M&A Due Diligence — Microsoft 365 Tenant Audit for Target Companies
The target's Microsoft 365 tenant is one of the largest hidden integration costs in any M&A deal. Standard financial and legal due diligence does not touch it. This is the EPC Group 5-10 day pre-close audit, refined across 216+ M&A engagements moving 1.83 million users (2023-2025 program).
The six deliverables
- License inventory + true-up estimate — every M365 SKU the target owns, entitled vs deployed seats, overage exposure at close.
- Security posture assessment — Secure Score baseline, active P1/P2 incidents, unresolved audit findings, Purview holds.
- Governance debt inventory — SharePoint EEEU permission exposure, sensitivity label state, DLP coverage.
- Copilot readiness gap — how far is the target from safely enabling Copilot post-close.
- Integration cost estimate — bounded range (small / medium / large) for consolidating into acquirer tenant.
- Post-close 30-day consolidation runbook — sequenced actions the integration team executes in the first month.
Frequently Asked Questions
Why does M&A due diligence need a Microsoft tenant audit?
Because the target's Microsoft 365 tenant is one of the largest post-close integration cost lines and one of the biggest risk surfaces — and standard financial + legal due diligence never touches it. A $50M acquisition can hide $500K-$2M of unbudgeted tenant integration cost (licensing overage, Purview retrofit, Copilot readiness gap, SharePoint permission cleanup, Power Automate flow rebuild). Worse: if the target's tenant has an active oversharing exposure, a security incident, or a regulatory audit finding, the acquirer inherits it at close. EPC Group's 5-10 day pre-close audit surfaces the integration cost and the risk surface before signing.
What does the audit produce?
Six deliverables in a single pre-close report: (1) License inventory + true-up estimate — every M365 SKU the target owns, entitled vs deployed seats, overage exposure at close. (2) Security posture assessment — Secure Score baseline, active P1/P2 incidents, unresolved audit findings, Purview holds in place. (3) Governance debt inventory — SharePoint EEEU permission exposure, sensitivity label taxonomy state, DLP policy coverage. (4) Copilot readiness gap — how far is the target from safely enabling Copilot post-close. (5) Integration cost estimate — bounded range (small / medium / large) for consolidating into the acquirer tenant. (6) Post-close 30-day consolidation runbook — the sequenced actions the integration team executes in the first month.
How long does the audit take?
5-10 business days. Small target (under 500 employees): 5 days. Mid-market target (500-2,500 employees): 7-8 days. Large target (2,500-10,000 employees): 10 days. Requires read-only Global Admin access to the target tenant during the audit window — provided under NDA and typically brokered by the target's CIO with acquirer legal counsel. EPC Group has run this audit on 216+ M&A engagements moving 1.83 million users across the 2023-2025 program window.
How does this fit into the standard M&A due diligence workstream?
Runs in parallel with financial + legal + operational due diligence, typically Weeks 4-6 of a 10-12 week diligence cycle. Report delivered to the acquirer M&A team + CIO + CISO 2-3 weeks before target close. Findings feed into: (a) the purchase agreement (representations and warranties around IT liability), (b) the post-close integration budget, (c) the Day 1 IT integration plan. For deals where the M&A tenant audit surfaces material findings, EPC Group has been engaged as the post-close M&A tenant consolidation partner — see /answers/ma-tenant-consolidation-microsoft-365 for the 5-day cutover playbook.
What do the top findings usually look like?
Three most common: (1) License overage — the target is paying for 500-2,000 seats it does not use, or is running M365 Business Premium where it should be E3. Post-close TCO improvement of $150K-$1.5M/yr. (2) Governance debt — the target has 60-90% of its SharePoint content permissioned to "Everyone Except External Users" and no sensitivity label taxonomy. Integration cost fixed fee quoted after discovery for the cleanup + Purview rollout. (3) Copilot-blocked — the target is on M365 E3 without Purview eDiscovery Premium, sensitivity labels, or DLP policies, meaning Copilot rollout at the acquirer is blocked in the target org until quoted after discovery of remediation is complete.
Talk to a senior architect
Email contact@epcgroup.net or call 888-381-9725.
North America's oldest continuous Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.