Microsoft 365 Security Assessment vs Penetration Test
If someone has told you that your organisation needs a penetration test and you are not sure whether they mean an M365 security assessment or an actual pen test, this guide is for you. They are different engagements, they answer different questions, they cost different amounts, and the right choice depends on what you are trying to find out.
What a Microsoft 365 security assessment is
A Microsoft 365 security assessment - also called a tenant audit or tenant health check - is a structured review of your environment's configuration against a defined security baseline. An assessor reviews your Conditional Access policies, Defender settings, admin account hygiene, external sharing configuration, DLP policies, licensing and other configuration domains.
The output is a findings report: what is misconfigured, what is missing, what is exposed, and what to do about it. The assessor is not attempting to break into your environment. They are reviewing whether your configuration matches what it should be.
A good M365 security assessment takes half a day to two days of skilled work, produces a written findings report with prioritised remediation recommendations, and requires read-only access to your tenant.
What a penetration test is
A penetration test (pen test) is an authorised simulation of an attack against your environment. A pen tester attempts to exploit vulnerabilities - in your network perimeter, your applications, your endpoints, your identities, or some combination - to demonstrate what an attacker could actually do if they gained a foothold.
A pen test answers the question: given the current state of my environment, how far could an attacker get? A configuration assessment answers the question: does my environment match the security baseline it should?
Pen tests require significantly more time and cost than configuration assessments. A scoped external network pen test typically starts from $5,000-$8,000 AUD. A full internal and external pen test for a mid-sized organisation commonly exceeds $15,000. They also require formal scoping, rules of engagement, and careful scheduling to avoid disrupting production systems.
Side-by-side comparison
| Factor | M365 Security Assessment | Penetration Test |
|---|---|---|
| What it answers | Is the configuration correct? | Could an attacker exploit the environment? |
| Method | Configuration review against baseline | Active exploitation attempt |
| Access required | Read-only Global Reader role | Varies - network access, credentials, or both |
| Typical cost (AUD) | $2,500 to $4,500 | $5,000 to $20,000+ |
| Typical duration | Half a day to two days | One to two weeks |
| Deliverable | Written findings report, remediation recommendations | Technical report with evidence of exploitation |
| Who needs it | Any organisation using Microsoft 365 | Organisations with compliance requirements or mature security posture |
| How often | Annually or after major changes | Annually for high-risk environments; as required for compliance |
| Changes environment | No - read only | No - but may stress-test production systems |
Which one do you actually need?
For most small and mid-sized Australian businesses that have not conducted a systematic review of their Microsoft 365 environment, a configuration assessment is the right starting point. The majority of successful attacks against SMBs exploit basic configuration gaps - no MFA, legacy authentication enabled, overly permissive admin accounts, misconfigured Conditional Access - not zero-day vulnerabilities that a pen test would find.
An M365 security assessment will identify and help you fix those gaps. Running a pen test on an environment with MFA disabled and legacy auth enabled is useful as a demonstration, but you do not need to pay for a simulated attack to know you need to enable MFA.
Start with a security assessment if:
- You have not reviewed your Microsoft 365 configuration in the past 12 months
- You do not have documented Conditional Access policies or a security baseline
- You are unsure whether your MFA, Defender, or external sharing settings are correctly configured
- You want a prioritised list of security improvements with effort and impact estimates
- You are preparing for a Copilot deployment or a governance programme
Consider a penetration test if:
- Your organisation has a contractual or regulatory requirement for annual pen testing (common in financial services, government supply chain, defence industry)
- You have already implemented the security baseline and want to validate it holds under attack simulation
- You are concerned about specific attack scenarios - insider threat, credential theft, lateral movement - that a configuration review would not surface
- You are preparing for ISO 27001, SOC 2, or Essential Eight ML3 assessment where pen test evidence is required
Can you do both?
Yes, and for organisations with mature security requirements, both are appropriate. The recommended sequence is: assessment first, remediation second, pen test third. Running a pen test against an unpatched configuration gives you a long list of findings you already knew about. Running it after remediation gives you a meaningful validation of the controls you have put in place.
Some providers offer combined engagements - an M365 configuration review followed by a targeted identity and cloud attack simulation. This is appropriate for organisations that have already completed a basic security baseline and want to test whether it holds.
If your organisation has never had a systematic review of its Microsoft 365 security configuration, a pen test is premature. Fix the known configuration gaps first. Then validate whether the fixes hold.
Accuracy
Last reviewed: 9 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Microsoft 365 Security & Governance Baseline
An independent Microsoft 365 security assessment covering identity, Defender, device management, collaboration governance, licensing and data protection. Written findings report, prioritised remediation recommendations and review session. From $2,500.
Learn more