Walking through a 5-domain Microsoft 365 audit in 30 seconds The article describes a new open-source PowerShell toolkit designed for solo administrators of small Microsoft 365 tenants, addressing the gap between overly complex enterprise tools and insufficient security recommendations. The tool performs a single-command audit across five security domains, producing a ranked report with findings mapped to major frameworks like NIST and ISO 27001, and provides ready-to-deploy remediation artifacts. It is specifically opinionated for small, cloud-only organizations using M365 and Cloudflare, and is available on GitHub under an MIT license. If you administer a small Microsoft 365 tenant, here's the question that probably stopped you somewhere between "I should check our security posture" and actually doing it: Which tool? Microsoft Secure Score gives recommendations but no remediation artifacts. CISA ScubaGear is excellent but federal-grade, overkill for a 20-person mid-market shop. M365DSC is configuration-as-code, which is great when you're a DSC shop and terrible when you're not. CIPP is purpose-built for MSPs managing many tenants, and solo defenders don't need that fan-out. There was a gap: an opinionated audit-plus-remediation toolkit for a solo defender running M365 + Cloudflare in a small org. I built one. Tagged 1.0 today. github.com/ibondarenko1/m365-security-operations https://github.com/ibondarenko1/m365-security-operations What it actually does One PowerShell command sweeps five domains, produces a single markdown report ranking findings P1/P2/P3, and links every gap to a ready-to-deploy remediation artifact: | Domain | Audit | Remediation | |---|---|---| | Sentinel detection engineering | Workspace state, daily quota, retention, Sentinel onboarding, analytics rules, Fusion, Activity Log diagnostic, data connectors, workbooks, hunting queries, automation playbooks, watchlists, UEBA, threat intelligence | 5 MITRE-mapped ARM templates + 10 KQL hunting drills | | Defender for Office 365 | Anti-phish impersonation, anti-spam, anti-malware, Safe Attachments, Safe Links, Tenant Allow/Block List, DKIM, ZAP, outbound thresholds, transport rules, Attack Simulation Training | Exchange Online PowerShell remediation scripts | | DNS + email authentication | MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, NS, Autodiscover, CAA, DNSSEC, SPF lookup count, DMARC sub-policy | Cloudflare Worker + DNS deployment script for MTA-STS + TLS-RPT | | Identity hardening | Conditional Access policies, authorization policy, directory roles, sign-in logs, authentication methods, app consent, service principal credentials, named locations, cross-tenant access, sign-in risk, SSPR | 6 baseline Conditional Access policy JSONs ready for Graph PUT | | Defender for Cloud | Per-plan pricing tier, Secure Score, recommendations by severity, AI plane, continuous export to Sentinel | Plan-tier upgrade methodology + walkthrough | Every finding is tagged with framework controls: NIST CSF 2.0, NIST SP 800-53, NIST SP 800-63B, ISO 27001:2022, MITRE ATT&CK, Microsoft Cloud Security Benchmark, RFC references. Try it in 30 seconds git clone https://github.com/ibondarenko1/m365-security-operations cd m365-security-operations ./examples/run-mock.ps1 That runs the full audit against bundled sanitized fixtures and produces a complete sample report 58 findings across 5 domains . No Azure access required. Open reports/