What is a Microsoft 365 Security & Compliance Health Check?

A Microsoft 365 Security & Compliance Health Check is a structured assessment of your M365 tenant security posture, compliance configuration, and risk exposure. It evaluates Microsoft Secure Score (identity, device, app, and data protection controls), Azure AD/Entra ID configuration (Conditional Access, MFA enforcement, privileged identity management), Microsoft Purview compliance center settings (retention policies, eDiscovery, audit logging, communication compliance), Data Loss Prevention (DLP) policy effectiveness, SharePoint and OneDrive permission sprawl, Exchange Online protection and anti-phishing configuration, and Teams governance and external access controls. EPC Group delivers quantified findings with prioritized remediation steps mapped to your compliance framework.

What is Microsoft Secure Score and what score should we target?

Microsoft Secure Score is a numerical representation of your organization's security posture across Microsoft 365 services, measured from 0-100%. The score evaluates controls across identity (MFA, password policies, Conditional Access), devices (Intune compliance, BitLocker enforcement), apps (OAuth app consent, Shadow IT detection), and data (DLP policies, sensitivity labels, information barriers). The industry average is 45-55%. Organizations in regulated industries should target 75%+ to meet compliance requirements. EPC Group typically improves client Secure Scores by 25-40 points within the first engagement through high-impact, low-effort control implementations.

How does Microsoft Purview support compliance requirements?

Microsoft Purview provides five compliance capabilities critical for regulated industries: Data Classification (automatic and manual sensitivity labels for HIPAA PHI, PCI data, PII), Data Loss Prevention (policies that prevent sensitive data from leaving the organization via email, Teams, SharePoint, or endpoints), Information Governance (retention and deletion policies that meet regulatory record-keeping requirements), eDiscovery (legal hold and search capabilities for litigation and regulatory investigations), and Audit (comprehensive logging of user and admin activities for compliance monitoring and incident investigation). Proper Purview configuration is required for HIPAA, SOC 2, and FedRAMP compliance in Microsoft 365 environments.

How much does a Microsoft 365 Security Health Check cost?

EPC Group offers three tiers: Good ($20,000) covers Secure Score assessment, basic permission audit for SharePoint and Exchange, DLP policy review, and a prioritized remediation report. Better ($30,000) adds Purview compliance configuration audit, Conditional Access policy optimization, Teams governance review, compliance gap analysis for HIPAA or SOC 2, and remediation implementation for top 10 findings. Best ($40,000) provides full enterprise assessment including Intune device compliance, multi-compliance framework mapping, incident response plan development, executive risk briefing, and 90 days of monitoring and advisory support. Most assessments complete in 3-6 weeks.

What are the most common M365 security gaps found in health checks?

The five most common findings across EPC Group health checks are: MFA not enforced for all users (found in 68% of assessments — many organizations have MFA enabled but not enforced via Conditional Access, leaving gaps), excessive SharePoint permissions (found in 82% — inheritance chains and sharing links create access to sensitive data far beyond intended audiences), no DLP policies or ineffective policies (found in 71% — either no DLP is configured or policies generate so many false positives that alerts are ignored), audit logging not enabled or not retained (found in 59% — default audit retention is 180 days, insufficient for most compliance frameworks that require 1-7 years), and stale external sharing links (found in 77% — guest accounts and sharing links persist long after business need ends).

How does the health check address incident response?

The Best tier includes development of an M365-specific incident response plan covering detection (configuring alerts for suspicious sign-ins, impossible travel, mass file downloads, DLP violations, and admin privilege escalation), investigation (using Microsoft 365 Defender, Purview Audit, and Azure AD sign-in logs to establish incident timeline and scope), containment (procedures for revoking sessions, blocking compromised accounts, disabling OAuth tokens, and isolating affected resources), eradication and recovery (removing persistent threats, resetting credentials, restoring from backup), and post-incident review (documenting lessons learned, updating controls, filing required compliance notifications). This plan is mapped to your specific compliance framework requirements for breach notification timelines.

Can the health check be performed without disrupting users?

Yes. The health check is entirely non-disruptive. EPC Group uses read-only access to the Microsoft 365 admin center, Azure AD/Entra ID portal, Purview compliance center, and Exchange admin center. No configuration changes are made during the assessment phase. Automated scanning tools use Graph API with read-only permissions. User interviews are optional and scheduled around business hours. The only potential user-visible activity occurs during the remediation phase (Better and Best tiers) when security controls are implemented, and those changes are scheduled with change management approval.

How often should a Microsoft 365 security health check be performed?

EPC Group recommends annual comprehensive health checks with quarterly Secure Score reviews. However, health checks should also be triggered by specific events: after a security incident or breach attempt, before or after a compliance audit, when adding new Microsoft 365 workloads (Copilot, Fabric, Viva), after significant organizational changes (mergers, acquisitions, large-scale onboarding), and when Microsoft releases major security features (which happens quarterly). Organizations in healthcare and financial services with active compliance requirements often opt for semi-annual comprehensive reviews.

Microsoft 365 Security & Compliance Health Check

Why Most M365 Tenants Are Under-Secured

Microsoft 365 provides over 300 security and compliance controls. The average enterprise has configured fewer than 40% of them. This gap exists because M365 security is not a single product — it spans Azure AD/Entra ID, Exchange Online Protection, Microsoft Defender for Office 365, Microsoft Purview, Intune, SharePoint admin center, Teams admin center, and Power Platform admin center. No single administrator owns all of these consoles, and security configurations drift over time as features are added and organizational needs change.

The result is predictable: enterprises pass initial compliance audits but develop security gaps over 12-24 months as configurations drift, new features go unconfigured, and organizational changes create permission sprawl. A security health check resets the baseline and identifies the highest-impact remediations.

Health Check Assessment Areas

Microsoft Secure Score Optimization

Secure Score is the starting point as it gives a clear baseline. The health check reviews your current score in four categories. It identifies actions for improvement, ranked by point value and effort needed for implementation.

Highlights quick wins, which are controls that can be enabled right away with no user impact.
Maps score improvements to specific compliance control requirements.

Enable Conditional Access policies for all users (not just admins).
Configure anti-phishing policies in Defender for Office 365.
Enable unified audit logging with extended retention.
Deploy sensitivity labels for automatic data classification.
Implement privileged identity management (PIM) for just-in-time admin access.

Permission Audit and Remediation

Permission sprawl is the biggest security risk in most M365 environments. Our health check audits various aspects of your system, including:

SharePoint site collection permissions and inheritance chains
OneDrive sharing links (both internal and external)
Microsoft Teams membership and guest access
Exchange Online mailbox delegation and shared mailboxes
Azure AD group membership and dynamic group rules
Power Platform environment permissions and data connectors

The most dangerous finding is typically "everyone except external users" sharing links in SharePoint — a single misconfigured sharing link can expose sensitive documents to the entire organization. In healthcare environments, this often means PHI is accessible to users outside the care team, violating HIPAA minimum necessary requirements.

Microsoft Purview Compliance Configuration

The Purview compliance center manages data governance across M365. The health check assesses several key areas:

Retention policies: Are they set up to meet regulatory record-keeping requirements?
Sensitivity labels: Are they deployed and adopted by users?
DLP policies: Are they effective, or are they causing too many false positives?
Communication compliance: Is it monitoring for regulatory violations in Teams and email?
Information barriers: Are they configured where needed, such as between departments with conflicts of interest?
Insider risk management: Is it set up to detect high-risk data exfiltration patterns?

Data Loss Prevention (DLP) Effectiveness

Many organizations have Data Loss Prevention (DLP) policies that are either too strict or too lenient. Strict policies can block legitimate business activities and lead to alert fatigue. On the other hand, lenient policies may not catch actual data loss events.

The health check evaluates DLP policy coverage across:

Exchange
SharePoint
OneDrive
Teams
Endpoints

The system analyzes false positive and false negative rates from policy match logs. It also reviews policy exceptions and overrides to ensure they are appropriate. Furthermore, it tests policies against realistic data loss scenarios.

Effective Data Loss Prevention (DLP) requires tuning, not just deployment. EPC Group employs a data-driven approach to optimize DLP. This method reduces false positives by 60-80% and improves the detection of actual data loss events.

Common Findings by Industry

Finding	Healthcare (HIPAA)	Finance (SOC 2)	Government (FedRAMP)
Average Secure Score	48%	52%	61%
Permission Sprawl	PHI exposed beyond care team	Financial data overshared	CUI accessible to non-cleared staff
DLP Gap	No PHI detection in Teams	PCI data not monitored	CUI marking not enforced
Audit Retention	180 days (need 6 years)	180 days (need 7 years)	90 days (need 3 years)
Incident Response	No breach notification plan	Plan exists but untested	Plan exists, tested annually

EPC Group vs. Competitors: M365 Security Health Check

Capability	EPC Group	MSSPs	General IT Consultancies
Assessment Depth	300+ controls across 8 admin centers	Focus on Defender/Sentinel only	Secure Score review only
Compliance Mapping	Pre-built for HIPAA, SOC 2, FedRAMP	Security-focused, not compliance	Basic mapping
Permission Audit Depth	Full inheritance chain analysis	Admin-level only	Spot-check approach
DLP Optimization	Data-driven tuning, 60-80% FP reduction	Policy deployment only	Template-based policies
Remediation	Assessment + implementation (Better/Best)	Report only, separate SOW for fixes	Report only
Cost	Fixed price, scoped after discovery	$50K-$150K+ T&M	$15K-$30K (shallow scope)

Pricing Tiers: M365 Security Health Check

Microsoft 365 Security and Compliance Health Check

Last updated: 2026 · Read time: ~6 min

A Microsoft 365 security and compliance health check reviews several key areas. These include Secure Score, permission structures, Purview compliance controls, DLP policies, and incident response readiness.

EPC Group offers this as a fixed-fee service for HIPAA, SOC 2, and FedRAMP environments. In their first audit, most enterprises find 15–30 critical gaps.

Key facts

Health check covers: Secure Score gap analysis, permission audit, Purview compliance controls, DLP effectiveness, and incident response readiness.
Most common improvements found: Conditional Access gaps for non-admin users, missing anti-phishing policies, audit logging gaps, sensitivity label coverage below 30%.
Compliance check covers six surfaces: SharePoint, OneDrive, Teams, Exchange, Azure AD groups, and Power Platform.
E5 ($57/user/month) adds Defender Plan 2, Defender for Cloud Apps, Insider Risk, Communication Compliance, Audit Premium, and more vs. E3 ($36/user/month).
EPC Group has delivered security health checks for Fortune 500 healthcare, financial services, and government clients.
Contact: (888) 381-9725 · contact@epcgroup.net

What the health check covers

Secure Score optimization

Microsoft Secure Score is the primary health metric for M365 security. A well-configured enterprise tenant should score above 75%. Most unmanaged tenants score 40–55%.

The health check identifies your top 10 Secure Score improvement actions by impact and implementation complexity. Common high-value items:

Enable Conditional Access policies for all users — not just admins.
Configure anti-phishing policies in Defender for Office 365.
Enable unified audit logging with extended retention.
Deploy sensitivity labels for automatic data classification.
Implement Privileged Identity Management (PIM) for just-in-time admin access.

Permission audit

Permissions are the most common source of data exposure — and the most common pre-condition for Copilot data leaks. The health check audits all six permission surfaces:

SharePoint — site collection permissions, inheritance chains, "Everyone except external users" links.
OneDrive — internal and external sharing links, stale shares.
Teams — membership, guest access, external federation settings.
Exchange Online — mailbox delegation, shared mailboxes, send-as rights.
Azure AD — group membership, dynamic group rules, stale accounts.
Power Platform — environment permissions, data connector access.

Purview compliance controls

The compliance section evaluates six Purview capabilities. Each is checked for configuration completeness and policy effectiveness:

Retention policies — configured to meet regulatory record-keeping requirements for your industry.
Sensitivity labels — deployed and adopted by users, not just configured in the admin portal.
DLP policies — effective without generating excessive false positives that cause users to bypass them.
Communication compliance — monitoring for regulatory violations in Teams and email.
Information barriers — configured where required (e.g., between departments with conflicts of interest).
Insider risk management — configured to detect high-risk data exfiltration patterns.

Incident response readiness

Most enterprises have no documented incident response runbook for M365-specific breaches. The health check validates:

Documented runbooks for mailbox compromise, bulk file download, and ransomware events.
Microsoft Sentinel analytics rules tuned to your environment.
Alert routing to on-call security personnel.
Contact information for Microsoft escalation paths (CSS, DART).

E3 vs E5 licensing gap analysis

Part of every health check is a licensing gap analysis. E5 adds significant security capabilities beyond E3.

E3 — $36/user/month: Core M365 apps, Defender for Office 365 Plan 1, Entra ID P1, Intune, Audit Standard.
E5 — $57/user/month: Adds Defender for Endpoint Plan 2, Defender for Cloud Apps, Insider Risk Management, Communication Compliance, Audit Premium (6-year retention), Customer Lockbox, Microsoft Sentinel ingestion.

For regulated industries, E5 is typically more cost-effective than purchasing equivalent third-party tools separately.

Frequently asked questions

What is a Microsoft 365 security health check?

The audit evaluates the security and compliance of your M365 tenant. It focuses on several key areas:

Secure Score optimization
Permission structures
Purview compliance controls
DLP policy effectiveness
Incident response readiness

Most organizations discover 15–30 critical gaps during their first audit.

How long does the health check take?

A standard health check takes 2–3 weeks. The process is divided into three weeks:

Week 1: Data collection and automated scanning.
Week 2: Manual review and analysis.
Week 3: Findings documentation and delivery of the remediation roadmap.

What are the most common gaps found?

Conditional Access not enforced for non-admin users, anti-phishing policies not configured, audit logging with insufficient retention, sensitivity label coverage below 30%, and Privileged Identity Management not deployed for admin accounts.

Do you provide a remediation roadmap?

Yes. Every health check delivers a prioritized remediation roadmap with effort estimates, licensing implications, and recommended implementation sequence. EPC Group can also deliver remediation as a follow-on engagement.

Does the health check cover Copilot readiness?

Yes. Copilot readiness is a core component. It checks Restricted SharePoint Search configuration, sensitivity label coverage, oversharing exposure, Purview AI Hub setup, and Microsoft Sentinel Copilot analytics rules.

Schedule a health check

Talk to an EPC Group security architect about your M365 security posture. Call (888) 381-9725 or request a discovery call.

Why EPC Group for M365 Security

EPC Group has been a Microsoft partner since 2000 (Gold Partner 2000–2022, Solutions Partner today) with over 10,000 implementations across the most security-sensitive industries. Our founder, Errin O'Connor, is a 4x bestselling author (Microsoft Press / Sams) and former NASA Lead Architect who designed security architectures for mission-critical systems.

G2 Leader with G2 Leader status — consistently the highest-rated Microsoft security consulting firm
25-40 point Secure Score improvement is our average first-engagement result
Pre-built compliance control mappings for HIPAA, SOC 2, and FedRAMP eliminate weeks of manual mapping
Assessment plus remediation in a single engagement (Better and Best tiers), not separate SOWs
Non-disruptive methodology using read-only access during assessment phase

Get Your M365 Security Health Check

Schedule a 30-minute call to discuss your M365 security posture, compliance requirements, and Secure Score. We will recommend the right assessment tier and timeline.

Schedule Security Assessment

Or call us directly: (888) 381-9725

Microsoft 365 Strategy: 2026 Considerations for Blog Microsoft 365 Security Compliance Health Check

In 2026, the choice between Microsoft 365 GCC High and Commercial tenant affects a contractor's ability to manage Controlled Unclassified Information (CUI) for federal work. This is crucial under CMMC Level 2, which requires 110 NIST 800-171 controls, or Level 3, which requires 134 controls.

GCC High costs about twice as much as the commercial version, ranging from $23 to $57 per user per month. However, it is essential for any DoD prime or sub-prime contractor handling CUI.

Migration from Commercial to GCC High takes 14 to 22 weeks.
The total cost for migration ranges from $350,000 to $950,000.

Choosing between Microsoft 365 E5 and E3 in 2026 is mainly about security and compliance. The E5 plan costs $57 per user per month and includes:

Microsoft Defender for Endpoint Plan 2
Microsoft Defender for Cloud Apps
Insider Risk Management
Communication Compliance
Microsoft Sentinel-fed audit logs
Customer Lockbox
Audit (Premium) with 6-year retention

This complete set offers about $35 per user per month in added value if you choose E3 with add-ons. For regulated industries, the E5 bundle is often more cost-effective than the equivalent E3 options.

Decision factors EPC Group evaluates

GCC High vs Commercial tenant decision for federal contractors
Customer Lockbox + Audit (Premium) configuration for regulated tenants
Microsoft Purview Compliance Manager assessment baseline (HIPAA, SOC 2, GDPR, NIST AI RMF)
E5 vs E3 + add-ons total-cost analysis at organization scale
Microsoft Defender for Endpoint Plan 2 deployment versus Plan 1 + add-ons

For a tailored read on this topic in your specific tenant, contact EPC Group at contact@epcgroup.net or +1 (888) 381-9725. Engagement options at /pricing.

Microsoft 365 Security & Compliance Health Check