Security Review Workpapers for Microsoft 365
Versioned workpapers for reviewing Microsoft 365 controls, evidence, permissions and remediation priorities.
No account and no email needed. An optional email copy is below.
Related: the Architecture & Security Design Workshop.
Want this worked against your own tenant rather than filled in by hand? See Tenant hardening for Microsoft 365.
How to use this pack
Editable workpapers for a structured Microsoft 365 review: a 48-check source-linked checklist, permission audit and gap analysis. Stable ITS-M365 IDs connect findings to evidence and remediation owners without presenting the pack as a certification.
- Work through security-checklist.md one control at a time.
- Record admin roles and sharing findings in permission-audit.csv.
- Write each gap, its owner and its date into gap-analysis.md.
Before you rely on it
Validate every control against current Microsoft guidance, tenant licensing, applicability and risk.
Want a copy in your inbox?
Optional email delivery makes the link easy to recover. You can download above without submitting anything.