Scoping checklist
Scoping Checklist: Microsoft 365 and Entra ID
Before a scoping call for a Microsoft 365 configuration review or penetration test, have four things ready: why you want it and who will read the report, whether you need a review, a test or both, the basic facts about your tenant, and who can authorise testing in writing. No credentials, administrator roles, keys, mailbox content or personal data are needed at scoping. Any access is created later, inside your own tenant, once the scope is agreed.
About this help article
Written by SecureRoot Risk Advisory LLP.
Start here
Why you want it
- What started it: a customer security questionnaire, an insurer's form, an audit finding, a suspicious sign-in or a new security lead asking where things stand.
- The deadline, and who reads the result: your own team, a customer, an auditor or your board.
- Whether you need a configuration review, a penetration test or both. If you are unsure, read the guide linked below first; the two need different access and produce different reports.
- The baseline you want to be measured against, if any: the CIS Microsoft 365 Foundations Benchmark, CISA's SCuBA baselines, or a customer's own requirements.
Your tenant
Basic facts about the tenant
- How many Microsoft 365 tenants you run, and which are in scope.
- Roughly how many licensed users and guest users, and the licence plans in use. Some security settings exist only on higher plans, so this decides what can be assessed.
- The workloads you actually use: Exchange Online, SharePoint and OneDrive, Teams, Intune, and any others.
- How identity works: cloud-only accounts, accounts synchronised from on-premises Active Directory, or sign-in federated through another identity provider.
- Roughly how many people hold administrative roles, and whether you have emergency (break-glass) accounts.
- Whether a security operations team or managed detection provider watches the tenant.
For a penetration test
Extra items if you want a test
- The name of the person who can authorise testing of the tenant in writing. Microsoft's Rules of Engagement allow testing within your own tenant or assets you are explicitly authorised to test, so this authorisation matters.
- Anything that must stay off limits, such as executive mailboxes, emergency accounts or production configuration changes.
- Whether a phishing simulation is wanted. Microsoft's rules prohibit using Microsoft services to phish others, so this needs checking against the current text before it is agreed.
- Whether your monitoring team should be told in advance, or left to detect the activity.
- Testing windows that suit your change calendar.
Keep back
What is not needed at scoping
- No passwords, credentials, API keys, tokens or certificates.
- No administrator or Global Reader role yet. Access is created later inside your tenant, time-bound to an engagement, and removed at the end.
- No mailbox content, files, user lists, exports or other personal data.
- No configuration exports. Describing the tenant in words is enough to scope it.
Scope boundaries
What this does not cover
- SecureRoot does not list a Microsoft 365 or Entra ID service. This checklist is for whoever you engage to review or test your tenant.
- Scoping is not authorisation to test. Testing starts only after written authorisation from the tenant owner and agreed rules of engagement.
- Neither a review nor a test covers Microsoft's own infrastructure or other customers' tenants; Microsoft's rules prohibit that.
- On-premises Active Directory is a separate estate with its own scope.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- Microsoft Security Testing Rules of Engagement
Microsoft Security Response Center (MSRC) · Link checked 2026-11-13
- CIS Microsoft 365 Benchmarks (Microsoft 365 Foundations)
Center for Internet Security · Link checked 2026-11-13
- Secure Cloud Business Applications (SCuBA) Project
Cybersecurity and Infrastructure Security Agency (CISA) · Link checked 2026-11-13
Related
Services and help that go with this
- Microsoft 365 configuration review vs penetration testing
What each is, what Microsoft allows, and what each delivers.
- Active Directory audit
For the on-premises directory behind a hybrid tenant.
- Evidence handling
How access and evidence are handled once work starts.
Talk through your tenant
Send SecureRoot the answers above and what the result is for. We will say plainly what we can and cannot help with.