Tests Overview

This section is generated from the Maester test source (each test's [MaesterTest] metadata and its Test.<ID>.md documentation). Each page includes the test ID, severity, product, feature, PowerShell command, overview, remediation details, and related references when available.

Every test is researched, written, and refined by security experts from the Maester community — meet the contributors.

Test Suites

Suite	Tests	Description
Maester	239	Maester security tests for Microsoft 365 and Microsoft Entra configurations.
Entra ID SCA	47	Entra ID Security Config Analyzer tests mapped to Microsoft Entra security configuration checks.
CISA	79	CISA SCuBA baseline tests for Microsoft 365 security configurations.
CIS	113	CIS Benchmark controls implemented as Maester tests.
ORCA	67	ORCA Exchange Online security configuration tests included in Maester.
Active Directory	270	Active Directory inventory and security configuration tests for on-premises domains.

All Tests

Test ID	Title	Suite	Severity	Product	Feature
AD-CFG-01	Tombstone lifetime configuration should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-02	dSHeuristics count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-03	SPN mappings should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-04	Optional features count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-05	Recycle bin enabled paths should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-06	LDAP query policy count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-07	Default query policy should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-08	AuthN policy container count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-09	AD activation objects count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-10	Well-known security principals count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-11	Registered DHCP servers count should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-12	Enterprise CA count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-13	Certificate templates count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-14	Enrollment templates count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-15	Enrollment CA certificate details should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-16	Trusted root CA count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-17	Trusted root CA details should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-18	Intermediate CA count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-19	Intermediate CA details should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-20	CRL distribution points count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-21	NTAuth certificates count should be retrievable	Active Directory	Info	Active Directory	Certificate Services
AD-CFG-22	Exactly one KDS root key should exist	Active Directory	Info	Active Directory	Directory configuration
AD-CFG-23	SMTP site links count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-CFG-24	IP site links count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-COMP-01	Computer disabled count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-02	Computer dormant count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-03	Computer CreatorSid count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-04	Computer non-standard primary group count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-05	Computer SID History count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-06	Computer default container count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-07	Computer OU count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-08	Computer per OU average should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-09	Computer delegation count should be retrievable	Active Directory	Info	Active Directory	Computers
AD-COMP-10	Computer delegation details should be retrievable	Active Directory	Info	Active Directory	Computers
AD-DACL-01	Distinct DACL object count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-02	OU DACL entry count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-03	Conflict object count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-04	Conflict object details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-05	Deny ACE count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-06	Deny ACE details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-07	Distinct DACL identity count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-08	DACL ACE distribution per identity should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-09	Privileged allow ACE count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-10	Privileged allow ACE details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-11	Privileged extended right count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-12	Privileged extended right details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-13	Privileged extended right identities should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-14	Non-inherited ACE count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-15	Unresolved SID count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-16	Unresolved SID details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-17	Inherited object type count should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DACL-18	Inherited object type details should be investigated	Active Directory	Info	Active Directory	Permissions and delegation
AD-DC-01	DC site coverage count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DC-02	SMBv1 should be disabled on all domain controllers	Active Directory	High	Active Directory	Domain controllers
AD-DC-03	SMBv3.1.1 enabled count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DC-04	SMB signing should be enabled on all domain controllers	Active Directory	High	Active Directory	Domain controllers
AD-DC-05	DCs with all FSMO roles count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DC-06	FSMO role holder details should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DC-07	DC operating system count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DC-08	DC operating system details should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DCD-01	DC non-standard LDAP port count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DCD-02	DC non-standard LDAPS port count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DCD-03	Read-only domain controller count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DCD-04	Non-Global Catalog DC count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DCOMP-01	Computers with unconstrained delegation count should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-02	Non-DC computers should not have unconstrained delegation	Active Directory	High	Active Directory	Computers
AD-DCOMP-03	Non-DC computers with constrained delegation count should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-04	Computer operating system count should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-05	Computer operating system details should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-06	No enabled computers should be stale for 180 days or more	Active Directory	Medium	Active Directory	Computers
AD-DCOMP-07	Computer DNS host name count should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-08	Computer DNS zone count should be investigated	Active Directory	Info	Active Directory	Computers
AD-DCOMP-09	Computer DNS zone details should be investigated	Active Directory	Info	Active Directory	Computers
AD-DFSR-01	All domain controllers should have DFS-R subscriptions	Active Directory	Low	Active Directory	Replication
AD-DNS-01	DNS zone count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-02	Zones with only SOA/NS records should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-03	Root servers with incorrect IPs should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-04	Root server incorrect IP details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-05	Dynamic DNS record count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-06	Zones with non-default records should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-07	Zone record count details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-08	Zone delegation count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-09	Zone delegation details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-10	SOA record details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-11	AD DS SRV record count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-12	AD DS SRV record details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-13	DNSSEC record count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-14	Empty zone count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-15	Duplicate zone count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-16	Reverse lookup zone count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-17	Non-standard zone count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-18	Reverse zone network count should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DNS-19	Reverse zone network details should be retrievable	Active Directory	Info	Active Directory	DNS
AD-DOM-01	Domain functional level should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-02	Machine account quota should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-03	Domain controller count should be retrievable	Active Directory	Info	Active Directory	Domain controllers
AD-DOM-04	RIDs remaining should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-05	Domain name standard compliance should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-06	Domain name non-standard details should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-07	NetBIOS name standard compliance should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOM-08	NetBIOS name non-standard details should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-DOMS-01	Allowed DNS suffixes count should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FEAT-01	Optional feature count should be investigated	Active Directory	Info	Active Directory	Directory configuration
AD-FEAT-02	Optional feature enabled details should be investigated	Active Directory	Info	Active Directory	Directory configuration
AD-FGPP-01	Fine-grained password policy count should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-FGPP-02	Fine-grained password policy value count should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-FGPP-03	Fine-grained password policy setting counts should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-FGPP-04	Fine-grained password policy application targets should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-FOR-01	Forest functional level should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FOR-02	Forest domain count should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FOR-03	Tombstone lifetime should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-FOR-04	Recycle Bin status should be retrievable	Active Directory	Info	Active Directory	Directory configuration
AD-FORS-01	UPN suffixes count should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FORS-02	UPN suffixes details should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FORS-03	SPN suffixes count should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-FORS-04	Cross-forest references count should be retrievable	Active Directory	Info	Active Directory	Domain and forest
AD-GCHG-01	Average group membership changes per year should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-01	Distinct groups with members count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GMC-02	Distinct account types of members count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GMC-03	Member account types breakdown should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GMC-04	Trust members count should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-05	Trust members details by group should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-06	Foreign SID principals count should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-07	Foreign SID details by domain should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-08	Empty non-privileged group count should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-09	Empty non-privileged group details should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-10	Privileged groups with members count should be investigated	Active Directory	Info	Active Directory	Groups
AD-GMC-11	Privileged groups with members details should be investigated	Active Directory	Info	Active Directory	Groups
AD-GPO-01	GPO total count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPO-02	GPO created before 2020 count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPO-03	GPO stale-before-2020 count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPO-04	Unlinked GPO count should be compliant	Active Directory	Low	Active Directory	Group Policy
AD-GPO-05	GPO unlinked details should be compliant	Active Directory	Low	Active Directory	Group Policy
AD-GPOL-01	GPO linked count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOL-02	Disabled GPO link count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPOL-03	GPO unlinked target count should be compliant	Active Directory	Low	Active Directory	Group Policy
AD-GPOL-04	Enforced GPO link count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPOL-05	GPO blocked inheritance count should be compliant	Active Directory	Medium	Active Directory	Group Policy
AD-GPOL-06	GPO linked OU count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-01	No GPOs should be missing permissions	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-02	No GPOs should be missing permissions	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-03	GPOs without authenticated users count should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-04	GPOs without authenticated users details should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-05	GPOs without enterprise domain controllers count should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-06	GPOs without domain computers count should be retrievable	Active Directory	Low	Active Directory	Group Policy
AD-GPOREP-07	GPOs with deny ACE count should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-08	GPOs with deny ACE details should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-09	GPO inherited permissions count should be retrievable	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-10	GPO no-apply Group Policy ACE count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-11	GPO no-apply Group Policy ACE details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-12	GPO disabled link count should be retrievable	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-13	GPO disabled link details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-14	GPO enforcement count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOREP-15	No GPOs should have version mismatches	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-16	No GPOs should have version mismatches	Active Directory	Medium	Active Directory	Group Policy
AD-GPOREP-17	No GPOs should contain a cpassword	Active Directory	Critical	Active Directory	Group Policy
AD-GPOREP-18	No GPOs should contain a cpassword	Active Directory	Critical	Active Directory	Group Policy
AD-GPOREP-19	No GPOs should contain a default password	Active Directory	High	Active Directory	Group Policy
AD-GPOREP-20	No GPOs should contain a default password	Active Directory	High	Active Directory	Group Policy
AD-GPOS-01	GPO state total count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-02	WMI filter count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-03	WMI filter details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-04	Disabled GPO settings count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-05	Computer disabled GPO settings details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-06	User disabled GPO settings details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-07	All disabled GPO settings details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-08	GPO owner distinct count should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GPOS-09	GPO owner details should be investigated	Active Directory	Info	Active Directory	Group Policy
AD-GRP-01	Group AdminCount should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-02	Groups in container objects count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-03	Stale groups count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-04	Groups with manager count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-05	Group SID History count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-06	Distribution group count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-07	Security group count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-08	Domain local group count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-09	Global group count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-GRP-10	Universal group count should be retrievable	Active Directory	Info	Active Directory	Groups
AD-KRBTGT-01	KRBTGT password age should not exceed 180 days	Active Directory	Medium	Active Directory	Account security
AD-KRBTGT-02	KRBTGT last logon should be investigated	Active Directory	Info	Active Directory	Account security
AD-KRBTGT-03	KRBTGT should have standard UAC settings (disabled account)	Active Directory	Medium	Active Directory	Account security
AD-MSA-01	Managed service account count should be investigated	Active Directory	Info	Active Directory	Account security
AD-OU-01	OU overlapping name count should be retrievable	Active Directory	Info	Active Directory	Organizational units
AD-OU-02	OU at domain root count should be retrievable	Active Directory	Info	Active Directory	Organizational units
AD-OU-03	OU stale count should be retrievable	Active Directory	Info	Active Directory	Organizational units
AD-OU-04	OU empty count should be retrievable	Active Directory	Info	Active Directory	Organizational units
AD-OU-05	OU empty details should be retrievable	Active Directory	Info	Active Directory	Organizational units
AD-PRINT-01	Printer total count should be retrievable	Active Directory	Info	Active Directory	Printers
AD-PWDPOL-01	Password history count should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-PWDPOL-02	Password maximum age should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-PWDPOL-03	Password minimum length should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-PWDPOL-04	Password complexity should be enabled	Active Directory	Medium	Active Directory	Password policy
AD-PWDPOL-05	Password reversible encryption should be disabled	Active Directory	Medium	Active Directory	Password policy
AD-PWDPOL-06	Account lockout duration should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-PWDPOL-07	Account lockout threshold should be retrievable	Active Directory	Info	Active Directory	Password policy
AD-REPL-01	No replication connections should be disabled	Active Directory	Low	Active Directory	Replication
AD-REPL-02	Non-auto replication connection count should be investigated	Active Directory	Info	Active Directory	Replication
AD-ROOTDSE-01	Supported SASL mechanism count should be investigated	Active Directory	Info	Active Directory	Directory configuration
AD-ROOTDSE-02	Supported SASL mechanism details should be investigated	Active Directory	Info	Active Directory	Directory configuration
AD-ROOTDSE-03	Root DSE should be synchronized	Active Directory	Low	Active Directory	Replication
AD-SCH-01	Schema modification year count should be retrievable	Active Directory	Info	Active Directory	Schema
AD-SCH-02	Schema modification year details should be retrievable	Active Directory	Info	Active Directory	Schema
AD-SCH-03	Schema version entry count should be retrievable	Active Directory	Info	Active Directory	Schema
AD-SCH-04	Schema version details should be retrievable	Active Directory	Info	Active Directory	Schema
AD-SCH-05	LAPS should be installed in Active Directory	Active Directory	Medium	Active Directory	Schema
AD-SITE-01	Site total count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SITE-02	Sites without domain controllers count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SITE-03	Sites without domain controllers details should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SITE-04	Sites without subnet associations count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SITE-05	Sites without subnet associations details should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SPN-01	Computer SPN service class count should be retrievable	Active Directory	Info	Active Directory	Service principal names
AD-SPN-02	Computer SPN service class usage should be retrievable	Active Directory	Info	Active Directory	Service principal names
AD-SPN-03	Computer SPN unknown service class count should be retrievable	Active Directory	Info	Active Directory	Service principal names
AD-SPN-04	Computer SPN unknown service class details should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-05	Computer SPN non-FQDN hosts should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-06	User SPN total count should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-07	User SPN service class count should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-08	User SPN service class usage should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-09	User SPN unknown service class count should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-10	User SPN unknown service class details should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-11	User SPN non-FQDN hosts should be investigated	Active Directory	Info	Active Directory	Service principal names
AD-SPN-12	No domain admin accounts should have SPNs configured	Active Directory	Critical	Active Directory	Service principal names
AD-SPN-13	No domain admin accounts should have SPNs configured	Active Directory	Critical	Active Directory	Service principal names
AD-SUB-01	Subnet total count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-02	Sites with subnet associations count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-03	Catch-all subnets count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-04	IPv6 subnets count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-05	IPv6 catch-all subnets count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-06	Non-RFC1918 (public IP) subnets count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-07	Non-RFC1918 (public IP) subnets details should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-08	Distinct first octets count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-09	Distinct first two octets (/16 networks) count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-10	Distinct first three octets (/24 networks) count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-SUB-11	Subnets without site associations count should be retrievable	Active Directory	Info	Active Directory	Sites and subnets
AD-TRUST-01	Trust total count should be investigated	Active Directory	Info	Active Directory	Trusts
AD-TRUST-02	Trust inter-forest count should be investigated	Active Directory	Info	Active Directory	Trusts
AD-TRUST-03	Trust quarantined count should be investigated	Active Directory	Info	Active Directory	Trusts
AD-TRUST-04	No trusts should lack SID filtering (quarantine)	Active Directory	High	Active Directory	Trusts
AD-TRUST-05	Trust configuration details should be investigated	Active Directory	Info	Active Directory	Trusts
AD-TRUST-06	Trust stale count should be investigated	Active Directory	Info	Active Directory	Trusts
AD-TRUST-07	Trust stale details should be investigated	Active Directory	Info	Active Directory	Trusts
AD-USER-01	Disabled user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-02	Dormant enabled user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-03	Non-expiring password user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-04	Reversible encryption user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-05	Delegation-enabled user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-06	DES-only Kerberos user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-07	No pre-authentication user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-08	Never-logged-in enabled user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-09	Password-not-required user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-10	Workstation-restricted user count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-11	User AdminCount count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-12	User non-standard primary group count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-13	User SID History count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-14	User SPN count should be retrievable	Active Directory	Info	Active Directory	Service principal names
AD-USER-15	User manager count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-16	User home directory count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-17	User profile path count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-18	User script path count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-19	User in container count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-20	Known service account count should be retrievable	Active Directory	Info	Active Directory	Users
AD-USER-21	Known service account details should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-22	Built-in administrator account count should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-23	Enabled built-in administrator details should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-24	Built-in administrator last logon details should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-25	Built-in administrator password age details should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-26	Honey pot user count should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-27	Honey pot user details should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-28	User delegation configured count should be investigated	Active Directory	Info	Active Directory	Users
AD-USER-29	No users should be configured for unconstrained delegation	Active Directory	High	Active Directory	Users
AZDO.1000	Azure DevOps OAuth apps can access resources in your organization through OAuth.	Maester	High	Azure DevOps	Security policies
AZDO.1001	Identities can connect to your organization's Git repos through SSH.	Maester	High	Azure DevOps	Security policies
AZDO.1002	Log Audit Events.	Maester	High	Azure DevOps	Auditing
AZDO.1003	Restrict public projects.	Maester	High	Azure DevOps	Security policies
AZDO.1004	Additional protections when using public package registries.	Maester	High	Azure DevOps	Security policies
AZDO.1005	IP Conditional Access policy validation.	Maester	High	Azure DevOps	Security policies
AZDO.1006	External Users access.	Maester	Medium	Azure DevOps	Users and access
AZDO.1007	Team and project administrator are allowed to invite new users.	Maester	Medium	Azure DevOps	Users and access
AZDO.1008	Request access to Azure DevOps by e-mail notifications to administrators.	Maester	Low	Azure DevOps	Users and access
AZDO.1009	Feedback Collection.	Maester	Info	Azure DevOps	Organization policies
AZDO.1010	Audit streaming.	Maester	High	Azure DevOps	Auditing
AZDO.1011	Project Resource Limits.	Maester	Info	Azure DevOps	Resource usage and limits
AZDO.1012	Work Items Tags Limits.	Maester	Info	Azure DevOps	Resource usage and limits
AZDO.1013	Organization Owner should not be an individual.	Maester	High	Azure DevOps	Users and access
AZDO.1014	Anonymous access to pipeline badges.	Maester	Medium	Azure DevOps	Pipelines
AZDO.1015	Limit variables that can be set at queue time.	Maester	High	Azure DevOps	Pipelines
AZDO.1016	Limit job authorization scope to current project for non-release pipelines.	Maester	High	Azure DevOps	Pipelines
AZDO.1017	Limit job authorization scope to current project for classic release pipelines.	Maester	High	Azure DevOps	Pipelines
AZDO.1018	Protect access to repositories in YAML pipelines.	Maester	High	Azure DevOps	Pipelines
AZDO.1019	Stage chooser.	Maester	Medium	Azure DevOps	Pipelines
AZDO.1020	Creation of classic build pipelines.	Maester	Medium	Azure DevOps	Pipelines
AZDO.1021	Creation of classic release pipelines.	Maester	Medium	Azure DevOps	Pipelines
AZDO.1022	Limit building pull requests from forked GitHub repositories.	Maester	High	Azure DevOps	Pipelines
AZDO.1023	Disable Marketplace tasks.	Maester	High	Azure DevOps	Pipelines
AZDO.1024	Disable Node 6 tasks.	Maester	Medium	Azure DevOps	Pipelines
AZDO.1025	Enable shell tasks arguments validation.	Maester	High	Azure DevOps	Pipelines
AZDO.1026	Enable automatic enrollment to Advanced Security for Azure DevOps.	Maester	Medium	Azure DevOps	Repositories
AZDO.1027	Disable showing Gravatar images for users outside of your enterprise.	Maester	Low	Azure DevOps	Repositories
AZDO.1028	Disable creation of TFVC repositories.	Maester	Medium	Azure DevOps	Repositories
AZDO.1029	Storage Usage Limit.	Maester	Info	Azure DevOps	Resource usage and limits
AZDO.1030	Project Collection Administrators.	Maester	High	Azure DevOps	Users and access
AZDO.1031	Validate SSH Key Expiration.	Maester	High	Azure DevOps	Security policies
AZDO.1032	(Tenant) Restrict creation of global Personal Access Tokens.	Maester	High	Azure DevOps	Security policies
AZDO.1033	(Tenant) Enable automatic revocation of leaked Personal Access Tokens.	Maester	High	Azure DevOps	Security policies
AZDO.1034	(Tenant) Restrict creation of new Azure DevOps organizations.	Maester	Medium	Azure DevOps	Organization policies
AZDO.1035	(Tenant) Restrict Personal Access Token lifespan.	Maester	High	Azure DevOps	Security policies
AZDO.1036	(Tenant) Restrict Personal Access Token full scope.	Maester	High	Azure DevOps	Security policies
AZDO.1037	(Organization) Restrict Personal Access Token creation.	Maester	High	Azure DevOps	Security policies
AZDO.1038	(Organization) Disallow extensions from accessing resources on the local network.	Maester	Medium	Azure DevOps	Security policies
AZDO.1039	(Organization) Secret Protection: new repositories enrolled automatically.	Maester	Medium	Azure DevOps	Repositories
AZDO.1040	(Organization) Secret Protection: existing repositories enrolled.	Maester	High	Azure DevOps	Repositories
AZDO.1041	(Organization) Secret Protection: push protection blocks secret commits.	Maester	High	Azure DevOps	Repositories
AZDO.1042	(Organization) Code Security: new repositories enrolled automatically.	Maester	Medium	Azure DevOps	Repositories
AZDO.1043	(Organization) Code Security: existing repositories enrolled.	Maester	Medium	Azure DevOps	Repositories
AZDO.1044	(Organization) Code Security: dependency and CodeQL alerts enabled.	Maester	Medium	Azure DevOps	Repositories
AZDO.1045	(Organization) Copilot code review: allowed for repositories.	Maester	Info	Azure DevOps	Repositories
CIS.GH.1.2.2	(L1) Ensure repository creation is limited to specific members	CIS	Medium	GitHub	Organization settings
CIS.GH.1.2.3	(L1) Ensure repository deletion is limited to specific users	CIS	High	GitHub	Organization settings
CIS.GH.1.2.4	(L1) Ensure issue deletion is limited to specific users	CIS	Medium	GitHub	Organization settings
CIS.GH.1.3.2	(L1) Ensure team creation is limited to specific members	CIS	Medium	GitHub	Organization settings
CIS.GH.1.3.8	(L1) Ensure strict base permissions are set for repositories	CIS	High	GitHub	Organization settings
CIS.M365.1.1.1	(L1) Ensure Administrative accounts are cloud-only	CIS	High	Microsoft 365	Administrative accounts
CIS.M365.1.1.3	(L1) Ensure that between two and four global admins are designated	CIS	High	Microsoft 365	Administrative accounts
CIS.M365.1.2.1	(L2) Ensure that only organizationally managed/approved public groups exist	CIS	Medium	Microsoft 365	Teams and groups
CIS.M365.1.2.2	(L1) Ensure sign-in to shared mailboxes is blocked	CIS	Medium	Microsoft 365	Teams and groups
CIS.M365.1.3.1	(L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.2	(L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.3	(L2) Ensure 'External sharing' of calendars is not available	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.4	(L1) Ensure 'User owned apps and services' is restricted	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.5	(L1) Ensure internal phishing protection for Forms is enabled	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.6	(L2) Ensure the customer lockbox feature is enabled	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.1.3.7	(L2) Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'	CIS	Medium	Microsoft 365	Organization settings
CIS.M365.2.1.1	(L2) Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)	CIS	Medium	Defender	Safe Links
CIS.M365.2.1.11	(L2) Ensure comprehensive attachment filtering is applied	CIS	Medium	Defender	Anti-malware
CIS.M365.2.1.12	(L1) Ensure the connection filter IP allow list is not used (Only Checks Default Policy)	CIS	Medium	Defender	Anti-spam
CIS.M365.2.1.13	(L1) Ensure the connection filter safe list is off (Only Checks Default Policy)	CIS	Medium	Defender	Anti-spam
CIS.M365.2.1.2	(L1) Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)	CIS	Medium	Defender	Anti-malware
CIS.M365.2.1.3	(L1) Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy)	CIS	Medium	Defender	Anti-malware
CIS.M365.2.1.4	(L2) Ensure Safe Attachments policy is enabled (Only Checks Default Policy)	CIS	High	Defender	Safe Attachments
CIS.M365.2.1.5	(L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled	CIS	Medium	Defender	Safe Attachments
CIS.M365.2.1.6	(L1) Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy)	CIS	Medium	Defender	Anti-spam
CIS.M365.2.1.7	(L1) Ensure that an anti-phishing policy has been created (Only Checks Default Policy)	CIS	Medium	Defender	Anti-phishing
CIS.M365.2.1.9	(L1) Ensure that DKIM is enabled for all Exchange Online Domains	CIS	Medium	Defender	Email authentication
CIS.M365.2.4.4	(L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)	CIS	Medium	Defender	Zero-hour auto purge
CIS.M365.3.1.1	(L1) Ensure Microsoft 365 audit log search is Enabled	CIS	High	Purview	Audit
CIS.M365.4.1	(L1) Ensure devices without a compliance policy are marked 'not compliant'	CIS	Medium	Intune	Device compliance
CIS.M365.4.2	(L1) Ensure device enrollment for personally owned devices is blocked by default	CIS	Medium	Intune	Device enrollment
CIS.M365.5.1.2.2	(L1) Ensure users cannot register applications	CIS	Medium	Entra ID	User and directory settings
CIS.M365.5.1.2.3	(L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'	CIS	Medium	Entra ID	User and directory settings
CIS.M365.5.1.3.1	(L1) Ensure users cannot create security groups	CIS	Low	Entra ID	Groups
CIS.M365.5.1.3.4	(L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'	CIS	Low	Entra ID	Groups
CIS.M365.5.1.4.1	(L2) Ensure the ability to join devices to Entra is restricted	CIS	Medium	Entra ID	Device identity
CIS.M365.5.1.4.2	(L1) Ensure the maximum number of devices per user is limited	CIS	Low	Entra ID	Device identity
CIS.M365.5.1.4.3	(L1) Ensure the GA role is not added as a local administrator during Entra join	CIS	Medium	Entra ID	Device identity
CIS.M365.5.1.4.4	(L1) Ensure local administrator assignment is limited during Entra join	CIS	Medium	Entra ID	Device identity
CIS.M365.5.1.4.5	(L1) Ensure Local Administrator Password Solution is enabled	CIS	Medium	Entra ID	Device identity
CIS.M365.5.1.4.6	(L2) Ensure users are restricted from recovering BitLocker keys	CIS	Medium	Entra ID	Device identity
CIS.M365.5.1.5.1	(L2) Ensure user consent to apps accessing company data on their behalf is not allowed	CIS	High	Entra ID	App consent and permissions
CIS.M365.5.1.5.2	(L1) Ensure the admin consent workflow is enabled	CIS	High	Entra ID	App consent and permissions
CIS.M365.5.1.5.3	(L2) Ensure password addition is blocked for applications	CIS	Medium	Entra ID	Applications
CIS.M365.5.1.5.4	(L1) Ensure password lifetime for applications does not exceed 180 days	CIS	Medium	Entra ID	Applications
CIS.M365.5.1.5.5	(L1) Ensure new application passwords are system-generated	CIS	Medium	Entra ID	Applications
CIS.M365.5.1.5.6	(L1) Ensure maximum certificate lifetime for applications does not exceed 180 days	CIS	Medium	Entra ID	Applications
CIS.M365.5.1.6.1	(L2) Ensure that collaboration invitations are sent to allowed domains only	CIS	Medium	Entra ID	External identities
CIS.M365.5.1.6.2	(L1) Ensure that guest user access is restricted	CIS	Medium	Entra ID	External identities
CIS.M365.5.1.6.3	(L2) Ensure guest user invitations are limited	CIS	Medium	Entra ID	External identities
CIS.M365.5.1.8.1	(L1) Ensure that password hash sync is enabled for hybrid deployments	CIS	Medium	Entra ID	Hybrid identity
CIS.M365.5.2.2.1	(L1) Ensure multifactor authentication is enabled for all users in administrative roles	CIS	High	Entra ID	Conditional Access
CIS.M365.5.2.2.10	(L1) Ensure a managed device is required to register security information	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.11	(L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time'	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.12	(L1) Ensure the device code sign-in flow is blocked	CIS	High	Entra ID	Conditional Access
CIS.M365.5.2.2.13	(L1) Ensure that periodic reauthentication is required for all users	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.14	(L2) Ensure trusted 'named locations' are defined	CIS	Low	Entra ID	Conditional Access
CIS.M365.5.2.2.15	(L2) Ensure exclusionary geographic access controls are utilized	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.16	(L2) Ensure Token Protection is enforced for session tokens	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.17	(L1) Ensure authentication transfer is blocked	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.2	(L1) Ensure multifactor authentication is enabled for all users	CIS	High	Entra ID	Conditional Access
CIS.M365.5.2.2.3	(L1) Enable Conditional Access policies to block legacy authentication	CIS	High	Entra ID	Conditional Access
CIS.M365.5.2.2.4	(L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.5	(L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators	CIS	High	Entra ID	Conditional Access
CIS.M365.5.2.2.6	(L1) Enable Identity Protection user risk policies	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.7	(L1) Enable Identity Protection sign-in risk policies	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.8	(L2) Ensure 'sign-in risk' is blocked for medium and high risk	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.2.9	(L1) Ensure a managed device is required for authentication	CIS	Medium	Entra ID	Conditional Access
CIS.M365.5.2.3.1	(L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue	CIS	Medium	Entra ID	Authentication methods
CIS.M365.5.2.3.10	(L1) Ensure Microsoft Authenticator on companion applications is disabled	CIS	Low	Entra ID	Authentication methods
CIS.M365.5.2.3.2	(L1) Ensure custom banned passwords lists are used	CIS	Medium	Entra ID	Password protection
CIS.M365.5.2.3.3	(L1) Ensure password protection is enabled for on-prem Active Directory	CIS	Medium	Entra ID	Password protection
CIS.M365.5.2.3.4	(L1) Ensure all member users are 'MFA capable'	CIS	High	Entra ID	Authentication methods
CIS.M365.5.2.3.5	(L1) Ensure weak authentication methods are disabled	CIS	High	Entra ID	Authentication methods
CIS.M365.5.2.3.6	(L1) Ensure system-preferred multifactor authentication is enabled	CIS	Low	Entra ID	Authentication methods
CIS.M365.5.2.3.7	(L2) Ensure the email OTP authentication method is disabled	CIS	Medium	Entra ID	Authentication methods
CIS.M365.5.2.3.8	(L1) Ensure that Account 'Lockout threshold' is '10' or less	CIS	Medium	Entra ID	Password protection
CIS.M365.5.2.3.9	(L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds	CIS	Medium	Entra ID	Password protection
CIS.M365.5.3.1	(L2) Ensure privileged role assignments are activated and not assigned	CIS	High	Entra ID	Privileged Identity Management
CIS.M365.5.3.2	(L1) Ensure 'Access reviews' for guest users are configured	CIS	Medium	Entra ID	Identity Governance
CIS.M365.5.3.3	(L1) Ensure 'Access reviews' for privileged roles are configured	CIS	Medium	Entra ID	Identity Governance
CIS.M365.5.3.4	(L1) Ensure approval is required for Global Administrator role activation	CIS	Medium	Entra ID	Privileged Identity Management
CIS.M365.5.3.5	(L1) Ensure approval is required for Privileged Role Administrator activation	CIS	Medium	Entra ID	Privileged Identity Management
CIS.M365.6.5.3	(L2) Ensure additional storage providers are restricted in Outlook on the web	CIS	Medium	Exchange Online	Outlook
CIS.M365.7.2.1	(L1) Ensure modern authentication for SharePoint applications is required	CIS	Medium	SharePoint	Access control
CIS.M365.7.2.10	(L1) Ensure reauthentication with verification code is restricted	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.11	(L1) Ensure the SharePoint default sharing link permission is set	CIS	Medium	SharePoint	Sharing links
CIS.M365.7.2.2	(L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.3	(L1) Ensure external content sharing is restricted	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.4	(L2) Ensure OneDrive content sharing is restricted	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.5	(L2) Ensure that SharePoint guest users cannot share items they don't own	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.6	(L2) Ensure SharePoint external sharing is managed through domain whitelist/blacklists	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.7	(L1) Ensure link sharing is restricted in SharePoint and OneDrive	CIS	Medium	SharePoint	Sharing links
CIS.M365.7.2.8	(L2) Ensure external sharing is restricted by security group	CIS	Medium	SharePoint	External sharing
CIS.M365.7.2.9	(L1) Ensure guest access to a site or OneDrive will expire automatically	CIS	Medium	SharePoint	External sharing
CIS.M365.7.3.1	(L2) Ensure Office 365 SharePoint infected files are disallowed for download	CIS	Medium	SharePoint	Access control
CIS.M365.8.1.1	(L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services	CIS	Medium	Teams	File sharing
CIS.M365.8.1.2	(L1) Ensure users can't send emails to a channel email address	CIS	Medium	Teams	Messaging
CIS.M365.8.2.1	(L2) Ensure external domains are restricted in the Teams admin center	CIS	Medium	Teams	External access
CIS.M365.8.2.2	(L1) Ensure communication with unmanaged Teams users is disabled	CIS	Medium	Teams	External access
CIS.M365.8.2.3	(L1) Ensure external Teams users cannot initiate conversations	CIS	Medium	Teams	External access
CIS.M365.8.2.4	(L1) Ensure the organization cannot communicate with accounts in trial Teams tenants	CIS	Medium	Teams	External access
CIS.M365.8.4.1	(L1) Ensure app permission policies are configured	CIS	Medium	Teams	Apps
CIS.M365.8.5.1	(L2) Ensure anonymous users can't join a meeting	CIS	Medium	Teams	Meetings
CIS.M365.8.5.2	(L1) Ensure anonymous users and dial-in callers can't start a meeting	CIS	Medium	Teams	Meetings
CIS.M365.8.5.3	(L1) Ensure only people in my org can bypass the lobby	CIS	Medium	Teams	Meetings
CIS.M365.8.5.4	(L1) Ensure users dialing in can't bypass the lobby	CIS	Medium	Teams	Meetings
CIS.M365.8.5.5	(L2) Ensure meeting chat does not allow anonymous users	CIS	Medium	Teams	Meetings
CIS.M365.8.5.6	(L2) Ensure only organizers and co-organizers can present	CIS	Low	Teams	Meetings
CIS.M365.8.5.7	(L1) Ensure external participants can't give or request control	CIS	Medium	Teams	Meetings
CIS.M365.8.5.8	(L2) Ensure external meeting chat is off	CIS	Medium	Teams	Meetings
CIS.M365.8.5.9	(L2) Ensure meeting recording is off by default	CIS	Low	Teams	Meetings
CIS.M365.8.6.1	(L1) Ensure users can report security concerns in Teams	CIS	Medium	Teams	Messaging
CISA.MS.AAD.1.1	Legacy authentication SHALL be blocked.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.2.1	Users detected as high risk SHALL be blocked.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.2.2	A notification SHOULD be sent to the administrator when high-risk users are detected.	CISA	Medium	Entra ID	Identity Protection
CISA.MS.AAD.2.3	Sign-ins detected as high risk SHALL be blocked.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.3.1	Phishing-resistant MFA SHALL be enforced for all users.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.3.2	If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.3.3	If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.	CISA	Medium	Entra ID	Authentication methods
CISA.MS.AAD.3.4	The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.	CISA	Low	Entra ID	Authentication methods
CISA.MS.AAD.3.5	The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.	CISA	High	Entra ID	Authentication methods
CISA.MS.AAD.3.6	Phishing-resistant MFA SHALL be required for highly privileged roles.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.3.7	Managed devices SHOULD be required for authentication.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.3.8	Managed Devices SHOULD be required to register MFA.	CISA	High	Entra ID	Conditional Access
CISA.MS.AAD.4.1	Security logs SHALL be sent to the agency's security operations center for monitoring.	CISA	High	Entra ID	Logs and monitoring
CISA.MS.AAD.5.1	Only administrators SHALL be allowed to register applications.	CISA	Medium	Entra ID	User and directory settings
CISA.MS.AAD.5.2	Only administrators SHALL be allowed to consent to applications.	CISA	High	Entra ID	App consent and permissions
CISA.MS.AAD.5.3	An admin consent workflow SHALL be configured for applications.	CISA	High	Entra ID	App consent and permissions
CISA.MS.AAD.5.4	Group owners SHALL NOT be allowed to consent to applications.	CISA	High	Entra ID	App consent and permissions
CISA.MS.AAD.6.1	User passwords SHALL NOT expire.	CISA	Medium	Entra ID	Password protection
CISA.MS.AAD.7.1	A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.	CISA	High	Entra ID	Roles and administrators
CISA.MS.AAD.7.2	Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.	CISA	High	Entra ID	Roles and administrators
CISA.MS.AAD.7.3	Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.	CISA	High	Entra ID	Roles and administrators
CISA.MS.AAD.7.4	Permanent active role assignments SHALL NOT be allowed for highly privileged roles.	CISA	High	Entra ID	Privileged Identity Management
CISA.MS.AAD.7.5	Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.	CISA	High	Entra ID	Privileged Identity Management
CISA.MS.AAD.7.6	Activation of the Global Administrator role SHALL require approval.	CISA	Medium	Entra ID	Privileged Identity Management
CISA.MS.AAD.7.7	Eligible and Active highly privileged role assignments SHALL trigger an alert.	CISA	Medium	Entra ID	Privileged Identity Management
CISA.MS.AAD.7.8	User activation of the Global Administrator role SHALL trigger an alert.	CISA	Medium	Entra ID	Privileged Identity Management
CISA.MS.AAD.7.9	User activation of other highly privileged roles SHOULD trigger an alert.	CISA	Medium	Entra ID	Privileged Identity Management
CISA.MS.AAD.8.1	Guest users SHOULD have limited or restricted access to Entra ID directory objects.	CISA	Medium	Entra ID	External identities
CISA.MS.AAD.8.2	Only users with the Guest Inviter role SHOULD be able to invite guest users.	CISA	Medium	Entra ID	External identities
CISA.MS.AAD.8.3	Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.	CISA	Medium	Entra ID	External identities
CISA.MS.EXO.1.1	Automatic forwarding to external domains SHALL be disabled.	CISA	High	Exchange Online	Mail flow
CISA.MS.EXO.10.1	Emails SHALL be scanned for malware.	CISA	High	Exchange Online	Anti-malware
CISA.MS.EXO.10.2	Emails identified as containing malware SHALL be quarantined or dropped.	CISA	High	Exchange Online	Anti-malware
CISA.MS.EXO.10.3	Email scanning SHALL be capable of reviewing emails after delivery.	CISA	High	Exchange Online	Anti-malware
CISA.MS.EXO.11.1	Impersonation protection checks SHOULD be used.	CISA	High	Exchange Online	Anti-phishing
CISA.MS.EXO.11.2	User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.	CISA	Medium	Exchange Online	Anti-phishing
CISA.MS.EXO.11.3	The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.	CISA	Medium	Exchange Online	Anti-phishing
CISA.MS.EXO.12.1	IP allow lists SHOULD NOT be created.	CISA	Medium	Exchange Online	Anti-spam
CISA.MS.EXO.12.2	Safe lists SHOULD NOT be enabled.	CISA	Medium	Exchange Online	Anti-spam
CISA.MS.EXO.13.1	Mailbox auditing SHALL be enabled.	CISA	High	Exchange Online	Mailbox auditing
CISA.MS.EXO.14.1	A spam filter SHALL be enabled.	CISA	High	Exchange Online	Anti-spam
CISA.MS.EXO.14.2	Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.	CISA	Medium	Exchange Online	Anti-spam
CISA.MS.EXO.14.3	Allowed domains SHALL NOT be added to inbound anti-spam protection policies.	CISA	Medium	Exchange Online	Anti-spam
CISA.MS.EXO.14.4	If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.	CISA	Medium	Exchange Online	Anti-spam
CISA.MS.EXO.15.1	URL comparison with a block-list SHOULD be enabled.	CISA	Medium	Exchange Online	Safe Links
CISA.MS.EXO.15.2	Direct download links SHOULD be scanned for malware.	CISA	High	Exchange Online	Safe Links
CISA.MS.EXO.15.3	User click tracking SHOULD be enabled.	CISA	Medium	Exchange Online	Safe Links
CISA.MS.EXO.16.1	Alerts SHALL be enabled.	CISA	High	Exchange Online	Alert policies
CISA.MS.EXO.16.2	Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.	CISA	Medium	Exchange Online	Alert policies
CISA.MS.EXO.17.1	Microsoft Purview Audit (Standard) logging SHALL be enabled.	CISA	High	Exchange Online	Audit logging
CISA.MS.EXO.17.2	Microsoft Purview Audit (Premium) logging SHALL be enabled.	CISA	Medium	Exchange Online	Audit logging
CISA.MS.EXO.17.3	Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).	CISA	Medium	Exchange Online	Audit logging
CISA.MS.EXO.2.1	A list of approved IP addresses for sending mail SHALL be maintained.	CISA	Medium	Exchange Online	Email authentication
CISA.MS.EXO.2.2	An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.	CISA	Medium	Exchange Online	Email authentication
CISA.MS.EXO.3.1	DKIM SHOULD be enabled for all domains.	CISA	Medium	Exchange Online	Email authentication
CISA.MS.EXO.4.1	A DMARC policy SHALL be published for every second-level domain.	CISA	Medium	Exchange Online	Email authentication
CISA.MS.EXO.4.2	The DMARC message rejection option SHALL be p=reject.	CISA	High	Exchange Online	Email authentication
CISA.MS.EXO.4.3	The DMARC point of contact for aggregate reports SHALL include [email protected].	CISA	Medium	Exchange Online	Email authentication
CISA.MS.EXO.5.1	SMTP AUTH SHALL be disabled.	CISA	High	Exchange Online	Client access
CISA.MS.EXO.6.1	Contact folders SHALL NOT be shared with all domains.	CISA	Medium	Exchange Online	Calendar and contact sharing
CISA.MS.EXO.6.2	Calendar details SHALL NOT be shared with all domains.	CISA	Medium	Exchange Online	Calendar and contact sharing
CISA.MS.EXO.7.1	External sender warnings SHALL be implemented.	CISA	Medium	Exchange Online	Mail flow
CISA.MS.EXO.8.1	A DLP solution SHALL be used.	CISA	High	Exchange Online	Data loss prevention
CISA.MS.EXO.8.2	The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.	CISA	Medium	Exchange Online	Data loss prevention
CISA.MS.EXO.8.3	The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.	CISA	Medium	Exchange Online	Data loss prevention
CISA.MS.EXO.8.4	At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.	CISA	High	Exchange Online	Data loss prevention
CISA.MS.EXO.9.1	Emails SHALL be filtered by attachment file types.	CISA	Medium	Exchange Online	Anti-malware
CISA.MS.EXO.9.2	The attachment filter SHOULD attempt to determine the true file type and assess the file extension.	CISA	Medium	Exchange Online	Anti-malware
CISA.MS.EXO.9.3	Disallowed file types SHALL be determined and enforced.	CISA	High	Exchange Online	Anti-malware
CISA.MS.EXO.9.4	Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.	CISA	Medium	Exchange Online	Anti-malware
CISA.MS.EXO.9.5	At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).	CISA	High	Exchange Online	Anti-malware
CISA.MS.SHAREPOINT.1.1	External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.	CISA	Medium	SharePoint	External sharing
CISA.MS.SHAREPOINT.1.2	External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.	CISA	Medium	SharePoint	External sharing
CISA.MS.SHAREPOINT.1.3	External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.	CISA	Medium	SharePoint	External sharing
CISA.MS.SHAREPOINT.2.1	File and folder default sharing scope SHALL be set to Specific People.	CISA	Medium	SharePoint	Sharing links
CISA.MS.SHAREPOINT.2.2	File and folder default sharing permissions SHALL be set to View only.	CISA	Medium	SharePoint	Sharing links
CISA.MS.SHAREPOINT.3.1	Expiration days for Anyone links SHALL be set to 30 days or less.	CISA	Medium	SharePoint	Sharing links
CISA.MS.SHAREPOINT.3.2	Allowable file and folder permissions for Anyone links SHALL be set to View only.	CISA	Medium	SharePoint	Sharing links
CISA.MS.SHAREPOINT.3.3	Reauthentication days for people who use a verification code SHALL be set to 30 days or less.	CISA	Medium	SharePoint	External sharing
EIDSCA.AF01	Authentication Method - FIDO2 security key - State.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AF02	Authentication Method - FIDO2 security key - Allow self-service set up.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AF03	Authentication Method - FIDO2 security key - Enforce attestation.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AF04	Authentication Method - FIDO2 security key - Enforce key restrictions.	Entra ID SCA	Low	Entra ID	Authentication methods
EIDSCA.AF05	Authentication Method - FIDO2 security key - Restricted.	Entra ID SCA	Low	Entra ID	Authentication methods
EIDSCA.AF06	Authentication Method - FIDO2 security key - Restrict specific keys.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AG01	Authentication Method - General Settings - Manage migration.	Entra ID SCA	Low	Entra ID	Authentication methods
EIDSCA.AG02	Authentication Method - General Settings - Report suspicious activity - State.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AG03	Authentication Method - General Settings - Report suspicious activity - Included users/groups.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AM01	Authentication Method - Microsoft Authenticator - State.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AM02	Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AM03	Authentication Method - Microsoft Authenticator - Require number matching for push notifications.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AM04	Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AM06	Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AM07	Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AM09	Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AM10	Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AP01	Default Authorization Settings - Enabled Self service password reset for administrators.	Entra ID SCA	High	Entra ID	User and directory settings
EIDSCA.AP04	Default Authorization Settings - Guest invite restrictions.	Entra ID SCA	Medium	Entra ID	External identities
EIDSCA.AP05	Default Authorization Settings - Sign-up for email based subscription.	Entra ID SCA	Medium	Entra ID	User and directory settings
EIDSCA.AP06	Default Authorization Settings - User can join the tenant by email validation.	Entra ID SCA	Medium	Entra ID	User and directory settings
EIDSCA.AP07	Default Authorization Settings - Guest user access.	Entra ID SCA	Medium	Entra ID	External identities
EIDSCA.AP08	Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.AP09	Default Authorization Settings - Allow user consent on risk-based apps.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.AP10	Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.	Entra ID SCA	Medium	Entra ID	User and directory settings
EIDSCA.AP12	Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.	Entra ID SCA	Medium	Entra ID	User and directory settings
EIDSCA.AP14	Default Authorization Settings - Default User Role Permissions - Allowed to read other users.	Entra ID SCA	Info	Entra ID	User and directory settings
EIDSCA.AP15	Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.	Entra ID SCA	Medium	Entra ID	Agent identities
EIDSCA.AS04	Authentication Method - SMS - Use for sign-in.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.AT01	Authentication Method - Temporary Access Pass - State.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AT02	Authentication Method - Temporary Access Pass - One-time.	Entra ID SCA	Medium	Entra ID	Authentication methods
EIDSCA.AV01	Authentication Method - Voice call - State.	Entra ID SCA	High	Entra ID	Authentication methods
EIDSCA.CP01	Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.CP03	Default Settings - Consent Policy Settings - Block user consent for risky apps.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.CP04	Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.CR01	Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.	Entra ID SCA	High	Entra ID	App consent and permissions
EIDSCA.CR02	Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.	Entra ID SCA	Low	Entra ID	App consent and permissions
EIDSCA.CR03	Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.	Entra ID SCA	Low	Entra ID	App consent and permissions
EIDSCA.CR04	Consent Framework - Admin Consent Request - Consent request duration (days).	Entra ID SCA	Low	Entra ID	App consent and permissions
EIDSCA.CR05	Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.	Entra ID SCA	Low	Entra ID	App consent and permissions
EIDSCA.PR01	Default Settings - Password Rule Settings - Password Protection - Mode.	Entra ID SCA	High	Entra ID	Password protection
EIDSCA.PR02	Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.	Entra ID SCA	High	Entra ID	Password protection
EIDSCA.PR03	Default Settings - Password Rule Settings - Enforce custom list.	Entra ID SCA	Medium	Entra ID	Password protection
EIDSCA.PR05	Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.	Entra ID SCA	Medium	Entra ID	Password protection
EIDSCA.PR06	Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.	Entra ID SCA	Medium	Entra ID	Password protection
EIDSCA.ST08	Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.	Entra ID SCA	Medium	Entra ID	Groups
EIDSCA.ST09	Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.	Entra ID SCA	Low	Entra ID	Groups
MT.1001	At least one Conditional Access policy is configured with device compliance.	Maester	Medium	Entra ID	Conditional Access
MT.1002	App management restrictions on applications and service principals is configured and enabled.	Maester	Medium	Entra ID	Applications
MT.1003	At least one Conditional Access policy is configured with All Apps.	Maester	High	Entra ID	Conditional Access
MT.1004	At least one Conditional Access policy is configured with All Apps and All Users.	Maester	High	Entra ID	Conditional Access
MT.1005	All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.	Maester	High	Entra ID	Conditional Access
MT.1006	At least one Conditional Access policy is configured to require MFA for admins.	Maester	High	Entra ID	Conditional Access
MT.1007	At least one Conditional Access policy is configured to require MFA for all users.	Maester	High	Entra ID	Conditional Access
MT.1008	At least one Conditional Access policy is configured to require MFA for Azure management.	Maester	High	Entra ID	Conditional Access
MT.1009	At least one Conditional Access policy is configured to block other legacy authentication.	Maester	High	Entra ID	Conditional Access
MT.1010	At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.	Maester	High	Entra ID	Conditional Access
MT.1011	At least one Conditional Access policy is configured to secure security info registration only from a trusted location.	Maester	High	Entra ID	Conditional Access
MT.1012	At least one Conditional Access policy is configured to require MFA for risky sign-ins.	Maester	High	Entra ID	Conditional Access
MT.1013	At least one Conditional Access policy is configured to require new password when user risk is high.	Maester	High	Entra ID	Conditional Access
MT.1014	At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.	Maester	High	Entra ID	Conditional Access
MT.1015	At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.	Maester	Medium	Entra ID	Conditional Access
MT.1016	At least one Conditional Access policy is configured to require MFA for guest access.	Maester	High	Entra ID	Conditional Access
MT.1017	At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.	Maester	Medium	Entra ID	Conditional Access
MT.1018	At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.	Maester	Medium	Entra ID	Conditional Access
MT.1019	At least one Conditional Access policy is configured to enable application enforced restrictions.	Maester	Medium	Entra ID	Conditional Access
MT.1020	All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.	Maester	Medium	Entra ID	Conditional Access
MT.1021	Security Defaults are enabled.	Maester	High	Entra ID	User and directory settings
MT.1022	All users utilizing a P1 license should be licensed.	Maester	Low	Entra ID	Conditional Access
MT.1023	All users utilizing a P2 license should be licensed.	Maester	Low	Entra ID	Conditional Access
MT.1024	Entra recommendations should be completed.	Maester	Medium	Entra ID	Entra recommendations
MT.1025	No external user with permanent role assignment on Control Plane.	Maester	High	Entra ID	Roles and administrators
MT.1026	No hybrid user with permanent role assignment on Control Plane.	Maester	High	Entra ID	Roles and administrators
MT.1027	No Service Principal with Client Secret and permanent role assignment on Control Plane.	Maester	High	Entra ID	Roles and administrators
MT.1028	No user with mailbox and permanent role assignment on Control Plane.	Maester	High	Entra ID	Roles and administrators
MT.1029	Stale accounts are not assigned to privileged roles.	Maester	High	Entra ID	Privileged Identity Management
MT.1030	Eligible role assignments on Control Plane are in use by administrators.	Maester	High	Entra ID	Privileged Identity Management
MT.1031	Privileged role on Control Plane are managed by PIM only.	Maester	High	Entra ID	Privileged Identity Management
MT.1032	Limited number of Global Admins are assigned.	Maester	High	Entra ID	Privileged Identity Management
MT.1033	Users should be blocked from using legacy authentication.	Maester	High	Entra ID	Conditional Access
MT.1034	Emergency access users should not be blocked.	Maester	High	Entra ID	Conditional Access
MT.1035	All security groups assigned to Conditional Access Policies should be protected by RMAU.	Maester	High	Entra ID	Conditional Access
MT.1036	All excluded objects should have a fallback include in another policy.	Maester	Medium	Entra ID	Conditional Access
MT.1037	Only users with Presenter role are allowed to present in Teams meetings	Maester	Low	Teams	Meetings
MT.1038	Conditional Access policies should not include or exclude deleted groups.	Maester	Medium	Entra ID	Conditional Access
MT.1039	Ensure MailTips are enabled for end users	Maester	Low	Exchange Online	Outlook
MT.1041	Ensure users installing Outlook add-ins is not allowed	Maester	Medium	Exchange Online	Outlook
MT.1042	Restrict dial-in users from bypassing a meeting lobby	Maester	Medium	Teams	Meetings
MT.1043	Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains	Maester	Medium	Exchange Online	Mail flow
MT.1044	Ensure modern authentication for Exchange Online is enabled	Maester	High	Exchange Online	Client access
MT.1045	Only invited users should be automatically admitted to Teams meetings	Maester	Medium	Teams	Meetings
MT.1046	Restrict anonymous users from joining meetings	Maester	Medium	Teams	Meetings
MT.1047	Restrict anonymous users from starting Teams meetings	Maester	Medium	Teams	Meetings
MT.1048	Limit external participants from having control in a Teams meeting	Maester	Medium	Teams	Meetings
MT.1049	Conditional Access policies for User Risk and Sign-in Risk should be configured separately.	Maester	High	Entra ID	Conditional Access
MT.1050	Apps with high-risk permissions having a direct path to Global Administrator	Maester	High	Entra ID	App consent and permissions
MT.1051	Apps with high-risk permissions having an indirect path to Global Administrator	Maester	High	Entra ID	App consent and permissions
MT.1052	At least one Conditional Access policy is targeting the Device Code authentication flow.	Maester	High	Entra ID	Conditional Access
MT.1053	Ensure intune device clean-up rule is configured	Maester	Low	Intune	Tenant administration
MT.1054	Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'	Maester	Medium	Intune	Device compliance
MT.1055	Microsoft 365 Group (and Team) creation should be restricted to approved users.	Maester	Low	Entra ID	Groups
MT.1056	Ensure that no person has permanent access to all Azure subscriptions at the root scope	Maester	High	Azure	Access management
MT.1057	App registrations should no longer use secrets.	Maester	Medium	Entra ID	Applications
MT.1058	Exchange application access policies must be configured.	Maester	Medium	Entra ID	App consent and permissions
MT.1059	Microsoft Defender for Identity health issues should be resolved	Maester	Medium	Defender	Defender for Identity
MT.1060	Drift folders should match their baseline.	Maester	Medium	Microsoft 365	Configuration drift
MT.1061	Device registration MFA control conflicts with Conditional Access policies.	Maester	Medium	Entra ID	Conditional Access
MT.1062	Ensure Direct Send is set to be rejected	Maester	Medium	Exchange Online	Mail flow
MT.1063	All App registration owners should have MFA registered	Maester	High	Entra ID	Authentication methods
MT.1064	Ensure that write permissions are required to create new management groups	Maester	Medium	Azure	Management groups
MT.1065	Ensure all Recovery Services Vaults have soft delete enabled	Maester	High	Azure	Backup
MT.1066	Conditional Access policies should not reference non-existent users, groups, or roles.	Maester	Medium	Entra ID	Conditional Access
MT.1067	Authentication method policies should not reference non-existent groups.	Maester	Low	Entra ID	Authentication methods
MT.1068	Restrict non-admin users from creating tenants.	Maester	Medium	Entra ID	User and directory settings
MT.1069	Restrict non-admin users from creating security groups.	Maester	Low	Entra ID	User and directory settings
MT.1070	Restrict device join to selected users/groups or none.	Maester	Medium	Entra ID	Device identity
MT.1071	At least one Conditional Access policy explicitly includes Azure DevOps.	Maester	Medium	Entra ID	Conditional Access
MT.1072	Conditional Access policies should not use the deprecated Approved Client App grant.	Maester	High	Entra ID	Conditional Access
MT.1073	Soft- and hard-matching of synchronized objects should be blocked.	Maester	Medium	Entra ID	Hybrid identity
MT.1074	Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain	Maester	Low	Exchange Online	Mailboxes
MT.1075	Require explicit assignment of Third Party Entra Apps.	Maester	Medium	Entra ID	Applications
MT.1076	MOERA SHOULD NOT be used for sent mail	Maester	Low	Exchange Online	Mailboxes
MT.1077	App registrations with privileged API permissions should not have owners.	Maester	Medium	Defender	Exposure Management
MT.1078	App registrations with highly privileged directory roles should not have owners.	Maester	Medium	Defender	Exposure Management
MT.1079	Privileged API permissions on service principals should not remain unused.	Maester	Medium	Defender	Exposure Management
MT.1080	Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.	Maester	Medium	Defender	Exposure Management
MT.1081	Hybrid users should not be assigned Entra ID role assignments.	Maester	Medium	Defender	Exposure Management
MT.1083	Ensure Delicensing Resiliency is enabled	Maester	Low	Exchange Online	Mailboxes
MT.1084	Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.	Maester	High	Entra ID	Hybrid identity
MT.1085	Pending approvals for Critical Asset Management should not be present.	Maester	Low	Defender	Exposure Management
MT.1086	Devices should not share both critical and non-critical user credentials.	Maester	Low	Defender	Exposure Management
MT.1087	Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.	Maester	High	Defender	Exposure Management
MT.1088	Devices with critical credentials should be protected by TPM.	Maester	Medium	Defender	Exposure Management
MT.1089	Devices with critical credentials should be protected by Credential Guard.	Maester	Medium	Defender	Exposure Management
MT.1090	Global Administrator role should not be added as local administrator on the device during Microsoft Entra join	Maester	Medium	Entra ID	Device identity
MT.1091	Registering user should not be added as local administrator on the device during Microsoft Entra join	Maester	Medium	Entra ID	Device identity
MT.1092	Intune APNS certificate should be valid for more than 30 days	Maester	High	Intune	Tenant administration
MT.1093	Apple Automated Device Enrollment Tokens should be valid for more than 30 days	Maester	High	Intune	Tenant administration
MT.1094	Apple Volume Purchase Program Tokens should be valid for more than 30 days	Maester	High	Intune	Tenant administration
MT.1095	Android Enterprise account connection should be healthy	Maester	High	Intune	Tenant administration
MT.1096	Ensure at least one Intune Multi Admin Approval policy is configured	Maester	Medium	Intune	Tenant administration
MT.1097	Ensure all Intune Certificate Connectors are healthy and running supported versions	Maester	High	Intune	Tenant administration
MT.1098	Mobile Threat Defense Connectors should be healthy	Maester	High	Intune	Tenant administration
MT.1099	Windows Diagnostic Data Processing should be enabled	Maester	Low	Intune	Tenant administration
MT.1100	Intune Diagnostic Settings should include Audit Logs	Maester	High	Intune	Tenant administration
MT.1101	Default Branding Profile should be customized	Maester	Low	Intune	Tenant administration
MT.1102	Windows Feature Update Policy Settings should not reference end of support builds	Maester	High	Intune	Device configuration
MT.1103	Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups	Maester	High	Intune	Tenant administration
MT.1105	Ensure MDM Authority is set to Intune	Maester	Low	Intune	Tenant administration
MT.1106	Catalog resources must have valid roles (no stale / removed app roles or SPNs).	Maester	Low	Entra ID	Identity Governance
MT.1107	Access packages and catalogs should not reference deleted groups.	Maester	Low	Entra ID	Identity Governance
MT.1108	Access packages should not reference inactive or orphaned assignment policies.	Maester	Low	Entra ID	Identity Governance
MT.1109	Access package approval workflows must have valid approvers.	Maester	Low	Entra ID	Identity Governance
MT.1110	No catalog should contain resources without any associated access packages.	Maester	Low	Entra ID	Identity Governance
MT.1111	High privileged user should be linked to an identity.	Maester	Low	Defender	Exposure Management
MT.1112	Privileged user accounts should not remain enabled when the linked primary account is disabled.	Maester	Medium	Defender	Exposure Management
MT.1113	AI agents should not be shared with broad access control policies.	Maester	High	Copilot Studio	Agents
MT.1114	AI agents should require user authentication.	Maester	High	Copilot Studio	Agents
MT.1115	AI agents should not have risky HTTP configurations.	Maester	Medium	Copilot Studio	Agents
MT.1116	AI agents should not send email with AI-controlled inputs.	Maester	High	Copilot Studio	Agents
MT.1117	Published AI agents should not be dormant.	Maester	Low	Copilot Studio	Agents
MT.1118	AI agents should not use author (maker) authentication for connections.	Maester	Medium	Copilot Studio	Agents
MT.1119	AI agents should not have hard-coded credentials in topics.	Maester	High	Copilot Studio	Agents
MT.1120	AI agents should not use MCP server tools without review.	Maester	Medium	Copilot Studio	Agents
MT.1121	AI agents with generative orchestration should have custom instructions.	Maester	Medium	Copilot Studio	Agents
MT.1122	AI agents should not have orphaned ownership.	Maester	Medium	Copilot Studio	Agents
MT.1123	Ensure BitLocker full disk encryption is configured	Maester	High	Intune	Endpoint security
MT.1147	Do not sync krbtgt_AzureAD to Entra ID.	Maester	High	Entra ID	Hybrid identity
MT.1148	Archive Scanning should be enabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1149	Behavior Monitoring should be enabled.	Maester	High	Defender	Endpoint antivirus
MT.1150	Cloud Protection should be enabled.	Maester	High	Defender	Endpoint antivirus
MT.1151	Email Scanning should be enabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1152	Script Scanning should be enabled.	Maester	High	Defender	Endpoint antivirus
MT.1153	Real-time Monitoring should be enabled.	Maester	High	Defender	Endpoint antivirus
MT.1154	Full Scan Removable Drives should be enabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1155	Full Scan Mapped Drives should be disabled for performance.	Maester	Low	Defender	Endpoint antivirus
MT.1156	Scanning Network Files should be enabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1157	CPU Load Factor should be optimized (20-30%).	Maester	Low	Defender	Endpoint antivirus
MT.1158	Scan should be scheduled.	Maester	Low	Defender	Endpoint antivirus
MT.1159	Quick Scan Time configuration is not required.	Maester	Info	Defender	Endpoint antivirus
MT.1160	Signatures should be checked before scan.	Maester	Low	Defender	Endpoint antivirus
MT.1161	Cloud Block Level should be High or higher.	Maester	Medium	Defender	Endpoint antivirus
MT.1162	Cloud Extended Timeout should be 30-50 seconds.	Maester	Low	Defender	Endpoint antivirus
MT.1163	Signature Update Interval should be 1-4 hours.	Maester	Low	Defender	Endpoint antivirus
MT.1164	PUA Protection should be enabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1165	Network Protection should be enabled.	Maester	High	Defender	Endpoint antivirus
MT.1166	Local Admin Merge should be disabled.	Maester	Medium	Defender	Endpoint antivirus
MT.1167	Real-Time Scan Direction should cover both directions.	Maester	Medium	Defender	Endpoint antivirus
MT.1168	Cleaned Malware should be retained for at least 30 days.	Maester	Low	Defender	Endpoint antivirus
MT.1169	Catch-up Full Scan should be disabled.	Maester	Low	Defender	Endpoint antivirus
MT.1170	Catch-up Quick Scan should be disabled.	Maester	Low	Defender	Endpoint antivirus
MT.1171	Sample Submission should send safe samples automatically.	Maester	Medium	Defender	Endpoint antivirus
MT.1172	Unified audit log ingestion is enabled.	Maester	High	Purview	Audit
MT.1173	Sensitivity labels are published for files used by Microsoft 365 Copilot.	Maester	Medium	Purview	Information protection
MT.1174	Insider Risk Management policy for Risky AI usage is enabled.	Maester	Medium	Purview	Insider risk management
MT.1175	DLP policy is configured for the Microsoft 365 Copilot location.	Maester	High	Purview	Data loss prevention
MT.1176	Retention policy is configured for the Microsoft Copilot location.	Maester	Medium	Purview	Data lifecycle management
MT.1177	Ensure LAPS Configuration Policy is properly set.	Maester	Medium	Intune	Endpoint security
MT.1178	Ensure ASR Rules are configured correctly.	Maester	High	Intune	Endpoint security
MT.1179	Ensure App Control for Business is enabled.	Maester	High	Intune	Endpoint security
MT.1180	Ensure Managed Installer Rules are configured correctly.	Maester	Medium	Intune	Endpoint security
MT.1181	Conditional Access policy is present that blocks high agent risk sign-ins.	Maester	High	Entra ID	Conditional Access
MT.1182	Mature DMARC policy SHALL be published for every Entra managed and verified domain.	Maester	Medium	Entra ID	User and directory settings
MT.1183	Temporary bypass for onPremisesObjectIdentifier updates should be disabled.	Maester	Medium	Entra ID	Hybrid identity
MT.1184	Conditional Access policy without any target resources configured.	Maester	Medium	Entra ID	Conditional Access
MT.1185	Block legacy MSOnline (MSOL) PowerShell module.	Maester	Medium	Entra ID	User and directory settings
MT.1186	Require explicit assignment of high-privilege first-party Entra Apps.	Maester	Medium	Entra ID	Applications
MT.1187	The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.	Maester	Medium	Entra ID	Global Secure Access
MT.1188	Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.	Maester	Medium	Entra ID	Global Secure Access
MT.1189	Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.	Maester	Medium	Entra ID	Global Secure Access
MT.1190	Entra Private Access applications should not use the Default connector group.	Maester	Low	Entra ID	Global Secure Access
MT.1191	Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.	Maester	Medium	Entra ID	Global Secure Access
MT.1192	Groups assigned to Entra Private Access applications should not be nested.	Maester	Low	Entra ID	Global Secure Access
MT.1193	Entra Private Access application segments should avoid broad or risky destinations.	Maester	Medium	Entra ID	Global Secure Access
MT.1194	The baseline Global Secure Access security profile should enforce a threat-intelligence floor.	Maester	Medium	Entra ID	Global Secure Access
MT.1195	The Quick Access app should not be subject to a sign-in frequency Conditional Access control.	Maester	Low	Entra ID	Global Secure Access
MT.1196	Review who can change attributes used by dynamic group rules.	Maester	Medium	Entra ID	Groups
MT.1197	Remove memberOf rules.	Maester	Medium	Entra ID	Groups
MT.1198	App registration certificates should not have excessive validity periods.	Maester	Medium	Entra ID	Applications
MT.1199	App registration credentials should not be expired or expiring soon.	Maester	Low	Entra ID	Applications
MT.1200	Agent Identities should have an active Agent Identity Blueprint Principal (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1201	Agent Users should have an existing parent Agent Identity (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1203	Agent Identity Blueprint Principals should have an existing Blueprint (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1204	Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1205	Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1206	Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1207	Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).	Maester	High	Entra ID	Agent identities
MT.1208	Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1209	Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).	Maester	High	Entra ID	Agent identities
MT.1210	Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).	Maester	High	Entra ID	Agent identities
MT.1211	Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).	Maester	High	Entra ID	Agent identities
MT.1212	Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).	Maester	Medium	Entra ID	Agent identities
MT.1213	Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).	Maester	High	Entra ID	Agent identities
MT.1214	Ensure macOS compliance policy requires System Integrity Protection.	Maester	Medium	Intune	Device compliance
MT.1215	Ensure Gatekeeper restricts macOS app download locations.	Maester	Medium	Intune	Device compliance
MT.1216	Ensure macOS compliance policy requires a Defender machine risk score level.	Maester	Medium	Intune	Device compliance
MT.1217	Ensure macOS LAPS is configured on Automated Device Enrollment profiles.	Maester	High	Intune	Device enrollment
MT.1223	Agent Identities should not have high-risk Microsoft Graph permissions (Preview).	Maester	High	Entra ID	Agent identities
MT.1224	Microsoft-managed Conditional Access policies should not be left in report-only mode.	Maester	Low	Entra ID	Conditional Access
MT.1225	Users should not be able to create Agent Identity Blueprints.	Maester	Medium	Entra ID	Agent identities
ORCA.100	Bulk Complaint Level threshold is between 4 and 6.	ORCA	Low	Defender	Anti-spam
ORCA.101	Bulk is marked as spam.	ORCA	Low	Defender	Anti-spam
ORCA.102	Advanced Spam filter options are turned off.	ORCA	Low	Defender	Anti-spam
ORCA.103	Outbound spam filter policy settings configured.	ORCA	Medium	Defender	Anti-spam
ORCA.104	High Confidence Phish action set to Quarantine message.	ORCA	High	Defender	Anti-spam
ORCA.105	Safe Links Synchronous URL detonation is enabled.	ORCA	Medium	Defender	Safe Links
ORCA.106	Quarantine retention period is 30 days.	ORCA	Low	Defender	Anti-spam
ORCA.107	End-user spam notification is enabled.	ORCA	Low	Defender	Quarantine
ORCA.108	DKIM signing is set up for all your custom domains.	ORCA	Medium	Defender	Email authentication
ORCA.108.1	DNS Records have been set up to support DKIM.	ORCA	Medium	Defender	Email authentication
ORCA.109	Senders are not being allow listed in an unsafe manner.	ORCA	Medium	Defender	Anti-spam
ORCA.110	Internal Sender notifications are disabled.	ORCA	Low	Defender	Anti-malware
ORCA.111	Anti-phishing policy exists and EnableUnauthenticatedSender is true.	ORCA	Medium	Defender	Anti-phishing
ORCA.112	Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.	ORCA	Medium	Defender	Anti-phishing
ORCA.113	AllowClickThrough is disabled in Safe Links policies.	ORCA	Medium	Defender	Safe Links
ORCA.114	No IP Allow Lists have been configured.	ORCA	Medium	Defender	Anti-spam
ORCA.115	Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.	ORCA	Medium	Defender	Anti-phishing
ORCA.116	Mailbox intelligence based impersonation protection action set to move message to junk mail folder.	ORCA	Medium	Defender	Anti-phishing
ORCA.118.1	Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.	ORCA	High	Defender	Anti-spam
ORCA.118.2	Domains are not being allow listed in an unsafe manner in Transport Rules.	ORCA	High	Defender	Mail flow
ORCA.118.3	Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.	ORCA	High	Defender	Anti-spam
ORCA.118.4	Your own domains are not being allow listed in an unsafe manner in Transport Rules.	ORCA	High	Defender	Mail flow
ORCA.119	Similar Domains Safety Tips is enabled.	ORCA	Info	Defender	Anti-phishing
ORCA.120.1	Zero Hour Autopurge Enabled for Phish.	ORCA	Medium	Defender	Zero-hour auto purge
ORCA.120.2	Zero Hour Autopurge Enabled for Malware.	ORCA	Medium	Defender	Zero-hour auto purge
ORCA.120.3	Zero Hour Autopurge Enabled for Spam.	ORCA	Medium	Defender	Zero-hour auto purge
ORCA.121	Supported filter policy action used.	ORCA	Medium	Defender	Zero-hour auto purge
ORCA.123	Unusual Characters Safety Tips is enabled.	ORCA	Info	Defender	Anti-phishing
ORCA.124	Safe attachments unknown malware response set to block messages.	ORCA	High	Defender	Safe Attachments
ORCA.139	Spam action set to move message to junk mail folder or quarantine.	ORCA	Low	Defender	Anti-spam
ORCA.140	High Confidence Spam action set to Quarantine message.	ORCA	Medium	Defender	Anti-spam
ORCA.141	Bulk action set to Move message to Junk Email Folder.	ORCA	Low	Defender	Anti-spam
ORCA.142	Phish action set to Quarantine message.	ORCA	Medium	Defender	Anti-spam
ORCA.143	Safety Tips are enabled.	ORCA	Info	Defender	Anti-spam
ORCA.156	Safe Links Policies are tracking when user clicks on safe links.	ORCA	Medium	Defender	Safe Links
ORCA.158	Safe Attachments is enabled for SharePoint and Teams.	ORCA	Medium	Defender	Safe Attachments
ORCA.179	Safe Links is enabled intra-organization.	ORCA	Medium	Defender	Safe Links
ORCA.180	Anti-phishing policy exists and EnableSpoofIntelligence is true.	ORCA	Medium	Defender	Anti-phishing
ORCA.189	Safe Attachments is not bypassed.	ORCA	Medium	Defender	Mail flow
ORCA.189.2	Safe Links is not bypassed.	ORCA	High	Defender	Mail flow
ORCA.205	Common attachment type filter is enabled.	ORCA	Medium	Defender	Anti-malware
ORCA.220	Advanced Phish filter Threshold level is adequate.	ORCA	Medium	Defender	Anti-phishing
ORCA.221	Mailbox intelligence is enabled in anti-phishing policies.	ORCA	Medium	Defender	Anti-phishing
ORCA.222	Domain Impersonation action is set to move to Quarantine.	ORCA	Medium	Defender	Anti-phishing
ORCA.223	User impersonation action is set to move to Quarantine.	ORCA	Medium	Defender	Anti-phishing
ORCA.224	Similar Users Safety Tips is enabled.	ORCA	Info	Defender	Anti-phishing
ORCA.225	Safe Documents is enabled for Office clients.	ORCA	Medium	Defender	Safe Attachments
ORCA.226	Each domain has a Safe Link policy applied to it.	ORCA	Medium	Defender	Safe Links
ORCA.227	Each domain has a Safe Attachments policy applied to it.	ORCA	Medium	Defender	Safe Attachments
ORCA.228	No trusted senders in Anti-phishing policy.	ORCA	Medium	Defender	Anti-phishing
ORCA.229	No trusted domains in Anti-phishing policy.	ORCA	Medium	Defender	Anti-phishing
ORCA.230	Each domain has a Anti-phishing policy applied to it, or the default policy is being used.	ORCA	Low	Defender	Anti-phishing
ORCA.231	Each domain has a anti-spam policy applied to it, or the default policy is being used.	ORCA	Low	Defender	Anti-spam
ORCA.232	Each domain has a malware filter policy applied to it, or the default policy is being used.	ORCA	Low	Defender	Anti-malware
ORCA.233	Domains are pointed directly at EOP or enhanced filtering is used.	ORCA	Medium	Defender	Mail flow
ORCA.233.1	Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.	ORCA	Medium	Defender	Mail flow
ORCA.234	Click through is disabled for Safe Documents.	ORCA	Medium	Defender	Safe Attachments
ORCA.235	SPF records is set up for all your custom domains.	ORCA	Medium	Defender	Email authentication
ORCA.236	Safe Links is enabled for emails.	ORCA	Medium	Defender	Safe Links
ORCA.237	Safe Links is enabled for teams messages.	ORCA	Medium	Defender	Safe Links
ORCA.238	Safe Links is enabled for office documents.	ORCA	Medium	Defender	Safe Links
ORCA.239	No exclusions for the built-in protection policies.	ORCA	High	Defender	Safe Links
ORCA.240	Outlook is configured to display external tags for external emails.	ORCA	Medium	Defender	Tenant settings
ORCA.241	Anti-phishing policy exists and EnableFirstContactSafetyTips is true.	ORCA	Medium	Defender	Anti-phishing
ORCA.242	Important protection alerts responsible for AIR activities are enabled.	ORCA	High	Defender	Tenant settings
ORCA.243	Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.	ORCA	Medium	Defender	Email authentication
ORCA.244	Policies are configured to honor sending domains DMARC.	ORCA	Medium	Defender	Anti-phishing