Microsoft 365 penetration testing is a controlled attempt to break into your own Microsoft 365 tenant, the way a real attacker would, so you can fix the weak spots first. It looks at how people sign in, what admins can do, how mail and files are shared, and whether your alerts fire when something odd happens. It is not a scan of Microsoft’s servers. Microsoft runs those, and you are not allowed to test them.
That distinction trips up many buyers. The test is about your settings, your accounts and your habits inside a platform Microsoft looks after.
Table of Contents
What does Microsoft 365 penetration testing actually cover?
A good test treats the tenant as one connected target. The usual areas are:
- Identity and sign-in: password policies, multi-factor authentication (MFA) coverage, Conditional Access rules and any gaps in them.
- Email and collaboration: Exchange Online mail flow rules, forwarding, shared mailboxes, Teams guest access and SharePoint and OneDrive sharing links.
- Admin and app permissions: who holds privileged roles, which third-party apps have been granted access, and whether any service accounts are over-trusted.
- Devices: whether Intune or similar rules really block unmanaged laptops and phones.
- Detection: whether your team sees a risky sign-in or a new inbox rule, and how fast.
Good Microsoft 365 penetration testing mirrors how real incidents start. Most begin small. A stolen password, a user who approves a prompt they should not, or a forgotten legacy setting. The test follows that chain to see how far it goes.
Does Microsoft allow you to penetration test Microsoft 365?
Yes, within limits. Microsoft publishes rules of engagement that cover its cloud services. They ask you to test your own tenant or assets, or assets you have explicit permission to test. Microsoft also suggests using a test account or trial tenant where you can.
The same rules list what is off limits. These include:
- accessing data or systems you do not own, or using credentials that are not yours;
- denial-of-service attacks and network-heavy automated fuzzing;
- phishing or social engineering aimed at Microsoft staff;
- post-exploitation moves such as dumping secrets or pivoting into other systems.
Microsoft says it may interrupt testing and can respond to anything that looks malicious. Your tester should know these rules before work starts, and the scope document should say so. Check the current page before every engagement, because the wording can change.
What is the difference between a configuration review and a pen test?
The two are often mixed up, and the right choice depends on your goal.
| Approach | What it does | Best for |
|---|---|---|
| Configuration review | Checks settings against a known baseline | Finding gaps quickly and cheaply |
| Penetration test | Tries to exploit gaps, chain them and reach real data | Proving what an attacker could actually do |
| Red team exercise | Goes after a goal over weeks, and tests your detection | Mature teams with a security operations function |
For a first look, a review against a baseline is often the sensible start. CISA’s SCuBA project publishes free secure configuration baselines for Microsoft 365, and a no-cost tool called ScubaGear that checks a tenant against them. Fix what it finds, then test what is left.
Which Microsoft 365 weaknesses do testers find most often?
Findings vary by tenant, but a few patterns come up again and again.
Legacy authentication left switched on
Older protocols cannot ask for a second factor, so they walk around MFA. Microsoft’s own guidance says its analysis found that more than 97 percent of credential stuffing attacks and more than 99 percent of password spray attacks use legacy authentication. Blocking it with Conditional Access is a quick win, and the sign-in logs show who still depends on it.
MFA that has holes in it
Many tenants say MFA is on for everyone. In practice there are exclusions for old service accounts, shared mailboxes or a director who complained once. Each exclusion is a door. We cover how attackers get past weaker MFA in our guide to what MFA stops and what still gets through.
Too many admins, too much sharing
Global admin rights handed out for convenience are a common find. So are anonymous sharing links on SharePoint folders and guest users who never left after a project ended.
Mail rules nobody watches
After an account takeover, attackers often add an inbox rule that hides replies or forwards mail outside. If nobody alerts on new rules, the fraud can run for weeks.
How much does Microsoft 365 penetration testing cost?
It depends on the size of the tenant, the number of users and how deep you want to go. A small business with a simple setup needs far less time than a firm with several tenants, custom apps and hybrid links to on-premises Active Directory. Ask for a fixed quote based on a written scope. Be wary of a price that arrives before anyone asks how many users you have.
How should you prepare for Microsoft 365 penetration testing?
- Decide the goal. Is it a customer requirement, an insurance question or a worry after an incident?
- Agree the scope in writing. Name the tenant, the accounts the tester may use and anything off limits.
- Set up test accounts. Low-privilege users and, if needed, an admin-level account give the tester a fair view.
- Tell the people who need to know. Your IT lead should be aware, but consider whether your monitoring team should be told, since you may want to see if they notice.
- Plan the fix window. Findings are only useful if somebody has time to act on them. Ask for a retest once you have.
If you are weighing up who should do the work, our note on what to consider when hiring pen testing companies covers the questions worth asking.
Frequently asked questions
Is Microsoft 365 secure by default?
Microsoft secures the platform, but you control the settings. Some protections, such as security defaults, exist for tenants without Conditional Access licences. Still, most of the risk sits in how you set up sign-in, sharing and admin rights.
Will a test disrupt my staff?
It should not. Tests avoid denial-of-service techniques, and the scope can keep testing away from live mail and files. Agree testing windows in advance anyway.
Do I need a test if I already use Defender?
Defender detects threats. A pen test checks whether your configuration lets one in and whether your team would notice. They answer different questions.
Does a pen test cover Azure too?
Microsoft 365 and Azure share the same identity layer, so the two overlap. Azure workloads such as virtual machines and storage need their own scope. See our page on Azure penetration testing for that side.
How often should you repeat Microsoft 365 penetration testing?
Once a year is a common rhythm, and it makes sense to test again after big changes. A new Conditional Access design, a merger or a move of staff onto new devices all count. Retest fixes soon after you make them, so you know they work.
Getting help with your tenant
If you would like an expert to look at your setup, Aardwolf Security offers cloud penetration testing for UK organisations, and you can get in touch to talk through scope. Even if you never do, the checklist above is a decent place to start.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
