CIS Microsoft 365 Assessments Across Multiple Client Tenants

If you run Microsoft 365 assessments for other organisations — as an MSP, a consultancy, or an independent auditor — the hard part is rarely the first tenant. It is the twelfth. The benchmark does not change between clients, but the manual effort does, and most teams end up rebuilding the same evidence pack by hand every time.

This guide lays out a repeatable workflow for assessing the CIS Microsoft 365 Foundations Benchmark v7.0.0 across a portfolio of client tenants: what is identical everywhere, what genuinely varies per tenant, and where the per-tenant hours actually go.

The fixed part: 160 controls across 9 sections

CIS Microsoft 365 Foundations Benchmark v7.0.0 defines 160 controls across 9 top-level sections. That scope is identical in every tenant you assess, which is exactly what makes the work systematisable in the first place.

• Section 1 — Microsoft 365 admin center (15 controls): administrative accounts, Microsoft 365 Groups, password and related tenant policies
• Section 2 — Microsoft Defender for Office 365 (21 controls): Safe Links, Safe Attachments, threat policies, priority-account protection
• Section 3 — Microsoft Purview (5 controls): audit log search, Data Loss Prevention, Information Protection
• Section 4 — Microsoft Intune (2 controls): device compliance policies, device enrollment restrictions
• Section 5 — Microsoft Entra, Identity (63 controls): MFA, password protection, Conditional Access, authentication methods, Privileged Identity Management
• Section 6 — Microsoft Exchange Online (13 controls): mailbox auditing, mail flow and anti-phishing, Outlook add-ins, Exchange modern authentication
• Section 7 — SharePoint Online and OneDrive (12 controls): external sharing, link defaults, site and OneDrive settings
• Section 8 — Microsoft Teams (17 controls): file sharing, external access, apps, meetings, messaging policies
• Section 9 — Microsoft Fabric and Power BI (12 controls): tenant settings

Two numbers drive capacity planning. 143 of the 160 controls are classified Automated in the benchmark itself — they can be evaluated by reading configuration state. The remaining 17 are Manual, requiring a person to inspect something the API does not expose cleanly. Those 17 are the only controls whose cost scales linearly with your client count. Everything else can be collected the same way every single time.

What actually varies per tenant

Licensing decides which controls are even in scope

The benchmark tags every control with a profile. Across the 160 controls:

• E3 Level 1 — 100 controls
• E3 Level 2 — 37 controls
• E5 Level 1 — 14 controls
• E5 Level 2 — 9 controls

That works out to 114 Level 1 and 46 Level 2 controls. The practical consequence for a multi-tenant practice: a client on E3 licensing cannot satisfy the 23 E5-profile controls without buying the licences that back them. Scoping an engagement therefore starts with confirming what the tenant is actually licensed for. Reporting an E5 control as a failure in an E3 tenant is noise, and clients notice noise.

Level matters too. Level 1 controls are the safe, minimal-impact baseline. Level 2 controls are stricter and security-focused, and several will visibly change how people work. Agree in writing which level the engagement targets before you hand over a findings list, or you will spend the readout defending recommendations the client never asked for.

Nine admin surfaces, every time

The 160 controls are spread across nine distinct administrative surfaces:

• Microsoft 365 admin center
• Microsoft Entra admin center
• Microsoft Defender, including Defender for Office 365
• Microsoft Purview compliance portal
• Microsoft Intune admin center
• Exchange admin center and Exchange Online PowerShell
• SharePoint admin center and OneDrive
• Microsoft Teams admin center
• Microsoft Fabric, the Power BI admin portal

Done by hand that is nine sign-ins per tenant, each with its own navigation, its own export quirks, and its own screenshots. Multiply by a portfolio and it becomes clear that collection, not analysis, is the bottleneck. The analysis is the part your clients are paying for.

A workflow that survives the twelfth tenant

1. Onboard with read-only access

Connect each client tenant using read-only Microsoft Graph permissions. No agents to deploy, no admin password sharing. This matters commercially as much as technically: a read-only, revocable grant is far easier to get signed off by a client’s security team than a request for standing administrative credentials, and it removes the awkward conversation about what your staff can change in someone else’s tenant.

2. Collect once, automatically

Run the assessment and let it walk all nine admin surfaces in a single pass. A full scan completes in 20–25 minutes depending on tenant size. The practical effect is that data collection stops being an activity you block out half a day for and becomes something you start at the beginning of a kickoff call and review before it ends.

Because the scope is fixed at 160 controls, the second tenant costs no more to collect than the first. That is the whole economic argument for standardising on the benchmark rather than assembling a bespoke checklist per client.

3. Triage by section weight, not alphabetically

Section 5, Microsoft Entra and identity, holds 63 of the 160 controls — more than the next three largest sections combined. On a time-boxed first-pass engagement, identity is where the findings density is, and it is where the findings a client actually cares about tend to live.

Section 2, Defender for Office 365, follows at 21 controls, then Section 8, Teams, at 17. At the other end, Sections 3 and 4 together account for just 7 controls between them: quick to close out, but not where a first pass should begin. Working the sections in descending weight rather than in numerical order is the single cheapest change most practices can make to their readout quality.

For a fuller treatment of sequencing and what each section covers, see the CIS Microsoft 365 Foundations Benchmark breakdown.

4. Produce the deliverable, do not assemble it

The artefact a client pays for is the report, not the scan. A CIS-aligned PDF report containing findings, per-control evidence, and a timestamped tenant snapshot is what closes the engagement. Alongside it, an audit-ready evidence export answers the follow-up questions an auditor will raise, and copy-paste remediation scripts — PowerShell, or admin portal steps, generated per finding — turn a list of problems into work the client’s IT team can execute without booking another call with you.

That last point is where multi-tenant practices gain or lose margin. If every finding needs a hand-written remediation note, the report is a writing project. If remediation steps come out of the assessment, the report is an export.

5. Give the client a seat, not a PDF thread

A read-only auditor seat lets you invite the client, or their external auditor, straight into the results rather than emailing revisions of a document. Team management and activity logs cover the other half of the problem: on a portfolio, you need to know which of your consultants ran which assessment against which tenant, and when. Multi-tenant support means subsidiaries and client tenants sit in one workspace instead of one login per customer.

Licensing the work the way the work is actually sold

Assessment engagements and managed compliance are different commercial shapes, and forcing one into the other is how practices end up paying for seats they do not use.

• Assessment License — one-time, per tenant, with a flexible duration that expires when the audit closes. This is the fit for point-in-time engagements: you buy a licence for the tenant you are assessing, deliver the report, and the licence ends with the work. No annual commitment for a client you may audit once.
• Continuous Compliance — an annual subscription across four tiers based on licensed Microsoft 365 user count: Small for 1 to 100 users, Medium for 101 to 500, Large for 501 to 1,000, and Enterprise for 1,000 to 10,000 or more on a custom quote. This is the fit for clients you manage on an ongoing basis rather than audit periodically.

Per-tenant Assessment Licensing for MSPs, VARs, consultancies, and independent auditors is covered on the partner program page.

When the assessment stops being an assessment

A point-in-time report is accurate on the day it is generated and decays from there. Tenants drift: an administrator relaxes a sharing default to unblock a project, a Conditional Access policy gets an exclusion added during an incident, a new admin account is created outside the normal process. None of that shows up in a PDF from last quarter.

For clients under an ongoing arrangement, continuous scanning with drift detection closes that gap — you are alerted when a control that previously passed regresses, rather than discovering it at the next annual review. A scheduler covers the middle ground, running daily, weekly, or monthly scans over any combination of controls or predefined rule sets, with email notifications on findings and drift.

The useful framing for a client conversation: the assessment tells them where they are, and drift detection tells them whether the remediation they paid for actually held. Those are two separate pieces of work, and the second one is recurring revenue.

Where to start

Pick the client tenant you know least well, not the one you know best. The benchmark is a fixed 160 controls regardless, and an unfamiliar tenant will tell you more about how much of your current process is manual habit than a tenant you have already hardened by hand.

The free trial runs for 14 days with full access to all 160 controls — enough to see the collection and reporting flow end to end against a real tenant before committing to a licensing model.