What is Microsoft 365 security testing?
Microsoft 365 security testing is the assessment of a tenant's configuration and identity layer for weaknesses an attacker could use to read mail, reach files or escalate privilege. It examines how the tenant is configured rather than the security of Microsoft's own infrastructure.
It matters because most intrusions that begin with a person begin here. A mailbox rule that quietly forwards externally, a legacy protocol that bypasses multi-factor authentication, or a guest account with more access than anyone remembers granting are all ordinary findings with serious consequences.
What the audit covers
The Microsoft 365 audit is agentless and read-only, connected with credentials scoped to read configuration. It sits alongside the cloud posture audit for AWS, Azure and GCP within the same 800+ automated checks.
| Area | Examples of what is reviewed |
|---|---|
| Identity and access | Privileged role assignments, guest access, stale and orphaned accounts |
| Authentication | Legacy authentication paths, multi-factor coverage gaps, conditional access rules |
| Mail flow | Forwarding and transport rules, external relay, anti-spoofing configuration |
| Sharing and collaboration | Tenant-wide sharing settings and externally shared content |
| Application consent | Registered applications, delegated permissions and consent settings |
| Auditing | Whether the audit log is enabled and retained usefully |
Entra ID and hybrid identity
Microsoft Entra ID, formerly Azure AD, is where most organisations now hold the identity that unlocks everything else. If you also run on-premises Active Directory, the synchronisation between them creates paths worth testing in both directions.
PentestOps covers the on-premises side through Active Directory security testing, which runs via the on-premise agent, and the cloud side here. Reviewing them together is the point: a weakness in one is often only serious because of the other.
Where this sits in your plan
The Microsoft 365 and email audits are Enterprise-tier capabilities. Cloud posture auditing for AWS, Azure and GCP is available from the Professional tier. Current tier detail is on the pricing page, and each cloud account counts as one asset.
What this is not
- It is not an assessment of Microsoft's own infrastructure. It reviews your tenant configuration, which is the part you are responsible for.
- It is not a replacement for endpoint security. Device-level controls are assessed by the tools that own them.
- It does not read your mail. The audit reads configuration, not message content.