What You Need To Know About M365 Audits From Someone Who Helped Write The Blueprint

Building a new secure M365 environment has always been the easy part, but with the constantly shifting landscape keeping it secure is the challenge. The first step is reviewing your configuration - performing an M365 audit - but that is easier said than done...

So that's what we are going to focus on today - what we've learnt from performing these over the last five plus years. What works well, what to avoid, and what are the sneaky traps. Examples include: how to effectively scope an audit of M365; what you need to be to see all the settings (hint - it isn't as simple as the Global Reader role); and the actual mechanics of performing and reporting on.

Sam will also cover off so of the most common findings, what they mean to clients, and how to communicate them effectively.

Speaker: Sam Brazier-Hollins

Sam has been deploying, assessing and uplifting Microsoft 365 environments since the early days of Office 365 across government, critical infrastructure and enterprise. As one of the original authors of the DTA PROTECTED Utility Blueprint - now ASD Blueprint for Secure Cloud - Sam has seen the good, the bad, and the ugly when it comes to Microsoft 365, including what happens when it all goes wrong. But this has presented the opportunity to learn how they do this, and more importantly, how to prevent it.

Sam was award Microsoft MVP status for M365 and Copilot at the beginning of 2025 and is now the Head of Technical Consulting, with Fujitsu Cyber. He leads a diverse, specialist team across New Zealand and Australia who offer expertise in cyber security consulting including assessments and uplifts, security testing, and cyber-product professional services.

Sam has publicly spoken on various cyber security topics across ANZ, including AISA Cybercon, Gartner and AUSCERT.