The M365 Audit You Can Run Before Calling a Consultant

Last month I published a post about the M365 security baseline most SMEs skip — the default tenant configuration that leaves businesses exposed because no one with security expertise has reviewed it since the initial migration.

That post explained what to check. This one gives you the tool to check it.

I built an open-source M365 Audit Toolkit and put it on GitHub. It is a set of read-only PowerShell modules that connect to your tenant using your credentials, interrogate the configuration, and produce a structured report of what is misconfigured, missing, or ranging beyond what you would reasonably accept. It does not change anything. It does not write data. It reads, evaluates, and reports.

And it is designed so that you can run it yourself — before you pick up the phone to a consultant.

Why a Self-Service Audit

Most UK SMEs operate in a state of confident uncertainty about their M365 tenant. The IT provider set it up. It works. Email flows. SharePoint files sync. Teams calls connect. Everything appears fine.

But “fine” is not a security posture. It is an absence of visible failure.

The problem is that the gaps in an M365 tenant are invisible until they are not. A compromised account exposes every SharePoint site the user can reach. A forgotten guest account with access to a shared folder persists indefinitely. A mailbox that has never been audited leaves no trail when something goes wrong. These gaps do not generate alerts. They do not appear in the admin console with a red warning icon. They sit quietly until a breach unmasks them, a subject access request forces you to find every piece of personal data in the tenant, or a client’s due diligence questionnaire asks questions you cannot answer.

I built the toolkit because the cost of a structured audit should not be a barrier to knowing where you stand. You should not need to engage a consultant just to find out whether your conditional access policies are configured, your admin roles are clean, or your retention policies align with your data retention schedule.

Run the audit first. Understand your gaps. Then decide whether you need help closing them.

What the Toolkit Covers

The M365 Audit Toolkit is modular. You can run the full audit or pick the modules relevant to your situation currently and build from there. At present it covers five areas.

Security Baseline Assessment. Checks MFA enforcement across all users, verifies that legacy authentication protocols is blocked, reviews conditional access policy configuration, mailbox auditing status, and DLP label deployment. This maps directly to the seven controls most SMEs skip.

Admin Role Hygiene. Identifies every global administrator in the tenant, flags accounts that should not hold that role, checks for service principal permissions that grant equivalent access, and reports on role-based access control adoption for other administrative functions. If your tenant has four, six, or eight global admins, this module will tell you exactly who they are and what they can do.

Guest Access Audit. Enumerates every external guest account in the tenant, what they can access, when they were last active, and whether access reviews are configured. This is the module that finds the former contractor who still has access to your shared folders three years after their engagement ended — which is more common than you would think.

SharePoint and OneDrive Governance. Reviews site-level sharing settings, detects externally shared content, checks for orphaned sites, and reports on storage allocation and versioning configuration. If you have ever wondered how much of your organisation’s data is sitting in personal OneDrive accounts that the business does not back up and cannot access, this module provides the answer.

AI Readiness Evaluation. Assesses your tenant’s readiness to adopt Copilot and other AI services safely — reviewing sensitivity label coverage, data loss prevention configuration, and access controls that would govern what an AI service can surface to users. This is increasingly relevant as Microsoft bundles Copilot into enterprise and business tiers.

How to Run It

The toolkit uses interactive MFA authentication, meaning it connects as you and inherits your permissions. It does not require app registrations, client secrets, or service accounts. If you have global reader access to the tenant, you can run the audit.

The general workflow:

1. Clone the repository from GitHub and review the modules.
2. Connect to your tenant using interactive browser-based MFA authentication.
3. Select the modules relevant to your assessment — security baseline, guest access, governance, AI readiness, or all of them.
4. Review the output as a structured summary showing what passed, what failed, and what needs attention.

The entire process can be completed in under an hour for a typical SME tenant. The output is a point-in-time snapshot — it does not persist data, and it does not leave artefacts in your tenant beyond the sign-in logs generated by your own authentication.

When to Call a Consultant

Running the audit yourself is the right first step. But there are situations where the findings will tell you that it is time to bring in expertise.

• The report is long and you do not know where to start. If every module returns significant findings, the remediation effort is material and benefits from prioritisation and sequencing — which is exactly what a structured engagement provides.
• You lack the permissions or authority to make changes. If the audit reveals that conditional access policies need to be reconfigured but your IT provider controls the tenant, the value of the report is in telling you exactly what to ask for and why.
• You are preparing for client due diligence, a cyber insurance application, or a regulatory review. The audit output gives you a factual baseline, but remediation may need to be documented, evidenced, and in some cases certified.
• You are adopting Copilot or other AI services. The AI readiness module will tell you where your gaps are, but closing them — sensitivity labels, access controls, DLP policies — is a project that benefits from experience doing it.

The point is not to avoid consultants. The point is to arrive at that conversation informed, with a clear picture of what needs to be done rather than starting from a blank page.

The Checklist Before You Pick Up the Phone

If you want to understand your M365 tenant before committing to an engagement, here is the minimum viable assessment:

• [ ] Run the security baseline module and resolve any critical MFA or conditional access findings
• [ ] Run the admin role module and reduce global administrators to two or three accounts
• [ ] Run the guest access module and revoke access for accounts no longer needed
• [ ] Review the SharePoint governance report for externally shared sites and orphaned content
• [ ] Review the AI readiness output if Copilot adoption is on your roadmap

If you can work through that list and resolve the findings, your tenant is in materially better shape. If you cannot, you now have a specific, evidenced brief for what needs to happen next.

The M365 Audit Toolkit is available now on GitHub. It is free, read-only, and built for exactly this use case.

If you run it and the findings warrant a conversation, the Security & Compliance Strategy service covers M365 tenant configuration as part of a broader engagement. Or get in touch with your report — I can tell you within a 30-minute call whether the gaps are ones you can close yourself or whether it is time to bring in support.