This audit was generated at m365audit.org.

M365 Audit

Microsoft 365 Security Audit

Hope Community Foundation · Generated July 16, 2026

62%

Hope Community Foundation

Security baseline score

  • 47 active users
  • 12 groups
  • 3 verified domains
  • 4 without MFA enforcement

Priority action items

High

High
2 shared mailboxes allow direct sign-in
Shared mailboxes should be accessed through delegated permissions from named user accounts.
Recommended: Block sign-in and remove licenses unless a documented exception requires one.
High
4 active user accounts are not protected by MFA
These users are registered or unregistered but are not covered by an enforced MFA policy.
Recommended: Include every active user in an enabled Conditional Access MFA policy.
High
External forwarding is enabled for 2 mailboxes
Messages are being automatically sent to addresses outside the organization.
Recommended: Confirm each destination is approved and remove unnecessary forwarding.

Medium

Medium
3 inactive accounts remain enabled
These accounts have not signed in for at least 90 days.
Recommended: Validate ownership, block sign-in, and reclaim unused licenses.
Medium
One mailbox is above 90% of its quota
The mailbox may soon be unable to send or receive messages.
Recommended: Archive or remove old mail before the mailbox reaches its limit.

Low

Low
2 third-party apps have broad tenant access
The applications can read sensitive directory, mail, or file information.
Recommended: Verify business ownership and remove grants that are no longer required.

Tenant summary

Organization details, high-level counts, and SharePoint storage usage. Admin portal →

Active users
47		 Groups
12		 Verified domains
3

SharePoint storage

Total 1494 GB Used 624.8 GB Remaining 869.2 GB % used 41.8%

Admin portal → · Entra admin portal →

Licenses

Subscribed Microsoft 365 licenses and assigned vs. available seats in your tenant. Licenses section of the Admin portal →

LicenseTotalConsumedRemaining
Microsoft 365 Business Premium50473
Microsoft Teams Phone Standard1082
Power BI Pro541

Domains (3)

These domains have been added to the Microsoft 365 admin portal. Domains in admin portal →

Managed: Microsoft 365 manages sign-in for this domain.
Federated: A third-party identity provider manages sign-in via SSO.

DomainAuthenticationDefaultInitial
hopecommunity.exampleManagedYesNo
hopecommunity.onmicrosoft.comManagedNoYes
hopefoundation.exampleManagedNoNo

Security snapshot

Authentication and identity posture across your Microsoft 365 tenant. Entra admin portal →

User MFA coverage

How user accounts are protected by MFA registration, Conditional Access, and Security Defaults. Entra admin portal →

MFA registered
45		 MFA enforced
43		 Without enforcement
4
Covered by CA MFA
43		 Covered by Security Defaults
0		 Registered only (not enforced)
2

Identity settings

Tenant-wide identity configuration including Security Defaults and Conditional Access policy count. Entra admin portal →

Security DefaultsDisabled
Enabled CA policies4
Groups12
Verified domains3

Nonprofit security baseline

Recommended Microsoft 365 settings for nonprofit organizations, grouped by area. ✅ aligned · ❌ action recommended · — not verified. Entra admin portal →

Global Checks

Tenant-wide settings that affect security posture across Microsoft 365, including audit logging and external sharing. Microsoft Purview compliance portal →

CheckStatusNotes
Enable Unified Audit Log ✅ Unified audit logging is enabled (Microsoft Graph)
Show usernames in reports ✅ Reports display identifiable usernames (Microsoft Graph)
Restrict guest user directory access ❌ Guests have limited rather than restricted directory access (Microsoft Graph)

Defender Checks

Microsoft Defender for Office 365 checks verify email and collaboration protections recommended for nonprofit tenants. Microsoft Defender portal →

CheckStatusNotes
Anti-phishing policy ✅ Anti-phishing protection is configured
Safe Links for email messages ✅ Safe Links is enabled for email
Safe Links for Office applications ❌ Safe Links for Office applications is missing from your environment
Safe Attachments policy enabled ✅ Safe Attachments is enabled
Safe Attachments in block mode ❌ Safe Attachments is configured for dynamic delivery instead of block mode
Zero-hour auto purge (phishing) ✅ ZAP for phishing is enabled

Exchange Checks

Exchange Online settings for mail transport, archiving, DKIM, and mailbox security. Verified via Microsoft Secure Score recommended actions. Exchange admin portal →

CheckStatusNotes
Block external mail forwarding ❌ Automatic external forwarding is allowed
DKIM signing enabled ✅ DKIM is enabled for the primary custom domain
Mailbox auditing enabled ✅ Mailbox auditing is enabled by default
Modern authentication enabled ✅ Modern authentication is enabled
Shared mailbox sign-in disabled ❌ Two shared mailboxes permit direct sign-in

SharePoint Checks

SharePoint and OneDrive tenant settings for external sharing, sync, and site security. Verified via Microsoft Graph and Microsoft Secure Score recommended actions. SharePoint admin portal →

CheckStatusNotes
Disable custom scripts on SharePoint sites ✅ Custom scripts are restricted
Disable legacy basic authentication for SharePoint ✅ Legacy authentication protocols are disabled (Microsoft Graph)
Disable Legacy Workflows ❌ Legacy workflow features are still available
Disable Re-sharing by External Users ✅ External users cannot re-share content (Microsoft Graph)
Disable SharePoint Store access ✅ SharePoint Store access is disabled
Disallow downloading infected files from SharePoint ✅ Infected file downloads are blocked
Enable SharePoint and OneDrive integration with Azure AD B2B ✅ Azure AD B2B integration is enabled
Set Add Shortcuts To OneDrive button state ✅ Add to OneDrive shortcuts are available
Hide SharePoint sync button (prefer OneDrive shortcuts) ❌ Sync button is visible on personal OneDrive sites (Microsoft Graph)

Teams Checks

Microsoft Teams messaging safety settings for weaponizable file and malicious URL protection. Verified via Microsoft Secure Score recommended actions. Microsoft Teams admin center →

CheckStatusNotes
Enable Weaponizable File Protection ✅ Weaponizable file protection is enabled
Enable Malicious URL Protection ❌ Malicious URL protection is missing from your environment

Intune Checks

Microsoft Intune device enrollment and Windows management settings verified via Microsoft Graph where available. Microsoft Intune admin center →

CheckStatusNotes
Require MFA to register or join devices ✅ MFA is required for device registration (Microsoft Graph)
Set device cleanup rules ✅ Inactive devices are retired after 90 days (Microsoft Graph)
Enable Windows diagnostic data ❌ Required Windows diagnostic data is not enabled
Set Windows Backup and Restore state ✅ Windows backup is configured

Entra Checks

Microsoft Entra ID tenant settings verified via Microsoft Graph where available. Authentication method checks recommend enabling FIDO2, software OATH, TAP, and Microsoft Authenticator protections. Entra admin portal →

CheckStatusNotes
Complete Authentication Methods Policy Migration ✅ Authentication methods migration is complete (Microsoft Graph)
Disable M365 tenant creation by users ✅ Non-admin users cannot create tenants (Microsoft Graph)
Do not expire passwords ✅ Cloud-managed passwords do not expire (Microsoft Graph)
FIDO2 security key ❌ FIDO2 is not enabled for all users (Microsoft Graph)
Software OATH tokens ✅ Software OATH tokens are enabled (Microsoft Graph)
Temporary Access Pass (TAP) ✅ Temporary Access Pass is enabled (Microsoft Graph)
Microsoft Authenticator ✅ Microsoft Authenticator is enabled (Microsoft Graph)
Microsoft Authenticator — passwordless ❌ Passwordless Authenticator sign-in is not enabled for all users (Microsoft Graph)
Microsoft Authenticator — require location ✅ Location information is required (Microsoft Graph)
Microsoft Authenticator — number matching ✅ Number matching is required (Microsoft Graph)

Conditional Access Checks (4/5)

Recommended Conditional Access controls matched by policy settings. Entra admin portal →

CheckStatusWhat we look forMatching policy
Require MFA for admins ✅ Require MFA for privileged directory roles across all cloud apps. Require MFA for administrators
Block legacy authentication ✅ Block legacy client protocols for all users. Block legacy authentication
Require MFA for all users ✅ Require MFA for all users and cloud applications. Require MFA for all users
Block high-risk sign-ins ❌ Block sign-ins assessed as high risk. —
Require compliant devices ✅ Require a compliant or hybrid joined device for sensitive access. Require compliant devices

Users (50)

User accounts grouped by mailbox type. MFA enforcement reflects Conditional Access (preferred), Security Defaults, or legacy per-user MFA when tenant-wide policies are not in place. Entra admin portal →

Regular users (47)

✓Avery Johnson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: Yes MFA enforced: Yes
Microsoft 365 Business Premium
Global Administrator
✓Jordan Lee
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: Yes MFA enforced: Yes
Microsoft 365 Business Premium
Security Administrator
✓Morgan Patel
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: Yes MFA enforced: Yes Mailbox >90%
Microsoft 365 Business Premium
Exchange Administrator
✓Taylor Rivera
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: Yes MFA enforced: Yes
Microsoft 365 Business Premium
SharePoint Administrator
✓Casey Nguyen
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: Yes MFA enforced: Yes
Microsoft 365 Business Premium
Teams Administrator
✓Riley Brooks
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✗Jamie Carter
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: No
Microsoft 365 Business Premium
✗Drew Wilson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: No
Microsoft 365 Business Premium
✗Skyler Davis
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: No
Microsoft 365 Business Premium
✗Robin Clark
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: No
Microsoft 365 Business Premium
✓Alex Martinez
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Bailey Thompson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Cameron White
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Dakota Harris
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Elliot Martin
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Finley Garcia
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Gray Anderson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Harper Moore
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Indigo Jackson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Jules Thomas
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Kendall Young
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Logan King
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Marley Wright
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Noel Scott
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Oakley Green
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Parker Adams
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Quinn Baker
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Reese Nelson
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Sage Hill
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Tatum Campbell
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Urban Mitchell
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Val Jordan
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Winter Roberts
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Xan Phillips
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Yael Evans
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Zion Turner
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Adrian Torres
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Blair Parker
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Charlie Collins
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Devon Edwards
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Emerson Stewart
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Frankie Sanchez
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Gale Morris
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Hayden Rogers
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Ira Reed
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Jess Cook
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium
✓Kai Morgan
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: Yes
Microsoft 365 Business Premium

Shared mailboxes (2)

✗Donations
[email protected]
Enabled: Yes Type: Member Licensed: No Admin: No MFA enforced: No
✗Programs
[email protected]
Enabled: Yes Type: Member Licensed: Yes Admin: No MFA enforced: No
Microsoft 365 Business Premium

Resource & equipment mailboxes (1)

✗Conference Room
[email protected]
Enabled: Yes Type: Member Licensed: No Admin: No MFA enforced: No

Groups (12)

Microsoft 365, security, and distribution groups in your directory. Visibility is Public, Private, or Hidden membership (Microsoft 365 groups default to Public when unset). Entra admin portal →

Display nameEmailTypeMail-enabledVisibility
All Staff [email protected] Microsoft 365 Yes Public
Board Members [email protected] Microsoft 365 Yes Private
Programs Team [email protected] Security Yes Private
Intune - Managed Devices — Security No Private
Volunteers [email protected] Distribution Yes Private
Development Team [email protected] Microsoft 365 Yes Private
Finance Committee [email protected] Microsoft 365 Yes Private
Event Coordinators [email protected] Distribution Yes Private
Leadership [email protected] Security Yes Private
MFA Registration Campaign — Security No Private
Conditional Access Exclusions — Security No Private
Newsletter Subscribers [email protected] Distribution Yes Public

Third-Party Apps With Broad Access (2)

OAuth consents with sensitive mail, file, or directory access. Review for shadow IT. Entra admin portal →

ApplicationConsent typeGranted toPermissions
Community CRM Connector
2c6e4e78-6d39-4a4d-9421-54dc694a3431		 Tenant-wide All users Mail.Read, Files.ReadWrite.All, User.Read.All
Volunteer Scheduling Export
b8302f25-a3d1-41db-b421-b55d9ab42f11		 Tenant-wide All users Directory.Read.All, Calendars.Read

Items needing review

Exceptions and risks are listed below to keep this audit concise.

Users Without MFA Enforcement (4)

Active member accounts not covered by Conditional Access MFA, Security Defaults, or legacy per-user MFA enforcement. Entra admin portal →

Display nameUser principal nameMFA registered
Jamie Carter[email protected]Yes
Drew Wilson[email protected]No
Skyler Davis[email protected]Yes
Robin Clark[email protected]No

Directory Role Assignments (5)

Administrative roles with standing access — review regularly and follow least privilege. Entra admin portal →

RoleUsers (sign-in names)
Exchange Administrator[email protected]
Global Administrator[email protected]
Security Administrator[email protected]
SharePoint Administrator[email protected]
Teams Administrator[email protected]

Inactive Accounts (3)

No interactive or non-interactive sign-in in the last 90 days. Entra admin portal →

Display nameUser principal nameDays inactive
Former Program Manager[email protected]184
Seasonal Volunteer[email protected]132
Legacy Service Account[email protected]418

Shared Mailbox Issues (2)

Shared mailboxes should remain sign-in disabled and unlicensed. Users should access them via delegated Full Access on their own accounts. Exchange admin portal →

MailboxLoginIssue
Donations[email protected]Sign-in enabled
Programs[email protected]Licensed and sign-in enabled

Mailboxes With External Forwarding (2)

These mailboxes forward incoming mail to an address outside your verified domains. Review each destination and remove any forwarding that is not expected. Exchange admin portal →

MailboxEmailForwards toKeeps copy
Executive Director[email protected][email protected]Yes
Events[email protected][email protected]No

Mailbox Near Quota (1)

Mailboxes at or above 90% of prohibit send/receive quota. Exchange admin portal →

UserEmailUsedQuota% Used
Morgan Patel[email protected]47.1 GB50.0 GB94.2%

Risky Mailbox Rules (2 of 34 total)

Inbox rules that may forward, redirect, delete, or act on all incoming mail. Review regularly to confirm they are legitimate. Exchange admin portal →

UserRuleOnActionWhen
[email protected] Forward event registrations Yes Forward externally
[email protected] Delete automated alerts Yes Delete message
  • Sender contains noreply
  • Delete without notifying the user

Read-only audit · No changes were made to your tenant · Use your browser Print dialog to save as PDF

Disclaimer: This report is provided as-is with no guarantees and no support. We do not guarantee the accuracy or completeness of the information shown. Audit data is not stored on our servers.