AuditM365 — Microsoft 365 & Intune security audit

The problem.

IT providers (MSPs) managing Microsoft 365 for their clients have to prove a tenant's security level: admin MFA, Conditional Access, mail forwarding, SharePoint sharing, Intune compliance, Defender… By hand, that is days of work across a dozen consoles. Most tools on the market send client data to a third-party service, which many clients refuse.

In pictures.

Screenshots taken on a fictitious demo tenant.

Tenant overview: collection quality, the 3 actions for this week, figures per service.

Audit results: 86 controls with severity, effort and remediation guide.

ANSSI / GDPR view: each measure of the French hygiene guide mapped to controls.

Portfolio view for MSPs: every tenant on one screen.

Privileged access: permanent roles, PIM, accounts without MFA.

What I built.

Read-only collection

Windows application (Inno Setup installer, automatic updates through GitHub Releases): no server to install.
One-click provisioning: the app creates the Entra App Registration with read-only permissions only, plus a certificate for SharePoint.
16 PowerShell collectors (Entra ID, Conditional Access, Exchange, Teams, SharePoint, Intune, Defender, MDE, Purview, DLP, Defender for Cloud Apps, Sentinel, logs, licences, Power Platform…) running in parallel.
Resilient to partial Microsoft responses: retries, full pagination, and a “Collection quality” panel that honestly states what could not be read instead of showing a false “compliant”.

Control engine

86 scored controls: severity, remediation effort, suggested deadline, and the evidence read from the tenant.
Every control ships with a step-by-step remediation guide, a script and a verification method.
Mapped to CIS Microsoft 365, ISO 27001:2022, NIS2, the French ANSSI hygiene guide and GDPR (dedicated view and report appendix).

Reporting

Local web dashboard: score, “the 3 things to do this week”, per-service detail, score trend across audits.
PDF, Word and PowerPoint reports generated on the workstation (Node.js: docx, pptxgenjs), Excel export of findings.
Portfolio view for MSPs: all tenants on one screen, scheduled audits, e-mail and Teams alerts.

The product around it

Licence server (Flask, Stripe): free 24-hour trial, Standard (1 tenant), Pro (5) and MSP (unlimited) plans.
Public website on Cloudflare Workers with a 13-minute HLS demo video, chapters and a Q&A assistant.
Prospecting assisted by 9 AI agents (see the dedicated project), every e-mail approved by a human.

The architecture.

Windows workstationAuditM365.exe

Admin sign-inread-only · certificate

Microsoft GraphEntra · Intune · Defender

PowerShellExchange · Purview · Teams

SharePointsites · sharing

16 collectorsin parallel

86 controlsscored + evidence

Dashboardlocal

ReportsPDF · Word · PowerPoint

Security & guardrails.

Read-only end to end: nothing is ever written to the audited tenant.
No tenant data leaves the auditor's workstation: no third-party cloud.
Secrets stored locally, never in code; licence keys verified server-side.
Every release reviewed (security and code) before publishing, then tested on real tenants.

The results.

In production and sold under licence, with a public website and a video demo.
Real audit measured at about 25 minutes on a tenant with thousands of users, versus several days by hand.
38 releases shipped in 2026, from v1.1 to v1.7.1.