Microsoft 365 Security Audit
Intrix delivers Microsoft 365 security audits for Australian organisations, reviewing every security-relevant setting across Azure AD, Exchange Online, SharePoint, Teams, Intune, Defender, and Purview. Identify misconfigurations and privilege escalation risks before attackers do.
Why Microsoft 365 Security Matters
Microsoft 365 is the backbone of most organisations’ productivity and collaboration. It holds your email, documents, identities, and business communications, making it a prime target for attackers. Default configurations are rarely secure enough for enterprise use
M365 accounts are high-risk attack targets
Data Exfiltration
Misconfigured sharing can expose sensitive data
Privilege Escalation
Excessive admin access and weak PIM increase risk
Shadow IT Integration
Unauthorised apps can access corporate data
Comprehensive M365 Audit Coverage
We examine every security-relevant setting across all M365 services
Azure Active Directory / Entra ID
Identity and access management configuration review
Conditional Access policy effectiveness
Guest access controls and policies
MFA enforcement and coverage gaps
Password policies and banned lists
Legacy authentication blocking
Sign-in risk policies
Privileged Identity Management (PIM)
Transport encryption (TLS)
Exchange Online
Email security and anti-phishing configuration
Mail flow rules review and risks
External forwarding rules audit
Anti-phishing and anti-spam policies
Shared mailbox security
DMARC/DKIM/SPF configuration
Litigation hold settings
Mailbox auditing enablement
Transport encryption (TLS)
SharePoint Online & OneDrive
File sharing and collaboration security
External sharing settings review
Sensitivity labels implementation
Anonymous link policies
Version history settings
Site collection permissions audit
Sync client restrictions
Data Loss Prevention (DLP) rules
Guest expiration policies
Microsoft Teams
Channel creation policies
External federation settings
Private channel governance
App permissions and third-party integrations
Recording and transcription policies
Meeting security settings
Messaging policies review
Microsoft Intune / Endpoint Manager
Device management and mobile security
Device compliance policies
BitLocker and encryption enforcement
Conditional access integration
Windows Update for Business
App protection policies (MAM)
Endpoint detection and response
BYOD vs corporate device separation
Remote wipe capabilities
Microsoft Purview (Compliance)
Data governance and compliance controls
Data classification and labelling
Insider risk management
Retention policies configuration
Communication compliance
eDiscovery settings and access
Information barriers
Audit log retention (90 days vs extended)
Records management
What You'll Receive
Microsoft Secure Score analysis with improvement roadmap
Comparison against Microsoft security baselines
Executive summary with risk ratings
Configuration hardening recommendations by priority
Licence optimisation suggestions (E3/E5/add-ons)
Technical remediation guide with step-by-step instructions
Our Audit Process
1
Scoping
Define audit scope, obtain read-only admin access
2
Data Collection
Automated and manual configuration extraction
3
Analysis
Compare against baselines, identify risks
4
Reporting
Deliver findings with prioritised recommendations
Microsoft 365 Security Audit FAQ
Intrix provides Microsoft 365 security audits for Australian organisations, covering Azure AD, Exchange Online, SharePoint, Teams, Intune, Defender, and Purview. Audits identify misconfigurations, excessive admin privileges, external sharing risks, and business email compromise vulnerabilities. Contact Intrix on 1300 931 727 to schedule your audit.
What does a Microsoft 365 security audit cover?
A Microsoft 365 security audit covers Azure Active Directory and Entra ID including conditional access policies, MFA enforcement, guest access controls, and Privileged Identity Management; Exchange Online including DMARC, DKIM, SPF configuration, anti-phishing policies, and external forwarding rules; SharePoint and OneDrive sharing settings and DLP rules; Teams guest access and app permissions; Intune device compliance and endpoint security; and Purview data governance and retention policies.
What are the most common Microsoft 365 security risks?
The most common Microsoft 365 security risks are business email compromise through phishing attacks targeting user credentials, overly permissive SharePoint and OneDrive external sharing settings, legacy authentication protocols that bypass modern MFA, excessive global administrator accounts without Privileged Identity Management controls, and unauthorised third-party app integrations with broad permissions. Intrix identifies all of these during a comprehensive M365 security audit.
How long does a Microsoft 365 security audit take?
An Intrix Microsoft 365 security audit typically takes five to seven business days from read-only admin access being granted to delivery of the final report. The audit is entirely non-intrusive and conducted without impacting end user productivity. You receive a Microsoft Secure Score analysis, configuration hardening recommendations by priority, a technical remediation guide, and an executive summary with risk ratings.
Do we need a Microsoft E5 licence for a security audit?
No. Intrix conducts M365 security audits across E3, E5, and mixed licence environments. The audit includes licence optimisation recommendations that identify which E5 security features provide the highest value for your specific risk profile, helping you decide whether an E3 to E5 upgrade is justified. Some advanced security controls such as Defender for Identity and Purview Insider Risk Management require E5 licences, which Intrix documents clearly in the findings report.
How is a Microsoft 365 security audit different from a penetration test?
A Microsoft 365 security audit reviews configuration settings, access controls, sharing policies, and administrative security against Microsoft security baselines and best practices. A penetration test actively attempts to exploit vulnerabilities to simulate an attacker’s actions. Both are needed: an audit confirms settings are correctly configured, and a penetration test verifies those configurations hold up under real attack conditions. Intrix provides both services for Microsoft 365 environments.
Do I need a security audit if I already have Microsoft Defender?
Microsoft Defender provides threat detection and response capabilities but does not automatically configure your Microsoft 365 environment securely. Defender can alert you to threats but cannot fix misconfigured conditional access policies, overly permissive SharePoint sharing settings, or admin accounts without MFA. An M365 security audit reviews the configuration layer that Defender operates within, ensuring the underlying settings do not create exploitable gaps. Intrix audits both the Defender configuration and the broader M365 environment together.
What is Microsoft Secure Score and how does it help?
Microsoft Secure Score is a measurement of an organisation’s Microsoft 365 security posture based on completed security actions across identity, data, devices, and apps. A higher score indicates more security controls are in place. However, Secure Score rewards implementation of individual controls without assessing whether those controls are correctly configured or appropriate for the organisation’s risk profile. Intrix uses Secure Score as one input in an M365 security audit alongside manual configuration review and comparison against Microsoft security baselines.
Secure Your Microsoft 365 Environment
Don’t let default configurations put your organisation at risk. Get a
comprehensive security review of your M365 tenant.