Microsoft 365 tenant scans

Scan a connected Microsoft 365 / Entra ID tenant from RedKit and get a report against the CIS Microsoft 365 Foundations Benchmark v7.0. Beta.

RedKit can scan a connected Microsoft 365 / Entra ID tenant and report its posture against the CIS Microsoft 365 Foundations Benchmark v7.0. The scan is read-only.

Tenant scans are in beta: more rules arrive with each version.

Before you start

The tenant must be connected to your organization first. A tenant administrator grants read-only consent to the mlab-scan app from Microsoft's own consent page. See Verify your infrastructure → Microsoft 365.

Run a scan

Open RedKit → Microsoft 365. Your connected tenants are listed with their last scan.

Launch a scan of the tenant. One scan uses one RedKit credit.

A scan usually takes under a minute. The report appears on its own when the results arrive.

Owners, Admins and Members can launch a scan. Tenant scans also appear in RedKit history with the other audits.

What is checked

The first rules cover tenant-wide settings:

App registration by users
Tenant creation by users
User consent to applications
The admin consent workflow
Guest access and invitations
App credential policies

Reading the report

Part	What it shows
Findings	Each failing rule, with the setting found and the value expected, by severity
Passing rules	The rules the tenant complies with
Not evaluated	Rules that could not be checked, with the reason (for example a permission not granted to `mlab-scan`, or a licence the tenant lacks)
Microsoft Secure Score	Shown next to the findings for comparison, overall and by category
Since the previous scan	New and fixed findings, and how findings and Secure Score move over time
Permissions read by the scan	What the scan could read in the tenant

A rule listed as Not evaluated is not a pass. Grant every permission the mlab-scan app requests so the scan can read all the settings it checks.

Open Microsoft 365 in RedKit

Scan a connected tenant.

Connect a tenant

Grant read-only consent.