How to run a Microsoft 365 security audit yourself

A Microsoft 365 security audit answers two questions at once: is the tenant configured to resist the attacks that actually happen, and are you paying for licences nobody uses. Most UK SMEs have never had either question answered properly, because their IT provider sells licences and their auditor does not open the Microsoft 365 admin centre.

You can do a credible first pass yourself in an afternoon. Here is the order that works.

1. Pull your licence position. Microsoft 365 admin centre → Billing → Your products. Export assigned versus purchased seats for every SKU, including add-ons bought years ago that nobody has looked at since.
2. Find the dormant seats. Reports → Usage → Active users. Anything with no interactive sign-in in 30 days needs a decision; at 90 days it is almost certainly reclaimable.
3. Check the identity controls. In the Microsoft Entra admin centre, confirm multi-factor authentication is enforced for everyone, that legacy authentication is blocked, and count how many accounts hold the Global Administrator role.
4. Read your Conditional Access exclusion lists. Not the policies — the exclusions. That is where the temporary carve-out from a 2023 project is still sitting.
5. Confirm you have a backup. Microsoft’s shared responsibility model makes your content your problem. If the only answer is “retention policies”, you do not have a backup.
6. Score it and price it. Run the calculator at the top of this page. It weights the controls, converts the licence findings into an annual figure, and shows the arithmetic behind each one.

If the result says the problem is real but you have nobody to own it, that is what our fractional CIO and IT consulting services exist for. If you would rather have the tenant measured properly than estimated, see the fixed-price Microsoft assessments.

Microsoft 365 security audit checklist: the 14 controls

Microsoft Secure Score rewards roughly 200 settings, most of which will never appear in an incident report. This Microsoft 365 security checklist scores fourteen. Each was chosen because it either shows up repeatedly as the root cause of real Microsoft 365 compromises, or because a UK regulator, cyber insurer or enterprise client will ask you to evidence it in writing.

The number beside each control is its weight out of 98. A control scores full marks for “yes”, half for “partial” and nothing for “no”.

• 10
  Multi-factor authentication enforced for every userNot “available”, not “for admins” — enforced tenant-wide, including service accounts and shared mailboxes with sign-in enabled. Microsoft is now mandating MFA for admin centre access, and password-only accounts remain the single most common entry point in business email compromise.
• 9
  Phishing-resistant MFA for privileged accountsPasskeys, FIDO2 keys or Windows Hello for Business for anyone holding an admin role. SMS and push-approval codes are both defeated by real-time phishing proxies, and SMS is being retired as an Entra ID method.
• 8
  Legacy authentication is blockedIMAP, POP, SMTP AUTH and older Office clients bypass Conditional Access, and therefore bypass MFA entirely. Microsoft’s own analysis attributes the overwhelming majority of password-spray and credential-stuffing attacks to legacy protocols. While legacy auth is open, every identity control above it is advisory rather than enforced.
• 8
  Conditional Access governs risky sign-insPolicies that respond to device compliance, location and sign-in risk. This is the control that turns a stolen password into a blocked login rather than a mailbox rule quietly forwarding your invoices.
• 7
  Global Administrator accounts are few, named and dedicatedFour or fewer, no shared credentials, no day-to-day mailbox on an admin account, and break-glass accounts stored offline. Most tenants we assess carry between eight and twenty Global Admins, usually because a previous MSP left theirs behind.
• 7
  Defender for Office 365 is active and tunedSafe Links and Safe Attachments switched on for mail, Teams and SharePoint, with impersonation protection naming your directors and finance team. Since July 2026 this is bundled into E3 and Business Premium, so a great many firms own it and have never enabled it.
• 7
  An independent backup protects Microsoft 365 dataMicrosoft’s shared responsibility model covers the platform, not your content. Retention policies and the recycle bin are not a backup. Ask any firm that has recovered from ransomware whether third-party backup was worth £3 per user per month.
• 7
  Data Loss Prevention covers client, personal and financial dataDLP policies across Exchange, SharePoint, OneDrive and Teams that actually block or warn, rather than sitting in audit-only mode since the pilot. This is the control that fails hardest under UK GDPR and SRA confidentiality scrutiny — and the ICO’s 72-hour reporting clock starts whether or not you noticed.
• 6
  Just-in-time privileged accessPrivileged Identity Management, so admin rights are activated for a window with justification and an approval trail rather than held permanently. DORA’s ICT risk requirements point squarely at this.
• 6
  Unified audit logging is on, with retention that meets your rulesDefault audit log retention is often shorter than the window you would need to reconstruct an incident, and shorter than FCA record-keeping expectations. You cannot enable a log retrospectively.
• 6
  External sharing and guest access are governedAnonymous “anyone with the link” sharing disabled or expiry-bound, guest accounts reviewed on a schedule, and a named owner for every SharePoint site. Sharing sprawl is how data leaves quietly, without anyone attacking anything.
• 6
  Devices are enrolled and compliance is enforcedIntune enrolment with policies that check encryption, patch level and antivirus state, plus a Conditional Access rule that refuses non-compliant devices. Enrolment without enforcement is inventory, not security — and device management is one of the five Cyber Essentials control areas.
• 6
  The incident response plan has been tested this yearA written plan naming who declares an incident, who calls the insurer, who talks to the regulator and within what deadline — rehearsed at least once. Operational resilience rules judge you on the rehearsal, not the document.
• 5
  Leavers lose access, sessions and tokens within 24 hoursDisabling the account is not enough if refresh tokens stay valid and the licence stays assigned. This is where the security audit and the cost audit meet: the seats you never reclaimed are the identities you never revoked.

Closing these is the substance of our Microsoft 365 security hardening engagement — same checklist, done rather than scored.

Microsoft 365 cost optimisation: the six places money leaks

Across the tenants Innoligo has assessed, reclaimable Microsoft 365 spend clusters into six patterns. The calculator tests for all six. They are listed roughly in order of how much money each usually represents.

1. Over-provisioned licence tiers

The largest single line, almost every time. Someone buys Microsoft 365 E5 for the whole company because the security team needed Defender for Endpoint Plan 2 for thirty people. The gap between E5 and E3 is £18.10 per user per month — £217.20 a year, per person, for features nobody opens. The same logic applies one tier down: under 300 staff, Business Premium carries most of what a typical knowledge worker needs from E3 at roughly half the price.

2. Add-ons you already own

The quietest waste and the easiest to fix. Entra ID Plan 1 is included in Business Premium and both Microsoft 365 E3 and E5, yet firms routinely still carry standalone Entra P1 seats bought before they moved to a bundle. From July 2026, Defender for Office 365 Plan 1 and additional Intune capability moved into E3, and Security Copilot capacity and advanced Intune management moved into E5. Buy any of those separately today and you are about to start paying twice. The add-on step of the calculator matches every add-on against the suites you hold and flags the overlap automatically.

3. Inactive and orphaned licences

Leavers, ended projects, contractors, test accounts, mailboxes inherited from an acquisition. Each one is both a cost line and a live identity. Unused Microsoft 365 licences are the rare finding that improves the security score and the P&L in the same action.

4. Copilot seats nobody uses

Microsoft 365 Copilot is the fastest-growing line on UK SME Microsoft bills and by far the least measured. A seat generating three prompts a week is not adoption, it is a subscription. Measure usage per seat, reassign rather than renew, and treat Copilot as a pool that follows real use. Getting that adoption right is its own discipline — see our AI and Copilot adoption work.

5. Month-to-month billing on a stable headcount

Buying without an annual commitment costs roughly 20% more per seat. That premium is worth paying for genuinely seasonal headcount. It is not worth paying on the core of a business whose staffing has been flat for three years. The usual answer is a hybrid: annual term on the stable base, month-to-month on the fluctuating margin.

6. Frontline workers on desktop suites

Shop-floor, warehouse, clinical and shift staff who need email, Teams and web apps on a shared device rarely need a full desktop suite. Microsoft 365 F3 exists for exactly this population. The saving is modest per head and material at scale — and it needs the most care, because F-plans genuinely do less.

If you want this fixed rather than measured, that is our Microsoft 365 and Azure cost optimisation service.

Microsoft 365 E3 vs E5: what you actually pay for

The most common licensing question we get from UK SMEs, and the one with the most expensive wrong answer. At UK list prices from July 2026, Microsoft 365 E5 costs £51.60 per user per month against £33.50 for E3 — £619.20 versus £402.00 a year. Over 100 people that difference is £21,720 annually.

What the extra buys, in plain terms:

• Entra ID Plan 2 — Identity Protection risk signals, access reviews, and Privileged Identity Management. If you want just-in-time admin rights, this is the line item that provides it.
• Defender for Endpoint Plan 2 — full endpoint detection and response with automated investigation, rather than the antivirus-plus baseline in Defender for Business.
• Defender for Office 365 Plan 2 — threat hunting, attack simulation training and automated remediation on top of the Plan 1 Safe Links and Safe Attachments now bundled into E3.
• Purview advanced compliance — eDiscovery Premium, Insider Risk Management, Communication Compliance and advanced auditing.
• Power BI Pro and Teams Phone — genuine value if you use them, dead weight if you do not. Check before you count them as justification.

The decision rule we apply: E5 is worth it for the users who generate the risk or hold the sensitive data, and rarely worth it for everyone else. A mixed estate — E5 for the executive team, finance, IT and anyone handling client money; E3 or Business Premium for the rest — is almost always cheaper and no less defensible to a regulator. Neither the FCA nor DORA names a licence; both describe outcomes. An unconfigured E5 tenant scores worse in this assessment than a well-run Business Premium one, and costs three times as much.

Microsoft 365 licensing audit: a worked example

An FCA-regulated wealth manager in the South East. 120 mailboxes, licences bought in three waves over five years by two different IT providers — which is to say, a completely ordinary tenant. Every figure uses the July 2026 UK list prices.

Now the five findings, with the arithmetic in full.

That is 32.6% of the licence bill, which is higher than typical — we deliberately picked a messy tenant. The range we normally find in a UK SME is 12% to 22%. Anything above 30% usually means two providers have been buying licences without talking to each other, which is exactly what happened here.

The other side of the ledger

The same firm scored 46 out of 100 on the security controls: MFA enforced but not phishing-resistant for admins, legacy authentication still open for a line-of-business application, no third-party backup, DLP in audit-only mode, and eleven Global Administrators. Model five days of disruption from a business email compromise that reaches finance:

• Lost productivity: 120 people × £290 loaded day rate × 5 days = £174,000
• Revenue impairment: £14m ÷ 260 trading days × 5 days, trading at 60% = £107,692
• Response, forensics, legal and notification: £25,000 + (120 × £150) = £43,000
• Modelled cost of one incident: ≈ £325,000

The point is not the precision of £325,000 — it is a scenario, not a forecast. The point is the ratio. Licence savings of £19,656 a year fund the entire remediation programme and a verified audit several times over, before a single pound of new budget is requested. That is the argument that gets signed off, and it is why this page calculates both halves rather than only the frightening one. The government’s annual Cyber Security Breaches Survey is a useful sense-check on how often UK businesses of your size actually experience this.

Microsoft 365 price list UK 2026

Microsoft’s 2026 commercial price increase took effect on 1 July 2026 and raised list prices across most Microsoft 365 and Office 365 suites. It applies globally, including the UK and the Eurozone, and reaches existing customers at their next renewal rather than immediately mid-term. The figures below are the per-user, per-month UK list prices the calculator uses as defaults. All exclude VAT, and CSP or volume pricing may differ from list. Microsoft publishes current retail figures on its own UK Microsoft 365 pricing pages.

Three things worth knowing before your next renewal. First, the increases are not uniform: Business Premium and Office 365 E1 stayed flat, while the steepest percentage jumps landed on the lower-cost frontline plans rather than the flagship enterprise suites. Second, Microsoft reviews GBP and EUR pricing against the US dollar roughly twice a year and adjusts local list prices independently of any global change, so a UK renewal quote can carry both the July increase and a separate currency adjustment. Third, Enterprise Agreement volume-tier discounts were removed in late 2025, flattening large accounts to list pricing at their next renewal — which for some estates pushes the real increase well past the headline percentage.

Microsoft 365 Copilot was not part of the July 2026 update. The calculator uses £24.70 per user per month as an indicative figure; adjust it to your own agreement.

Microsoft 365 compliance requirements by sector

The controls barely change between sectors. What changes is who asks, how hard, and what evidence they will accept.

Financial services — FCA and DORA

SYSC expects proportionate systems and controls, and the FCA’s operational resilience regime expects you to have identified important business services, set impact tolerances and tested that you can stay within them. For EU-facing firms, DORA adds explicit ICT risk management, incident reporting deadlines and third-party oversight duties. In Microsoft 365 terms: Conditional Access, privileged access management, audit log retention that survives an investigation, and a tested incident plan naming who reports to whom and when.

Legal — SRA

Client confidentiality under the SRA Standards and Regulations is the hinge. Anonymous SharePoint links, guest accounts never reviewed, and DLP left in audit-only mode are the three findings that become a reportable event fastest. Firms handling client money should also expect their PII insurer to ask specifically about MFA coverage and email impersonation protection.

Healthcare — NHS DSPT

The Data Security and Protection Toolkit is an annual self-declaration with real consequences for supplier status. Its expectations map closely onto the identity and device controls above, and it is unusually explicit about leaver processes and audit logging.

Manufacturing, logistics and energy — NIS2

If you supply into EU essential-services sectors, NIS2 pushes accountability up to management level and requires supply chain security measures. Boards are personally in scope, which changes who signs off remediation. This is the ground our UK–EU compliance and resilience work covers.

Everyone else — Cyber Essentials and UK GDPR

Cyber Essentials is increasingly a condition of winning enterprise and public-sector work rather than a nice-to-have. Its five control areas map almost one-to-one onto the first six items in this assessment, and certification runs through the NCSC’s delivery partner IASME. If you cannot answer “yes” to MFA, legacy authentication and device management, certification will not pass.

Free self-assessment vs a verified Microsoft 365 audit

This tool is honest about its limits. It scores what you already know. A verified audit measures what you do not.

Innoligo delivers these as fixed-price Microsoft assessments with UK-registered delivery partners agreed with you before signoff. If the finding is that you need someone to own this permanently rather than fix it once, that is a fractional CIO conversation instead. Recent examples are in our case studies.