Free Microsoft 365 Audit for Nonprofits

Nonprofits face the same security threats as larger organizations, usually with a smaller IT team and a tighter budget. Many run email, files, and collaboration in Microsoft 365 without a full-time admin who lives in the admin center every day. Settings pile up, shared mailboxes get misconfigured, MFA gaps go unnoticed, and third-party apps connect quietly in the background.

That is why Good Heart Tech built M365 Audit: a free, read-only audit that reviews your Microsoft 365 tenant and emails you a plain HTML report with the issues to fix first. No sales call. No changes to your tenant. Just clear, actionable guidance.

Why we built this

Good Heart Tech is a volunteer-run 501(c)(3) that provides free IT support to other nonprofits. We see the same Microsoft 365 problems again and again: accounts without MFA, shared mailboxes that still allow sign-in, mail forwarding to personal addresses, stale licensed users, and shadow IT apps with broad OAuth permissions.

Most small nonprofits are mission-driven first. They do not have the time, budget, or deep Microsoft expertise to audit their own tenant from scratch. Commercial security assessments can be expensive or hard to interpret. M365 Audit is our way to scale practical help: a simple on-ramp into the complex Microsoft world so organizations can secure their mission without guessing where to start.

How it works

1. Accept the terms and sign in with your organization's Global or Security Administrator account.
2. Grant read-only access. We review settings and security data only. Your tenant configuration stays untouched.
3. Get your report by email. Share results with your team, then sign in anytime to run an updated audit.

Start a free audit or view the full sample report to see how findings are presented.

What the audit checks

We focus on the settings nonprofits most often need help with:

• Identity and MFA: User MFA coverage, inactive accounts, admin roles, and Conditional Access.
• Email and Defender: Shared mailboxes, forwarding rules, phishing protection, and Safe Links where licensed.
• Apps and shadow IT: Third-party apps, OAuth permissions, and tools connected to your tenant.

The report groups findings by priority so you can tackle critical items first, like users without MFA, risky app access, or external mail forwarding, before moving on to medium-priority cleanup like inactive licensed accounts.

Who it is for

M365 Audit is built for nonprofit Microsoft 365 admins, executive directors wearing the IT hat, and MSPs supporting nonprofit clients who want a fast baseline without opening dozens of admin panels. If your organization already partners with Good Heart Tech, the report can also help our volunteers focus support time on your highest-risk items.

Need hands-on help after the audit? Contact Good Heart Tech to learn about free managed IT for eligible nonprofit partners. Ready to see where you stand? Run your free audit at m365audit.org.

M365 Audit is a free, volunteer-run service from Good Heart Tech. It is not affiliated with Microsoft and is provided as-is with no guarantees.