Microsoft 365 & Azure (Entra ID) Tenant Scan: Step-by-Step Security Assessment Guide
Run a Microsoft 365/Entra ID tenant scan step-by-step: Global Admin sprawl, Conditional Access gaps, app registration risks, DMARC, and Copilot oversharing.
Microsoft 365 & Azure (Entra ID) Tenant Scan: Step-by-Step Security Assessment Guide
TL;DR: A Microsoft 365/Entra ID tenant scan is a structured review of identity, access, email, and data protection settings across your Microsoft cloud environment to catch misconfigurations before attackers do. The highest-impact checks, in priority order: cap Global Administrator accounts at 2–4 people and move them off Conditional Access exclusion lists, enforce phishing-resistant MFA via Conditional Access (not just Security Defaults), block legacy authentication entirely, audit app registrations for over-permissioned Microsoft Graph API scopes, and confirm DMARC is set to enforce. Microsoft's built-in Secure Score is a strong starting point, but it measures configuration completeness — not whether those configurations are correct for your specific risk profile.
Microsoft Entra ID (formerly Azure Active Directory) sits at the center of identity for Microsoft 365, Azure resources, and every connected third-party application in most enterprise environments — which means a single Entra ID misconfiguration doesn't stay contained to one service. An excluded break-glass account with no monitoring, a Conditional Access policy that quietly doesn't apply to a specific app, an app registration that accumulated Microsoft Graph permissions during development and was never revisited after launch — each of these becomes a tenant-wide compromise pathway, not a narrow one.
This guide walks through running that review — a Microsoft 365/Entra ID tenant scan — from Microsoft's own built-in Secure Score through to the specific identity, email, and data settings that generate the most findings in real assessments.
What Is a Microsoft 365/Entra ID Tenant Scan?
Definition: A Microsoft 365/Entra ID tenant scan is a systematic security assessment of a Microsoft cloud tenant's identity configuration (Conditional Access, MFA, privileged roles), application registrations and API permissions, email security settings, data protection policies, and device compliance — performed through the Microsoft 365 admin center, the Entra admin center, and Microsoft Secure Score, or via automated CSPM/SSPM tooling. The objective is finding access and configuration risk that exists independently of any software vulnerability, since the overwhelming majority of real-world Microsoft 365 incidents trace back to identity and configuration gaps rather than a flaw in Microsoft's platform.
"Tenant" refers to your organization's dedicated instance of Microsoft Entra ID and Microsoft 365 — the isolated directory, users, and configuration specific to your organization, distinct from Microsoft's shared underlying cloud infrastructure. Securing that tenant configuration is your responsibility under Microsoft's shared responsibility model, regardless of how secure Microsoft's own infrastructure is rated.
Manual Review vs. Microsoft Secure Score vs. Third-Party CSPM/SSPM
| Manual Portal Review | Microsoft Secure Score | Third-Party CSPM/SSPM | |
|---|---|---|---|
| Setup time | None — built into every tenant | None — built into every tenant | Requires connecting via API/app registration |
| What it measures | Whatever you choose to check | Configuration completeness against Microsoft's recommendations | Configuration + drift + often cross-cloud correlation |
| Reflects your specific risk profile | Yes, if reviewer has context | Partially — generic scoring, not context-aware | Often yes, with customizable risk weighting |
| Detects configuration drift | No — point in time only | No — reflects current state at each login | Yes — continuous monitoring |
| Covers app registration permission sprawl | Only if manually reviewed | Partially | Typically yes, explicitly |
| Covers Conditional Access policy gaps/exclusions | Only if manually reviewed | Limited | Often yes, with "what-if" gap analysis |
| Cost | Free (admin time only) | Free (included) | Typically a paid subscription |
| Best for | Initial baseline, smaller tenants | Ongoing self-service tracking | Continuous posture management, regulated/larger orgs |
A meaningful nuance worth stating plainly: Secure Score measures whether recommended settings are turned on, not whether they're configured correctly for your environment. A tenant can show a strong Secure Score while still having a Conditional Access policy that quietly excludes a high-risk application, or a break-glass account with no monitoring attached — gaps a score alone won't surface.
How to Run a Microsoft 365/Entra ID Tenant Scan: A Step-by-Step Guide
Step 1: Start With Microsoft Secure Score, Then Go Deeper
Open Microsoft 365 Defender → Secure Score (or the equivalent view in the Entra admin center) to get Microsoft's own prioritized list of recommended actions and your current baseline percentage — record this number before making changes. Treat this as a starting inventory, not a finish line, since Secure Score doesn't validate whether enabled settings are scoped correctly.
Step 2: Audit Global Administrator Count and Remove Standing Access
Navigate to Entra admin center → Roles and administrators → Global Administrator. Best practice caps this role at 2–4 accounts organization-wide — every Global Admin can change security settings, access user data, and create accounts, making each one a top-tier target. Use dedicated admin accounts separate from daily-driving accounts (no email access, no general internet browsing), and enable Privileged Identity Management (PIM) so elevated access is granted just-in-time and time-bound rather than standing indefinitely.
Step 3: Enforce MFA via Conditional Access, Not Security Defaults Alone
Go to Entra admin center → Protection → Conditional Access. Security Defaults provide a baseline, but Conditional Access policies allow far more precise control — require MFA for all users (not admins alone), and specifically require phishing-resistant methods (FIDO2 security keys, Windows Hello for Business, or certificate-based authentication) for administrative roles. Critically, review every policy's exclusion list: a policy that enforces MFA but excludes a specific account or application "temporarily" is one of the most common findings in real tenant reviews, and exclusions frequently outlive their original justification by months or years.
Step 4: Confirm Break-Glass Accounts Exist and Are Monitored — Not Just Excluded
Every tenant should have at least two dedicated break-glass (emergency access) accounts excluded from Conditional Access, specifically to prevent a misconfigured policy from locking out all administrators simultaneously. The finding to check for: these accounts should have extremely strong, unique credentials and active sign-in monitoring/alerting — an unmonitored break-glass account is functionally a standing backdoor with no oversight, which defeats the purpose of tightly scoping every other admin account.
Step 5: Block Legacy Authentication Entirely
Under Conditional Access, create or verify a policy blocking legacy authentication protocols (IMAP, POP3, SMTP AUTH, older Exchange ActiveSync clients) tenant-wide. Legacy protocols don't support modern authentication or MFA, making them a direct bypass for any MFA enforcement elsewhere in your policy set — an attacker with a valid password alone can often authenticate through a legacy protocol even when every other sign-in path requires a second factor.
Step 6: Audit App Registrations and Service Principal Permissions
Navigate to Entra admin center → Applications → App registrations, then review API permissions for each, sorting by Microsoft Graph scope severity. This is where permission sprawl accumulates silently: a developer requests broad Graph API access during development, grants admin consent to move fast, and the application goes into production with permissions no one revisits. Focus specifically on applications with Mail.ReadWrite, Directory.ReadWrite.All, or similarly broad scopes, confirm an active business owner exists for each, and revoke consent for anything unused or ownerless.
Step 7: Test Conditional Access Coverage With the "What If" Tool
Before and after making policy changes, use the Conditional Access "What If" tool against real sign-in scenarios to confirm policies apply as intended — a misconfigured Conditional Access policy can lock out an entire organization in seconds, which is exactly why new or modified policies should run in report-only mode first, validated against real sign-in log data, before full enforcement.
Step 8: Confirm Email Authentication Is Set to Enforce
Verify SPF, DKIM, and DMARC records for your domain, with DMARC specifically configured to enforce (p=reject) rather than monitor-only (p=none). Review Microsoft Defender for Office 365 → Policies for anti-phishing, safe attachments, and safe links coverage, confirming these extend to all accepted domains and aren't limited to a subset left over from a partial rollout.
Step 9: Review Data Protection — Sensitivity Labels, DLP, and Copilot Readiness
Check Microsoft Purview → Information Protection for sensitivity label coverage and Data Loss Prevention policy effectiveness across SharePoint, OneDrive, and Exchange. This step has taken on new urgency in 2026 specifically because of Microsoft 365 Copilot: Copilot surfaces content based on a user's existing permissions, meaning any pre-existing oversharing (a SharePoint site with broader access than intended, a "anyone in the organization" sharing link) becomes dramatically more discoverable once Copilot can summarize and surface it in response to a simple prompt. A Copilot-readiness pass — auditing sharing scope before enabling Copilot broadly — is now a standard part of a thorough tenant scan.
Step 10: Check Device Compliance and Establish a Recurring Review Cadence
Review Microsoft Intune → Devices → Compliance policies to confirm managed devices meet baseline requirements (encryption, OS currency, screen lock) before accessing corporate data, and that Conditional Access policies actually require compliant-device status where appropriate rather than allowing any authenticated sign-in regardless of device posture. Finally, schedule this entire review on a recurring basis — quarterly at minimum, monthly or continuous for regulated industries — since identity configurations drift constantly as new apps are registered, new admins are provisioned, and new Conditional Access policies are added.
Most Common Findings by Risk Category
| Category | Common Finding | Typical Fix |
|---|---|---|
| Privileged access | More than 4 Global Admins; standing (non-PIM) elevated access | Reduce to 2–4; enable PIM for just-in-time elevation |
| Conditional Access | Policies with stale exclusions; no legacy auth block | Review exclusion lists quarterly; block legacy auth tenant-wide |
| MFA | Reliant on Security Defaults alone; admins using non-phishing-resistant methods | Move to Conditional Access; require FIDO2/passkeys for admins |
| Break-glass accounts | Excluded from CA but unmonitored | Add dedicated sign-in alerting for break-glass account activity |
| App registrations | Over-permissioned Graph API scopes with no active owner | Audit and revoke unused/ownerless app consents |
| Email authentication | DMARC set to p=none instead of enforcement |
Move to p=reject after confirming legitimate mail aligns |
| Data protection / Copilot | Broad SharePoint/OneDrive sharing predating Copilot rollout | Audit sharing scope before expanding Copilot access |
| Device compliance | Conditional Access not requiring compliant-device status | Tie sensitive-data access policies to Intune compliance state |
Frequently Asked Questions
How long does a Microsoft 365/Entra ID tenant scan take? A first-pass review covering the ten steps above, starting from Microsoft Secure Score and working through Conditional Access, app registrations, and email/data settings, typically takes 2–4 hours for a mid-sized tenant — longer than a comparable Google Workspace review, largely because Conditional Access and app registration review require more granular per-policy inspection.
Is a high Microsoft Secure Score enough to consider a tenant secure? No. Secure Score measures whether recommended settings are enabled, not whether they're scoped correctly for your environment — a tenant can score well while still having Conditional Access policies with risky exclusions, over-permissioned app registrations, or an unmonitored break-glass account, none of which a completeness-based score fully captures.
What's the single highest-impact setting to fix first? Auditing and reducing Global Administrator count, paired with enabling Privileged Identity Management for just-in-time elevation. Standing Global Admin access is consistently the highest-value target in real compromises, since a single compromised Global Admin credential grants tenant-wide control.
Why does legacy authentication matter if MFA is already enforced elsewhere? Legacy protocols (IMAP, POP3, older ActiveSync) don't support modern authentication and therefore can't enforce MFA at all — an attacker with a valid password can often authenticate through a legacy protocol entirely independent of MFA policies applied to modern sign-in flows, making it a direct bypass unless explicitly blocked.
Does enabling Microsoft 365 Copilot introduce new security risk on its own? Copilot itself doesn't grant new permissions — it operates within a user's existing access. The risk is that Copilot makes previously obscure oversharing (broad SharePoint permissions, forgotten sharing links) far more discoverable, since a simple prompt can now surface content a user technically had access to but would likely never have found manually. This is why a sharing-scope audit before broad Copilot rollout has become a standard 2026 tenant scan step.
How is this different from a Google Workspace tenant scan? The underlying goal — finding identity, access, and sharing misconfigurations before attackers do — is the same, but the specific control surfaces differ: Entra ID's Conditional Access and PIM model is considerably more granular than Google Workspace's equivalent Context-Aware Access, while Google Workspace's Drive sharing defaults have a more direct analog in SharePoint/OneDrive sharing policy review. See Google Workspace Tenant Scan: Step-by-Step Security Assessment Guide for the parallel walkthrough.
Related Resources
- Google Workspace Tenant Scan: Step-by-Step Security Assessment Guide — the parallel guide for Google Workspace tenants
- What Is Cloud Security Posture Management (CSPM)? — the infrastructure-focused counterpart to tenant scanning
- What Is Zero Trust Architecture? — how Conditional Access implements Zero Trust principles in practice
- What Is Attack Surface Management (ASM)? — extending discovery beyond a single tenant
- Trusteed Cloud Security & Compliance — continuous configuration monitoring across cloud and SaaS environments
Identity Configurations Drift Constantly — Scanning Once a Year Isn't Enough
Conditional Access policies accumulate exceptions. App registrations accumulate permissions nobody revisits after launch. Global Admin roles get granted for a single project and never revoked once it ends. None of these show up on a dashboard unless something is actively checking — and a single annual review means your actual risk window is however many months pass between scans, not the day you last checked.
Trusteed's cloud security platform extends continuous configuration monitoring across your Microsoft 365, Entra ID, and broader cloud footprint — catching Conditional Access drift, over-permissioned app registrations, and access sprawl as they happen, with the same evidence trail that supports SOC 2, ISO 27001, and HIPAA compliance automatically.
Ready to move from a point-in-time scan to continuous coverage? Start scanning for free or talk to an expert to see how Trusteed keeps your Microsoft 365 and Entra ID configuration continuously monitored, not just reviewed once a quarter.
This post was published on the Trusteed Blog. Trusteed provides continuous cloud and SaaS security configuration monitoring — catching misconfigurations like Conditional Access exclusion drift, over-permissioned app registrations, and Global Admin sprawl the moment they occur, with automated evidence generation for SOC 2, ISO 27001, and HIPAA.