Run by Andy Kemp Consulting · Live
Microsoft 365 Tenant Audit
A read-only review of your Microsoft 365 tenant, run by Andy Kemp Consulting. Around 50 checks across identity, privileged access, apps, Exchange, devices and collaboration, turned into scored findings mapped to recognised frameworks.
Read-only by design
Nothing in your tenant is changed
The audit uses read-only Microsoft Graph permissions, so it cannot modify users, policies or settings. Nothing is installed and no agents are deployed.
Andy Kemp Consulting runs the audit for you. You approve access on Microsoft's own consent screen, and you stay in control of when it ends.
How it works
- 1
Request
Fill in the form at audit.andykemp.com with your organisation and tenant details.
- 2
Approve read-only access
You receive a custom link. Sign in to your own Microsoft Entra tenant and approve the read-only permissions on Microsoft's consent screen.
- 3
Audit
Once access is approved, Andy Kemp Consulting runs the audit against your tenant.
- 4
Report
You receive a high-level report of the findings when the audit completes.
- 5
Remove access
Once the audit is complete, delete the app registration that was created in Microsoft Entra ID. This is your responsibility as the tenant owner, and you can remove it at any time.
Prefer to set up the permissions yourself?
If your organisation doesn't allow one-click consent, your security team can create the app registration and assign the read-only permissions manually. There is a documented process for this, and we will work with you to get it set up.
Need more depth?
A high-level report is provided when the audit completes. If you want something deeper, such as detailed remediation guidance, a full roadmap or a walkthrough with your team, we can discuss scope and commercials.
Discuss a deeper review →What it checks
Findings are mapped to recognised frameworks, including Cyber Essentials, the NCSC Cyber Assessment Framework and the CIS Microsoft 365 Foundations Benchmark.
Identity & access
Conditional Access, MFA registration, authentication methods, security defaults
Privileged access
Directory and PIM role assignments, standing admin access, break-glass accounts
External exposure
Guests, cross-tenant access, SharePoint and OneDrive sharing, stale accounts
Apps & consents
App registrations, enterprise apps, OAuth grants, expiring secrets, over-privileged apps
Exchange Online
Delegation, forwarding, inbox rules, transport rules
Devices, data & collaboration
Intune and app protection, sensitivity labels, retention, Teams and groups
Licensing & readiness
Licence usage and migration complexity for tenant moves
Ready to audit your tenant?
Fill in the request form and you'll receive your custom consent link.