VeyagoAudits · Microsoft 365 and software
Your software bill went up this year. Did your use of it?
Microsoft 365 prices rose in July 2026, and most organizations still pay for licenses nobody uses, accounts nobody owns and settings nobody has checked since setup. We audit your tenant and your software stack, then hand you a written list of what to fix and what it saves.
- One written priceBefore any work starts.
- Read-only accessWe can look, but can't touch.
- IndependentWe sell no licenses and take no commissions.
- Ready to act onA report your team can use the next day.
Why it pays for itself
Less than one year of the waste it finds.
Take a 60-person team on Microsoft 365 E3 at $39 per user per month. Finding the 15% that goes unused or oversized, which is typical, saves about $4,200 a year, every year. The audit costs $2,490, once.
Security findings don't show up on an invoice, but a forwarding rule nobody noticed or an admin account without MFA is where many small-business breaches start.
- 60 users × $39 × 12 months
- $28,080 a year
- 15% unused or oversized
- $4,212 a year
- The Audit, once
- $2,490
Cassian Drefke
Leads every audit. He has led two large Microsoft 365 tenant consolidations end to end, including cross-tenant mail, calendar and SharePoint migrations.
What you get
A report you can act on the next day.
Every finding has the same six fields: a number, what we found, why it matters, how serious it is, what it saves a year, and the exact setting to change and where.
- A one-page summary for whoever signs the budget: yearly savings, the five fixes that matter most, and an overall risk rating
- License savings, line by line: what you pay now and what you would pay
- Security findings, ranked by risk
- Housekeeping: stale sites, guests, storage
- A fix plan for the next week, month and quarter
- The raw data as CSV, for your IT
1.2 · LicensesLow risk
6 licensed users have not signed in for 90 days.
- Why it matters
- Each still costs a full E3 license every month.
- Saves
- $2,808 a year
- Fix
- Confirm with their managers, then remove the license in the Microsoft 365 admin center under Users.
4.2 · MailHigh risk
One mailbox forwards every message to a personal address outside the company.
- Why it matters
- Customer mail leaves the company without anyone deciding it should.
- Fix
- Remove the forwarding on the mailbox, then set automatic external forwarding to off in the outbound anti-spam policy.
Prices
One written price, before any work.
Every price excludes tax and is confirmed in writing after a free scope call. Nonprofits get 20% off every audit.
Microsoft 365 tenant audit
Audit
For an organization with up to 150 users on one tenant.
$2,490excl. tax
or €2,650
Report in 10 working days
- Licenses: unused, unassigned and oversized seats, add-ons paid for twice, renewal exposure
- Accounts: leavers still licensed, guests, shared accounts that can still sign in
- Identity: MFA coverage, admin roles, break-glass accounts, Conditional Access gaps
- Mail: SPF, DKIM and DMARC, external forwarding, phishing protection
- Data, apps and devices: sharing, stale Teams and sites, Copilot readiness, app consents, Intune
- A written report and a walkthrough with your team
Deep Audit
For 150 to 500 users, several tenants, or a merger ahead.
from$5,900excl. tax
or from €6,250
Report in 3 to 4 weeks
- Everything in the Audit
- Every tenant compared, and the settings that have drifted between them
- Merger or migration readiness: domains, clashing user names, mailbox sizes, calendar and room dependencies
- A cutover risk list and a rough migration plan
Software spend review
Essentials
For a business paying for up to 25 tools.
$1,290excl. tax
or €1,390
Register in 7 working days
- Every paid tool: owner, plan, seats, cost and billing cycle
- Seats paid for against seats used
- Tools nobody has opened in 90 days
- Tools that do the same job
- Renewal dates, notice periods and auto-renew clauses
Complete
For a business paying for up to 75 tools.
$2,890excl. tax
or €3,090
Register in 15 working days
- Everything in Essentials
- Tools paid for on personal cards and expense claims
- Security basics per tool: single sign-on, MFA, how many admins, where the data is kept
- Where a lower plan or annual billing saves money
Both reviews come as a spreadsheet register, one row per tool with the totals and savings worked out, a keep, cut or consolidate call on every tool, and a renewal calendar you can import.
Audit + Spend Review Essentials
Your tenant and every tool around it, in one report, in 10 working days.
$3,390 or €3,590
Book a scope call| Audit | Price (USD) | Price (EUR) | Size | Delivery |
|---|---|---|---|---|
| Microsoft 365 Audit | $2,490 | €2,650 | Up to 150 users | 10 working days |
| Microsoft 365 Deep Audit | from $5,900 | from €6,250 | 150 to 500 users, several tenants, or a merger | 3 to 4 weeks |
| Software Spend Review Essentials | $1,290 | €1,390 | Up to 25 tools | 7 working days |
| Software Spend Review Complete | $2,890 | €3,090 | Up to 75 tools | 15 working days |
| Audit + Spend Review Essentials | $3,390 | €3,590 | Up to 150 users and 25 tools | 10 working days |
Nonprofits: 20% off every audit. Build a Veyago Cockpit within three months of an audit, and the audit price comes off the Cockpit.
What we check
Twenty-four checks, each a line in the report.
This is the whole list for the Audit, with where each answer comes from. The Deep Audit adds the last three.
Licenses
- 1.1Seats purchased, assigned and left unassigned, for every plan Graph: subscribedSkus
- 1.2Licensed users with no sign-in for 30, 60 and 90 days Entra sign-in activity
- 1.3Right-sizing: people on E3, E5 or a Premium plan who only use the basics, such as no desktop apps, Intune or Defender Microsoft 365 usage reports
- 1.4Shared, room and resource mailboxes holding a paid license they don't need Exchange Online
- 1.5Add-ons bought twice and plans that overlap, such as a standalone Teams Phone on top of a bundle that already includes it Graph: licenseDetails
- 1.6Renewal dates, monthly or annual commitment, and how exposed you are to the next price rise Admin center billing
Accounts
- 2.1Leavers' accounts: disabled but still licensed, or enabled but unused Entra ID
- 2.2Guest users: how many, when they were last active and who invited them Entra ID
- 2.3Service and shared accounts that can still sign in interactively Entra ID
Identity
- 3.1MFA coverage per person, and legacy sign-in methods still allowed Entra authentication methods
- 3.2Admin roles: how many Global Admins, admins without MFA, standing against eligible roles Entra roles
- 3.3Break-glass accounts: present, and excluded from the right policies Conditional Access
- 3.4Conditional Access policies: gaps, policies left in report-only, exclusions Conditional Access
- 4.1SPF, DKIM and DMARC for every domain, and how strict the DMARC policy is DNS and Exchange Online
- 4.2Mail forwarded to outside addresses, and suspicious inbox rules Exchange Online
- 4.3Anti-phishing and impersonation protection settings Defender for Office 365
Files and sites
- 5.1External sharing for every SharePoint site and OneDrive, and "anyone" links in use SharePoint admin
- 5.2Stale Teams and sites: no activity in 180 days, no owner, or a single owner Graph and usage reports
- 5.3Storage used against your quota, and what extra storage costs you SharePoint admin
- 5.4Copilot readiness: sensitive sites everyone can read, and overshared files SharePoint permissions
Apps, devices and logging
- 6.1Third-party apps with consent, high-risk permissions, and who is allowed to consent Entra enterprise apps
- 6.2App registrations with secrets that have expired or are about to Entra app registrations
- 7.1Intune enrollment, compliance policies, and unmanaged devices reaching company data Intune
- 8.1Whether the unified audit log is on, and how long it keeps records Purview
Deep Audit only
For 150 to 500 users, several tenants, or a merger ahead, the Deep Audit adds three more.
- 9.1Every tenant compared: where settings have drifted between them
- 9.2Merger or migration readiness: domains, clashing user names, mailbox sizes, calendar and room dependencies
- 9.3A cutover risk list and a rough migration plan
Read-only, and you hold the key
You grant two read-only roles, Global Reader and Reports Reader, and you remove them when we are done. If our tooling needs an app registration, it is created in your own tenant with read-only Microsoft Graph permissions and deleted on delivery. We never change a setting, delete data or contact your vendors.
How it works
From a free call to a fix plan.
-
1
Scope call
Thirty minutes, free. We agree what's in, what's out, and the price, in writing.
-
2
Read-only access
You grant a read-only role. We never change settings, delete data or contact your vendors.
-
3
The audit
We collect the settings and usage data, read-only, and a person goes through every finding.
-
4
Report and walkthrough
Findings ranked by risk and by savings, explained to the people who will act on them.
-
5
Your call
Nothing happens after that unless you ask.
After the audit
What you do with it is up to you.
Most teams fix the findings themselves. If you would rather we did, or the audit points to something bigger, here is what that costs.
-
Fix · from $1,490
We carry out the report's recommendations alongside your team, priced in writing from the report itself. From €1,590.
-
Migrate · quoted after an audit
Tenant-to-tenant moves, mergers and consolidations, planned from what the audit found rather than from a guess.
-
A Cockpit, with the audit credited
Keep the picture current every day in a Veyago Cockpit. Build one within three months and the audit price comes off.
Straight answers
Before you ask.
Do you need admin access?
No. We use Microsoft's read-only roles. We see settings and usage, and can't change anything.
What happens to our data?
We collect only what the audit needs, keep it for the engagement, and delete it within 30 days of delivering the report. A data processing agreement is available before we start.
Do you sell Microsoft licenses?
No. We earn nothing from what you buy or cancel.
What if you don't find savings?
Then you have written proof that your tenant is in good shape, which your auditor, board or insurer will want anyway.
How is this different from Secure Score?
Secure Score tells you what Microsoft thinks is missing. It doesn't tell you what you're overpaying for, which accounts belong to people who left, or which fix matters most for your business.
Who does the work?
Cassian Drefke leads every Microsoft 365 and software audit personally, and he is the person you talk to from the scope call to the walkthrough.
Book a scope call
Tell us what you run on.
Thirty minutes, free, and you leave with a written price. You hear back within one working day, from a person.
What this page says about audits was last checked .