Tests authored
- MT.1002App management restrictions on applications and service principals is configured and enabled.
- MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
- MT.1006At least one Conditional Access policy is configured to require MFA for admins.
- MT.1007At least one Conditional Access policy is configured to require MFA for all users.
- MT.1008At least one Conditional Access policy is configured to require MFA for Azure management.
- MT.1009At least one Conditional Access policy is configured to block other legacy authentication.
- MT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.
- MT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.
- MT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.
- MT.1013At least one Conditional Access policy is configured to require new password when user risk is high.
- MT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.
- MT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.
- MT.1016At least one Conditional Access policy is configured to require MFA for guest access.
- MT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.
- MT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.
- MT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.
- MT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.
- MT.1021Security Defaults are enabled.
- MT.1022All users utilizing a P1 license should be licensed.
- MT.1023All users utilizing a P2 license should be licensed.
- MT.1024Entra recommendations should be completed.
- MT.1033Users should be blocked from using legacy authentication.
- MT.1147Do not sync krbtgt_AzureAD to Entra ID.
Also contributed to
- CISA.MS.EXO.7.1External sender warnings SHALL be implemented.
- MT.1001At least one Conditional Access policy is configured with device compliance.
- MT.1003At least one Conditional Access policy is configured with All Apps.
- MT.1004At least one Conditional Access policy is configured with All Apps and All Users.
- MT.1025No external user with permanent role assignment on Control Plane.
- MT.1026No hybrid user with permanent role assignment on Control Plane.
- MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.
- MT.1028No user with mailbox and permanent role assignment on Control Plane.
- MT.1029Stale accounts are not assigned to privileged roles.
- MT.1030Eligible role assignments on Control Plane are in use by administrators.
- MT.1031Privileged role on Control Plane are managed by PIM only.
- MT.1032Limited number of Global Admins are assigned.
- MT.1034Emergency access users should not be blocked.
- MT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.