Microsoft 365 security gap analysis
The controls, their identifiers, their severity, their remediation lines and their public sources are real and are rendered from the same module the free Microsoft 365 Security Scorecard uses, so they cannot drift from the product. The verdicts, the evidence sentences and the effort tags are illustrative: a composite of what a first pass typically finds. No customer's tenant, posture or identity is published here, and none was used to produce this page.
- Prepared for
- Illustrative: a 180-seat professional services firm
- Baseline
- ITSailor Tenant Security Baseline, version 2026.10
- Scope
- Entra ID, Exchange Online, Intune, external sharing
- Method
- Read-only. Live session plus delegated Microsoft Graph and public DNS
- Sampled window
- 30 days of sign-in and audit data
- Review
- 48 controls, reviewed 18 October 2026
Findings, in remediation order
Listed in the order I would fix them. Fixing standing administrator count before legacy authentication is blocked moves the problem rather than closing it.
- Severity
- critical
- Verdict
- Partly met
- Evidence
- Conditional Access requires MFA for Global Administrator. Four other privileged roles, including Exchange Administrator, are not in the policy scope.
- Effort
- Under an hour, one policy edit
- Severity
- critical
- Verdict
- Not met
- Evidence
- No policy blocks legacy authentication. Sign-in logs show legacy client attempts against three mailboxes in the sampled window.
- Effort
- Half a day, report-only first
- Severity
- high
- Verdict
- Not met
- Evidence
- Nine standing Global Administrators, of which two are shared accounts and one has no sign-in recorded in the sampled window.
- Effort
- One to two weeks, owner per assignment
- Severity
- high
- Verdict
- Not met
- Evidence
- DMARC record present at p=none with no rua address, so nothing is enforced and nothing is being reported.
- Effort
- One hour, then weeks of monitoring
- Severity
- high
- Verdict
- Partly met
- Evidence
- Laptops enrolled. Personally owned mobile devices access mail without enrolment or an app protection policy.
- Effort
- One to two weeks, needs a user comms plan
- Severity
- medium
- Verdict
- Not met
- Evidence
- Guest accounts present with no expiry and no review. The oldest predates the current tenant administrator.
- Effort
- Half a day to review, ongoing to keep
One finding, worked through
In the delivered document every row in the table is expanded like this one.
ITS-M365-PA-003 · essential profile · high
Does your tenant have fewer than 5 permanent Global Administrators?
What I read
Delegated Microsoft Graph, read-only, during the session with you watching the screen. Directory role assignments and their activation type.
What it returned
Nine standing Global Administrators, of which two are shared accounts and one has no sign-in recorded in the sampled window.
Why it matters
Every Global Administrator can change anything, so each extra standing account adds an attack path. Emergency access accounts count towards the total.
What to do
Reduce standing Global Administrators below five, give the rest narrower roles, and make the remaining assignments eligible through Privileged Identity Management where you are licensed for it.
Effort
One to two weeks, owner per assignment
Sources for this control
Directional crosswalk, not a compliance opinion: DORA Art. 9 · NIS2 Art. 21(2)(i) · NIST CSF PR.AA. A crosswalk says which obligation a control speaks to. It does not say you satisfy that obligation, and nothing on this page certifies anything.
What this page is
- One page of a longer document. The delivered gap analysis covers the control families agreed with you at the start of the session, not six rows.
- Read-only throughout. The session uses delegated Microsoft Graph and public DNS. Nothing in the workshop changes a setting in your tenant. Changes are yours to make, in your own order.
- The baseline is a review aid. 48 controls, version 2026.10, reviewed 18 October 2026. It is not a certification and not an audit opinion.
- The findings are illustrative and the controls are not. No client's tenant or data was used.