glass accounts are a legitimate exclusion. A shared reception mailbox someone signs into with a password is not.
• Check registration, not just policy. The Entra ID authentication methods report shows who has actually registered a method. A policy that requires MFA for users who never registered it is a policy waiting to be bypassed.

Skip this and you will spend the first month assuming coverage that does not exist.

2. Legacy authentication

Legacy protocols such as basic-auth IMAP, POP and older SMTP sign-ins cannot do MFA, which makes them the side door around everything in check one. Microsoft has retired basic authentication for most Exchange Online protocols, but authenticated SMTP submission and old app integrations still turn up.

Look at the Entra sign-in logs filtered by client app for anything other than modern clients, then check whether a Conditional Access policy blocks legacy authentication outright. Expect to find a scanner or a line-of-business app emailing through SMTP AUTH. Document it, then plan its replacement rather than breaking it on a Friday.

3. Admin roles and who holds them

Small organisations accumulate Global Administrators the way lofts accumulate boxes: each one went up for a sensible reason and nobody remembers what it was.

• Count the Global Admins. Microsoft recommends fewer than five. Most small clients need two: a break-glass account and a named admin.
• Remove admin rights from daily accounts. Admins should use separate privileged accounts, not the one they read email in.
• Review partner relationships. Old delegated admin privileges from a previous provider are common. Remove what you cannot account for and use granular delegated admin (GDAP) for your own access, scoped to the roles you need.

The departure test: for every admin account, ask who would notice if that person left tomorrow. If the answer is nobody, the account should not exist.

4. Mailbox forwarding and inbox rules

A forwarding rule to an external address is one of the most common signs that a mailbox has already been compromised, because it lets an attacker read mail after the password is changed.

• Check mailbox-level forwarding. In Exchange Online PowerShell, Get-Mailbox -ResultSize Unlimited | Where {$_.ForwardingSmtpAddress} finds the obvious ones.
• Check inbox rules too. Get-InboxRule run per mailbox catches rules that forward, redirect, delete or move messages to obscure folders such as RSS Feeds.
• Check the outbound policy. The outbound spam filter policy controls whether automatic external forwarding is allowed at all. Defaulting it to off and allowing named exceptions is the sensible stance.

Any rule nobody can explain is treated as an incident, not a tidy-up item.

5. Licence waste

Licence waste is a security finding as well as a cost one. Licensed accounts for departed staff are live identities with mailboxes nobody watches.

Export assigned licences with last sign-in dates. Flag accounts with no sign-in for 90 days, licensed shared mailboxes that do not need a licence, and users on a premium tier who use none of its features. Convert leavers' mailboxes to shared or remove them under the client's retention policy. The saving often helps pay for the remediation work, which makes the conversation with the client easier.

Running the audit across many tenants

One tenant by hand is fine. Thirty by hand is a week, and the results will differ depending on who ran them. Standardise:

• Script the collection. The same PowerShell or Graph queries for every tenant, output to the same columns.
• Use a fixed template. Each check gets a status of pass, fail or accepted risk, with evidence attached.
• Re-run it. The onboarding audit becomes a quarterly or continuous check, because a tenant that was clean in March drifts by June.

Multi-tenant tools help here. Our comparison of Microsoft 365 management tools for MSPs covers Lighthouse, CIPP and the rest, and the piece on watching the tenant, not just the endpoint explains how to keep the audit live after onboarding.

Reporting findings to the client

A forty-row spreadsheet of red cells is a report nobody reads. Structure it in three layers:

1. One page for the decision-maker. The three or four findings that matter, in business terms: "Two former staff can still read company email" lands better than "stale licensed identities".
2. A remediation plan. Each finding with its fix, who does it, the disruption to expect and whether it is in scope or chargeable.
3. The evidence appendix. Exports and screenshots for your records and anyone who asks.

Ask the client to sign off any finding they choose not to fix. An accepted risk with a signature is a decision. An unrecorded one is a liability wearing a client's name.

Where this fits with Helios

Most of this checklist is discipline, not tooling: deciding the checks, holding the order and reporting honestly. Helios includes Microsoft 365 and Defender monitoring alongside its RMM and PSA, so tenant findings can sit next to tickets, documentation and time for the same client, and the remediation work becomes billable records rather than notes. Its AI technician, Helio, can investigate alerts and act within plain-English rules your technicians set, which suits re-running checks between quarterly reviews. If you are weighing it up, the Helios pricing page sets out the cost by fleet size, with every feature on every plan.

Common questions about Microsoft 365 security audits

How long does a Microsoft 365 security audit take per tenant?

A Microsoft 365 security audit for a small tenant usually takes a few hours when the queries are scripted and the template is fixed, and considerably longer by hand. The variable is investigation: an unexplained forwarding rule or admin account adds time, because each one needs following up with the client before you can mark it resolved.

Should I fix Microsoft 365 issues before the client signs off the report?

Fix genuine compromises immediately, such as an external forwarding rule nobody can explain, and record what you did. Everything else waits for the client to agree the remediation plan, because changes like blocking legacy authentication or removing admin rights can break workflows the client depends on, and they should know before it happens.

Does the onboarding audit replace ongoing Microsoft 365 monitoring?

No. The onboarding audit is a baseline taken on one day, and Microsoft 365 tenants drift as staff join, leave and install apps. Ongoing monitoring of sign-ins, admin role changes and new forwarding rules catches problems between audits, while repeating the full checklist quarterly confirms nothing has slipped through the alerts.

Researched and written with Helio SEO, our AI writer for business blogs.