--- title: CIS Microsoft 365 Benchmark Assessment | Datatechs Consulting description: An independent assessment of your Microsoft 365 tenant against the CIS Microsoft 365 Foundations Benchmark. Prioritised findings, plain-English reporting, fixed scope. image: https://www.datatechs.co.uk/hubfs/raw_assets/public/datatechs-theme/images/Datatech_OG.png --- [Skip to content](https://www.datatechs.co.uk/audit/cis-m365#main-content) [![Datatechs home](https://www.datatechs.co.uk/hs-fs/hubfs/Datatech%20Consulting%20Limited.png?width=2130&height=676&name=Datatech%20Consulting%20Limited.png "Datatechs home")](https://www.datatechs.co.uk?hsLang=en-gb) [![](https://www.datatechs.co.uk/hubfs/Datatech%20Consulting%20Limited%20-%20INVERT.png)](https://www.datatechs.co.uk/?hsLang=en-gb) [Home](https://www.datatechs.co.uk/?hsLang=en-gb) [Services](https://www.datatechs.co.uk/services?hsLang=en-gb) [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [Professional Services and Consultancy](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) [View all services →](https://www.datatechs.co.uk/services?hsLang=en-gb) [Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [CIS M365 Benchmark](https://www.datatechs.co.uk/audit/cis-m365?hsLang=en-gb) [CIS Intune Benchmark](https://www.datatechs.co.uk/audit/cis-intune?hsLang=en-gb) [Cyber Essentials](https://www.datatechs.co.uk/audit/cyber-essentials?hsLang=en-gb) [View the full audit →](https://www.datatechs.co.uk/audit?hsLang=en-gb) [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) Resources Free Downloads [M365 Security Essentials Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) [Intune Security Essentials Checklist](https://www.datatechs.co.uk/resources/intune-security-essentials?hsLang=en-gb) [About](https://www.datatechs.co.uk/about?hsLang=en-gb) [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) [Contact Us](https://www.datatechs.co.uk/contact?hsLang=en-gb) [Home](https://www.datatechs.co.uk/?hsLang=en-gb) [Services](https://www.datatechs.co.uk/services?hsLang=en-gb) [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [Professional Services and Consultancy](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) [Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) [CIS M365 Benchmark](https://www.datatechs.co.uk/audit/cis-m365?hsLang=en-gb) [CIS Intune Benchmark](https://www.datatechs.co.uk/audit/cis-intune?hsLang=en-gb) [Cyber Essentials](https://www.datatechs.co.uk/audit/cyber-essentials?hsLang=en-gb) [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) Resources [M365 Security Essentials Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) [Intune Security Essentials Checklist](https://www.datatechs.co.uk/resources/intune-security-essentials?hsLang=en-gb) [About](https://www.datatechs.co.uk/about?hsLang=en-gb) [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) [Contact Us](https://www.datatechs.co.uk/contact?hsLang=en-gb) CIS Microsoft 365 Foundations Benchmark # Measure your Microsoft 365 tenant against the benchmark everyone else is being measured against. The CIS Microsoft 365 Foundations Benchmark is the most widely adopted security configuration standard for Microsoft 365. We assess your tenant against it, tell you where you stand, and give you a prioritised plan to close the gaps. [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [Request a quote →](https://www.datatechs.co.uk/contact?hsLang=en-gb) Not ready to talk yet? [Start with the free checklist.](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) CIS benchmark v7.0.0 Level 1 and Level 2 Entra, Exchange, SharePoint, Teams, Purview Independent, no product to sell What it is ## A consensus standard, not a vendor’s own recommendations. The CIS Microsoft 365 Foundations Benchmark is a consensus-developed set of security configuration recommendations published by the Center for Internet Security, a non-profit that maintains hardening guidance across most major platforms. It is not a Microsoft product and not a vendor standard. It is maintained by a community of practitioners and updated as the platform changes. That independence is the reason it carries weight. When an insurer, an auditor or an enterprise customer asks how your Microsoft 365 environment is configured, the CIS Benchmark is a reference point both sides recognise, which a vendor’s own recommendations are not. Published by Center for Internet Security (CIS) Full name CIS Microsoft 365 Foundations Benchmark Version assessed v7.0.0 Applies to Entra ID, Exchange Online, SharePoint and OneDrive, Teams, Purview and Defender Why it matters ## Most tenants are not insecure by decision. They drifted. Most Microsoft 365 tenants are not insecure because someone made a bad decision. They are insecure because nobody made a decision at all. Defaults were accepted during migration, licences changed, staff came and went, and the configuration drifted quietly for years. The commercial pressure is what usually forces the issue. Supply chain requirements Enterprise customers increasingly ask suppliers to evidence how their environment is configured. “We use Microsoft 365” is no longer an answer. Cyber insurance Insurers ask specific configuration questions at renewal, and the answers affect both premium and cover. Several of those questions map directly onto benchmark controls. Regulatory and sector pressure Financial services, healthcare and public sector suppliers face explicit expectations about access control, audit logging and data handling. Incidents that were preventable Business email compromise remains the most common way small organisations lose money, and it almost always follows a configuration gap rather than a sophisticated attack. What it covers ## Every major workload in the tenant. The benchmark spans the major workloads in a Microsoft 365 tenant. Our assessment covers all of them. - 1 Identity and authentication Entra ID password policy, MFA coverage, authentication methods, self-service password reset. - 2 Privileged access Admin role assignment, privileged identity management, guest and external access. - 3 Conditional Access Baseline policies for identity, device compliance and session control. - 4 Exchange Online Mail flow rules, anti-phishing, DMARC, DKIM and SPF, external sender handling. - 5 SharePoint and OneDrive External sharing, link defaults, legacy authentication, sync controls. - 6 Microsoft Teams External and guest access, meeting and messaging policy. - 7 Microsoft Purview Data loss prevention, sensitivity labelling, retention. - 8 Microsoft Defender Threat policies and automated investigation and response. - 9 Auditing Audit log configuration, retention and sign-in reporting. Version 7.0.0 expanded the benchmark’s identity coverage significantly, absorbing a set of recommendations that previously sat in the CIS Azure Foundations Benchmark, and added guidance for newer surfaces including data loss prevention for Copilot. Profile levels ## Level 1 and Level 2. The benchmark splits its recommendations into two profile levels. Level 1 The widely applicable baseline Covers configuration that is widely applicable and unlikely to disrupt normal business use. Level 2 The higher baseline Adds hardening for organisations that need a higher baseline or operate under regulatory pressure, and some of it will change how people work. How it works ## Scoped, assessed, reported, handed over. 01 Scoping A short call to understand your tenant, your licensing and what is prompting the assessment. We confirm scope and fee before anything starts. 02 Assessment We review your tenant configuration against each applicable control. Licensing matters here: not every control applies to every licence tier, and we tell you which recommendations your licensing does not support rather than listing them as failures. 03 Reporting You get a findings report written to be read by someone who is not a Microsoft 365 specialist. Each finding states what was found, why it matters in plain terms, and what to do about it, prioritised by risk rather than listed in benchmark order. 04 Handover We walk you through the findings. You can take the report and act on it yourself, hand it to your existing IT provider, or ask us to carry out the remediation. What you receive - A findings report written to be read by someone who is not a Microsoft 365 specialist - Each finding stating what was found, why it matters in plain terms, and what to do about it - Findings prioritised by risk rather than listed in benchmark order - Recommendations your licensing does not support identified as such, not counted as failures - A walkthrough of the findings, and the report to keep Scope and fee ## Quoted per engagement, agreed before we start. Quoted Scope and fee confirmed at the discovery call, before any work begins. There is no product being sold alongside this. The assessment is the deliverable. What the scope depends on - Tenant size and complexity - Your licensing tier, and which controls it supports - Whether both profile levels are in scope - Whether you want us to carry out the remediation as well [Request a quote](https://www.datatechs.co.uk/contact?hsLang=en-gb) Official sources ## Read it from the source. The benchmark is published by CIS, not by us. Read it there. [CIS Microsoft 365 Benchmarkscisecurity.org](https://www.cisecurity.org/benchmark/microsoft_365)[CIS Benchmarks overviewcisecurity.org](https://www.cisecurity.org/cis-benchmarks) Framework information checked on 18 September 2026. FAQ ## Common questions Do I need to buy anything from CIS? No. The benchmark PDF is free to download for non-commercial use. Paid CIS membership adds tooling, which is not required for this assessment. Will this disrupt our users? The assessment itself is read-only and changes nothing. Remediation is where disruption is possible, which is why findings are prioritised and Level 2 controls are flagged where they affect how people work. We already have an IT provider. Does this replace them? No. It is deliberately independent. Plenty of our assessments are commissioned precisely because an organisation wants a view that is not from the people who built the environment. How long does it take? It depends on tenant size and complexity, and we confirm it at scoping before you commit. ## Find out where your tenant actually stands. A short discovery call is enough to scope the work and give you a fixed fee. No obligation, and no sales pressure. [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [Book a discovery call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) [View services](https://www.datatechs.co.uk/services?hsLang=en-gb) [![Datatechs](https://www.datatechs.co.uk/hs-fs/hubfs/Datatech%20Consulting%20Limited%20-%20INVERT.png?height=56&name=Datatech%20Consulting%20Limited%20-%20INVERT.png)](https://www.datatechs.co.uk/?hsLang=en-gb) Microsoft 365 security and compliance for organisations and MSPs. Services - [M365 Security Audit](https://www.datatechs.co.uk/audit?hsLang=en-gb) - [Professional Services](https://www.datatechs.co.uk/services/professional-services?hsLang=en-gb) - [IT Helpdesk and Support](https://www.datatechs.co.uk/services/it-helpdesk?hsLang=en-gb) - [Managed Compliance](https://www.datatechs.co.uk/services/managed-compliance?hsLang=en-gb) - [Power Platform](https://www.datatechs.co.uk/services/power-platform?hsLang=en-gb) - [Azure and Cloud Infrastructure](https://www.datatechs.co.uk/services/azure-cloud-infrastructure?hsLang=en-gb) Resources - [Blog](https://www.datatechs.co.uk/blog?hsLang=en-gb) - [M365 Security Checklist](https://www.datatechs.co.uk/resources/m365-security-essentials?hsLang=en-gb) Company - [About](https://www.datatechs.co.uk/about?hsLang=en-gb) - [MSP Partners](https://www.datatechs.co.uk/msp-partners?hsLang=en-gb) - [Contact](https://www.datatechs.co.uk/contact?hsLang=en-gb) - [Book a call](https://www.datatechs.co.uk/book-a-call?hsLang=en-gb) Contact - [hello@datatechs.co.uk](mailto:hello@datatechs.co.uk) - United Kingdom © 2026 Datatechs Consulting Limited. Registered in England and Wales, company number 16868376. Registered office: Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, BL6 6HG. [Privacy Policy](https://www.datatechs.co.uk/privacy-policy?hsLang=en-gb) [Terms](https://www.datatechs.co.uk/terms?hsLang=en-gb)