Many businesses rely on Microsoft 365 for email, files and collaboration while third-party applications connect through Microsoft Entra ID. An unfamiliar application grant, an unnecessary administrator role or an overlooked sign-in setting can create access that is wider than the business intended.
This review answers a practical question: Which identity and application-access settings deserve attention first—and what evidence supports that decision?
Email to scope an identity review → · See what the review covers →
Who should consider this review?
- Small and medium-sized organizations using Microsoft 365 without a recent independent look at identity and app access.
- Teams that have added external SaaS tools, business automation or AI-connected applications that request Microsoft permissions.
- Businesses with multiple current or former administrators, third-party IT providers or uncertain ownership of application integrations.
- Agencies and managed service providers that need a bounded second opinion or a customer-ready remediation list.
A business that needs a full incident investigation, regulatory audit or broad Microsoft 365 hardening engagement should commission that scope instead.
What is included?
The introductory scope is one Microsoft 365 / Entra tenant, normally up to 150 users, with a closer review of up to ten customer-selected or risk-prioritized enterprise applications. Scope is confirmed before any work starts.
Identity and privileged access
- Review the documented state of administrator role assignments, emergency access arrangements and least-privilege practices.
- Examine available multifactor authentication and sign-in protection settings, including Security Defaults or Conditional Access where licensed.
- Identify stale, shared or third-party administrative access that warrants owner verification, based on evidence actually supplied.
Enterprise applications and consent
- Examine selected enterprise applications, service principals and OAuth permission grants, distinguishing delegated from application permissions.
- Flag grants with potentially broad access to mail, files, directory data or administrative APIs for business-owner validation.
- Review user-consent restrictions, administrator-consent procedures, and ownership of selected integrations.
- Record application credential lifetime or renewal concerns only when relevant evidence is available; no secrets are collected.
Visibility and operational follow-through
- Interpret relevant Microsoft Secure Score / Entra recommendations as starting evidence, not a security certification or comprehensive verdict.
- Check whether available sign-in/audit information and access-review processes support ongoing oversight.
- Separate issues that can be fixed with existing settings from those requiring additional licenses, operational changes or deeper investigation.
How the engagement works
- Confirm scope. Identify the tenant, license mix, approximate user count, responsible administrator, selected applications and business concerns. Agree the evidence and confidentiality arrangements.
- Review with the tenant owner. The preferred approach is a guided screen share and customer-generated, sanitized configuration evidence. No production changes or autonomous scanning are included.
- Document and prioritize. Record observed configuration, business impact, recommended action, responsible owner and items that remain unverified.
- Handover. Provide the findings and discuss the order in which the current IT team or a separately engaged implementer could address them.
A typical review is planned for three to five business days after the agreed inputs are available, subject to access, cooperation and scope.
What you receive
- Executive findings summary in plain language, separating confirmed observations from assumptions.
- Identity and application-access inventory for the explicitly reviewed items and evidence sources.
- Prioritized risk and remediation register with severity rationale, affected settings or apps, recommended owner and next action.
- Quick wins versus planned changes, including likely licensing or coordination dependencies.
- Findings handoff, up to 30 minutes, to support the customer's administrator or existing provider.
The deliverable is a bounded decision document, not an assertion that all tenant weaknesses have been found.
Access, privacy and limitations
The customer stays in control of the tenant. Do not email passwords, bearer tokens, client secrets, raw mailbox data or confidential documents. We can start with a tenant description and a list of concerns. Any configuration exports should be minimized, redacted and exchanged through an agreed secure channel; retention and deletion terms should be set before sharing.
Direct access is not required by default. If the customer elects to provide it, permissions must be explicitly authorized, least-privileged, time-limited and revocable. Microsoft role and API restrictions mean that some application permissions and privileged settings may need a customer administrator to demonstrate them; those controls will be marked unverified if evidence is unavailable. No tenant modifications, credential testing, phishing, exploitation or automated penetration testing are included. This is not Microsoft accreditation, partner certification or compliance attestation.
Technical basis
The approach is informed by primary documentation, including Microsoft's security operations guidance for enterprise applications, app-permission review guidance, Microsoft Secure Score, and CISA's SCuBA assessment project. These are reference sources, not endorsements. Official configuration tooling is available to tenant administrators independently of this service.
Request a scoped review
Email hello@360it.pro with your approximate number of users, Microsoft 365 subscription, number of connected business applications and the concern prompting the review. Do not send sensitive tenant information in your first email.
The initial conversation confirms fit, scope and a private fixed-price proposal. Remediation or deeper testing, if useful, is quoted separately.
Common questions
Is this a full Microsoft 365 security audit or penetration test?
No. It is a focused, evidence-based review of identity configuration and selected application permissions in one tenant. It excludes penetration testing, threat hunting, comprehensive email or endpoint configuration audits, formal compliance certification, and any security guarantee.
Will you need Global Administrator access or our passwords?
No Global Administrator account, password, token or client secret is requested. The default approach is a customer-admin-led screen-sharing session with sanitized evidence. If direct access is separately justified, the client must approve the exact minimum read-only roles and time-limited access. Some settings cannot be verified with reader permissions alone.
Does this require Microsoft Entra ID P1 or P2?
No particular premium license is required to discuss the baseline controls, but Conditional Access, access reviews and some security reports depend on the tenant's subscriptions. The review distinguishes available, unavailable and unverified controls and never assumes a feature is licensed.
Can an existing Microsoft 365 provider participate?
Yes. The review can be coordinated with the organization's administrator, managed IT provider or internal security team. Findings and implementation priorities are intended to be usable by the team already responsible for the tenant.