Blog
Field notes from an M365 auditing team.
Practical guides, benchmark explainers, and security playbooks for Microsoft 365, Entra ID, Exchange, Teams, SharePoint and Defender.
2026-10-19
How to Audit Microsoft 365 Security: Step-by-Step Guide for MSPs
A practical, repeatable process for auditing Microsoft 365 and Entra ID security — covering identity, admin roles, email, data, and licensing — built for MSPs who need consistent results across clients.
2026-10-18
Microsoft 365 Security Audit: CIS Benchmark vs. EIDSCA vs. SCUBA — Which Standard Should Your MSP Follow?
A practical comparison of the CIS Microsoft 365 Benchmark, EIDSCA, and CISA SCUBA for MSPs running tenant security audits — what each covers, where they overlap, and how to choose.
2026-09-22
Open Source Microsoft 365 Security Tools: ORCA, EIDSCA, and More
A roundup of the free, open-source tools and baselines for Microsoft 365 security — what each one does, and how they fit together into a real audit.
2026-09-15
GDPR, HIPAA, ISO 27001: Mapping Microsoft 365 Controls to Compliance Frameworks
Compliance frameworks don't prescribe a tool — they require evidence. Here's how Microsoft 365 configuration controls map to GDPR, HIPAA, and ISO 27001.
2026-09-08
Privileged Role Sprawl in Entra ID: Finding Stale Admin Accounts
Standing admin accounts are a top risk in every framework. Here's how to audit privileged roles, find stale admins, and move to just-in-time access.
2026-09-01
How Often Should You Audit Microsoft 365? (And Why Annual Isn't Enough)
Annual audits miss most of the year's drift. Here's a practical cadence for Microsoft 365 security auditing, by tenant size and change rate.
2026-08-25
Is Your Microsoft 365 Tenant Ready for Copilot? A Security Pre-Check
Copilot surfaces whatever a user can access. Before you roll it out, audit the permissions, sharing, and identity config it will expose.
2026-08-18
SharePoint and OneDrive Oversharing: How to Audit Permission Sprawl
Oversharing in SharePoint and OneDrive is a top audit finding — and Copilot makes it urgent. Here's how to audit permission sprawl and link defaults.
2026-08-11
Legacy Authentication in Microsoft 365: How to Find and Kill It in 2026
Legacy authentication bypasses MFA entirely. Here's how to find it, block it safely, and prove it's gone — without breaking legitimate mail clients.
2026-08-04
Auditing Guest Access and External Sharing in Microsoft 365
Guest accounts and external sharing are a top-3 risk domain. Here's how to audit who can get in, what they can reach, and where the defaults leave you exposed.
2026-07-28
Entra ID Risky Sign-Ins: How to Audit and Reduce False Positives
Risky sign-ins are high-signal on paper and noisy in practice. Here's how to audit your risk configuration and cut alert fatigue without weakening security.
2026-07-21
How to Build a Client-Ready Microsoft 365 Security Report (Free Template)
Raw scan output isn't a deliverable. Here's how to structure a client-ready Microsoft 365 security report — sections, severity, and remediation — plus a sample.
2026-07-14
The MSP's Guide to Auditing Microsoft 365 Across Multiple Client Tenants
How MSPs and MSSPs can audit Microsoft 365 across many client tenants without running PowerShell by hand or paying per-seat for clients they rarely touch.
2026-07-07
A Complete Guide to Microsoft 365 Conditional Access Policy Auditing
Conditional Access is the most important control plane in Entra ID. Here's how to audit your existing policies for coverage gaps, broad exclusions, and drift.
2026-06-30
Message/Email Compliance Auditing in Microsoft 365: A Practical Guide
A practical guide to auditing email and message compliance in Microsoft 365 — mail flow, external forwarding, mailbox auditing, DLP, and retention.
2026-06-23
How to Run a Continuous Microsoft 365 Security Audit (Not Just a One-Time Checklist)
A one-time Microsoft 365 audit is a snapshot. Continuous auditing turns it into an ongoing record — which is what auditors and clients actually expect.
2026-06-16
Microsoft Secure Score Is Not a Security Audit — Here's the Gap
Secure Score is a useful metric, but it's not an audit. Here's what it measures, what it misses, and why auditors ask for something else.
2026-06-09
ORCA vs EIDSCA vs Manual Secure Score Reviews: Which Should You Use?
ORCA, EIDSCA, and Secure Score each look at a different slice of Microsoft 365. Here's what each is good for and why most teams end up needing all three.
2026-06-02
CIS Microsoft 365 Foundations Benchmark: A Practical Walkthrough
A practical guide to the CIS Microsoft 365 Foundations Benchmark — what it covers, which controls to tackle first, and how to audit against it.
2026-05-26
CISA SCuBA for Microsoft 365: What It Is and How to Run It
CISA SCUBA is the US government's secure configuration baseline for Microsoft 365. Here's what it covers, how to assess against it, and what it demands.
2026-05-19
EIDSCA Explained: What the Entra ID Security Config Analyzer Checks
EIDSCA is an open-source Entra ID security configuration baseline. Here's what it checks, why identity config matters most, and how to run it.
2026-05-12
What Is ORCA for Microsoft 365? (And What It Doesn't Check)
ORCA is Microsoft's free Office 365 Recommended Configuration Analyzer. Here's what it checks, what it misses, and where a full audit picks up.