Tenant Security Self-Assessment
Assess your own Microsoft 365 tenant across eight security and compliance domains. This assessment is designed to be completed using least-privilege, read-only permissions — no elevated roles or write access required.
Least Privilege: All information needed for this audit can be gathered with Global Reader, Security Reader, and Reports Reader roles — plus read-only Microsoft Graph API permissions. No Global Admin or write access is required.
Want your real tenant checked instead? Tenant Audit runs around 50 read-only checks against it for you.
About this tool
How Tenant Security Self-Assessment works
Work through eight domains: identity and access management, Conditional Access and Zero Trust, data protection, email security, endpoint management, collaboration security, compliance and governance, and backup and resilience. Each is scored on its own and adds up to an overall tenant score.
Everything it asks can be checked with Global Reader, Security Reader and Reports Reader, plus read-only Microsoft Graph permissions. The PDF report lists exactly which.
Want Andy Kemp Consulting to audit your tenant for you? That's the Tenant Audit.
Questions
Does it connect to my tenant?
Nothing. You answer questions from what you know about your tenant, or can check in the admin centres; the tool doesn't sign in to Microsoft 365 or read anything from it.
Where do my answers go?
Your answers stay in your browser and are worked out there. The site only counts, anonymously, that the tool was opened, finished or downloaded.
Do I need an account?
No account is needed to use it. Downloading the report needs a free andykemp.com account, which takes a minute to create.
How is this different from the Tenant Audit?
This self-assessment is a questionnaire you answer yourself. The Tenant Audit is a service: Andy Kemp Consulting runs around 50 read-only checks against your tenant and gives you scored findings.
Related tools
Use it with
- Tenant AuditA read-only Microsoft 365 tenant audit: around 50 checks across identity, privileged access, apps, Exchange, devices and collaboration, as scored findings.
- Entra ID Hygiene ScorecardScore your directory hygiene across account lifecycle, guest management, app registrations, and group governance.
- Backup & Recovery ReadinessEvaluate your Microsoft 365 backup posture across workload coverage, strategy, resilience targets, and operational maturity.
- Zero Trust ScorecardAssess your Microsoft 365 and Entra ID environment against core Zero Trust security principles.