Help Center

M365Audit is fully hosted — there's nothing to install. From sign-up to your first audit report is a few minutes:

1. 1
   Create your account

   Sign up with email or Google. Your account is created instantly.

2. 2
   Connect a tenant

   Click 'Connect Tenant' and send yourself (or your client) a consent link. As a Global Admin, they approve read-only permissions — no credentials shared.

3. 3
   Run your first audit

   Select the tenant, choose a benchmark (CIS, CISA, NIST, or HIPAA), and launch. The audit runs in the background.

4. 4
   Get your report

   Results appear as a severity-ranked PDF report you can download, share, or email to a client.

M365Audit uses the standard multi-tenant Entra app registration pattern — the same approach every legitimate M365 security SaaS uses. No credentials are ever shared with us.

1. 1
   Initiate connection

   From your dashboard, add a new tenant. You'll get a consent URL to send to the tenant's Global Admin.

2. 2
   Admin consents

   The Global Admin visits the URL, reviews the requested read-only permissions (Organization.Read.All, Policy.Read.All, AuditLog.Read.All, etc.), and clicks Accept.

3. 3
   Preflight check

   M365Audit verifies the granted permissions against what's needed. If anything is missing, you'll see exactly what and can re-consent before any audit runs.

4. 4
   Ready to audit

   The tenant appears in your dashboard. You can run audits immediately or schedule recurring checks.

Every audit is a full M365 security (Pester-based) test suite run against your connected tenant. Results are compiled into a professional PDF report.

• •Audits cover Entra ID (Conditional Access, MFA, roles), Exchange Online (DLP, anti-spam, mail flow), Teams (external access, guest settings), SharePoint (sharing policies), and Defender (onboarding).
• •Reports include an executive summary, severity-ranked findings, pass/fail per benchmark control, and remediation steps.
• •White-label subscribers get their own logo and org name on every report — no M365Audit branding.

One audit credit = one comprehensive M365 security audit run against one M365 tenant. Credits never expire.

• •One audit is $299 and covers one tenant. Credits never expire.
• •White-label branding is a $50 one-time add-on.
• •Pack credits never expire. MSP credits replenish monthly and never expire.
• •All billing handled through Stripe. No automatic refunds after 7 days on first purchase.

Set up weekly, biweekly, or monthly audits to run automatically against any connected tenant. Ideal for continuous compliance monitoring.

• •Configure per-tenant audit schedules from the Scheduled Audits page.
• •Get notified when critical checks fail (email or webhook — coming soon).
• •Track pass/fail rates over time with trend charts on the dashboard.

MSP subscribers see all connected tenants in one dashboard — compare scores, track trends, and identify systemic weaknesses across your book of business.

• •Security posture score per tenant with trend lines.
• •Cross-tenant comparison: which clients are weakest on MFA? Conditional Access? Audit logging?
• •White-label all client comms — reports, emails, everything carries your brand.

M365Audit is for tenants you own or have explicit written authorization to audit. Read-only Graph permissions — we never write to your tenant.

• •App-only OAuth: your tenant consents to our multi-tenant Entra app. No user passwords are involved.
• •Read-only scopes only: Organization.Read.All, Policy.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All, and equivalent Exchange/Teams read scopes.
• •Your audit data is stored encrypted and isolated per-account. You can delete any audit or your entire account at any time.