Microsoft 365 security audit method and score calculation
Sentinel Audit365 is automated audit software, operated by SF2i. Here is how it connects to your tenant, what it compares each setting against, and how the protection score is calculated. No black box.
How an audit runs
- Scoping. A conversation about your environment, your licences and your concerns. The audits are configured for your tenant.
- Connection. You grant delegated access for the duration of the setup: SF2i registers the audit application in your tenant. The audit then connects through it, read-only, using a certificate.
- Analysis. The Sentinel Audit365 software runs more than 180 controls automatically, on the platform hosted and monitored by SF2i.
- Delivery. Interactive report, PDF summary, Excel export and email summary, placed in your SharePoint. The first report arrives within 48 h.
- Follow-up. The audit runs again automatically once a month and measures progress.
Read-only access
The audit observes without ever changing anything. It reads your tenant's configuration through the Microsoft 365 APIs, using certificate-based rather than password-based authentication. Nothing is installed on your workstations or servers, and your users see no difference. Remediation stays in your hands, or those of your IT provider.
The three frameworks
- CIS Microsoft 365 Foundations Benchmark. The internationally recognised framework from the Center for Internet Security, which describes the secure configuration of each Microsoft 365 service. Each control carries its number, for example CIS 5.2.2.1 for MFA on privileged accounts.
- ANSSI IT hygiene guide. The essential measures published by the Agence nationale de la sécurité des systèmes d'information, the reference in France. Example: measure 13 for multi-factor authentication.
- Microsoft Security Baseline. The security recommendations published by Microsoft for its own services.
Control statuses
- Compliant the setting is aligned with the recommendations (compliance 1).
- Warning the setting provides partial protection (compliance 0.5).
- Non-compliant the setting is missing or contrary to the recommendations (compliance 0).
- Optimisation a cost or hygiene improvement, not included in the score.
- Information a context indicator, not included in the score.
When a control applies to only part of the environment, for example an Exchange policy that covers only a fraction of the mailboxes, compliance becomes proportional to coverage. A misconfigured rule that applies to a minority only counts in proportion to its share.
How the score is calculated
Each control carries a criticality from 1 (minor) to 5 (critical), which reflects its impact on security. A domain's score is the average compliance, weighted by criticality:
Domain score = Σ (criticality × compliance) ÷ Σ (criticality)
The overall score, called the risk protection score, then weights each domain by the share of real risk it carries, regardless of how many controls it has:
Protection = Σ (domain weight × domain score) ÷ Σ (weights of audited domains)
| Domain | Role | Weight |
|---|---|---|
| Exchange Online | Email, the main attack surface | 45 |
| Entra ID | Identity, the cornerstone | 37 |
| SharePoint Online | Documents and intranet | 7 |
| Microsoft Teams | Collaboration | 6 |
| OneDrive | Personal files | 5 |
A domain that is not audited is left out, and the weights of the others are recalculated.
A worked example
Take a tenant with Entra ID at 95%, Exchange Online at 70%, and SharePoint, Teams and OneDrive at 100%.
| Domain | Weight × score |
|---|---|
| Exchange Online | 45 × 70 = 3,150 |
| Entra ID | 37 × 95 = 3,515 |
| SharePoint, Teams, OneDrive | (7 + 6 + 5) × 100 = 1,800 |
| Risk protection score | 8,465 ÷ 100 = 84.7% |
A simple average of the five domains would give 93%, and would hide the weakness in email. With weighting, the 30 points missing on Exchange cost 13.5 points on the overall score: the result reflects the real risk.
Protection levels
| Score | Exposure | Maturity |
|---|---|---|
| 95% and above | Low exposure | Optimised, good security level |
| 80 to 94% | Moderate exposure | Advanced, level to optimise |
| 65 to 79% | Notable exposure | Intermediate, level to strengthen |
| 50 to 64% | High exposure | Initial, significant gaps |
| Below 50% | Critical exposure | Insufficient level |
Entra ID and Exchange Online are fundamental domains: if either falls below 70%, it is flagged as a priority, whatever the overall score.
What the audit does not replace
Sentinel Audit365 assesses the configuration of Microsoft 365. It does not replace a penetration test, an audit of your workstations, servers and network, or real-time security monitoring. It is a foundation: it makes sure the basic settings are in place, and that they stay in place.
Ready to see what your tenant is hiding? First report within 48 h.
A subscription, an automatic audit every month, nothing to launch. A first conversation is enough to get started. We work in New Caledonia, French Polynesia and France.
- New Caledonia+687 24 23 22
- French Polynesia+689 40 42 90 79
- France+33 2 96 47 48 05