Microsoft 365 tenant audit
Denetta Microsoft 365 Tenant Audit is the module that audits a company’s Microsoft 365 tenant through a read-only application consent granted by the tenant’s administrator: it evaluates MFA enforcement, administrators’ MFA registration, privileged roles, legacy authentication protocols, SharePoint/OneDrive external sharing and guest invitation settings with 18 rules. Email, file and calendar content is never read, and no tenant setting is changed.
What does it find?
Example findings; each counts in the score with its own weight and explains the fix.
- Critical
Account in a privileged role with no MFA method registered
- High
MFA is not enforced tenant-wide
- High
Legacy authentication protocols are not blocked
- High
Guest (external) account in a privileged role
- Medium
SharePoint/OneDrive allows “Anyone” links
Which permissions does it use?
The company’s administrator grants consent to Denetta’s separate, read-only application on Microsoft’s own consent screen (admin consent). No password is requested or stored, and the connection can be revoked at any time from the Entra admin center.
Every permission requested is read-only: tenant information and subscription plan, Secure Score, security defaults and Conditional Access policies, the MFA registration report, admin role assignments, SharePoint/OneDrive sharing settings and the registered authentication method types of admin accounts only. Denetta also audits its own access on every scan: if the application has been given a write permission or a broader read permission than it needs, this is reported as a finding.
What does it not read?
Email, file, calendar and chat content is never read; permissions that reach them are not requested. Users’ MFA status is counted in memory and only the number is stored; privileged account names are kept masked. Without Entra ID P1, sign-in logs cannot be read; those checks appear as a “visibility gap”, not as “passed”.
Exchange Online specific checks (audit logging, mailbox forwarding, DKIM signing) are not part of this version and appear in the report as visibility gaps. The domain’s SPF, DKIM and DMARC records are audited by the Domain and Email Security module.
How is it licensed?
A tenant does not belong to a site, so this module is licensed per company. Contact us for pricing; the audit starts with the company’s signed consent form and the administrator’s application consent.