CIS Benchmark Tests

These tests verify tenant and organization configuration against CIS Benchmark recommendations.

149 checks20 High114 Medium15 Low

Run theseInvoke-Maester -Suite cisCopy

149 checks

Group byProductFeatureAreaSeverityNone

Columns

ProductFeatureAreaSeverityUser impactEffortATT&CKControlsSourceReset to default

ID↕Check↕Product↕Feature↕Area↕Severity↕User impact↕Effort↕ATT&CK↕Controls↕Source↕

CIS.GH.1.2.3Ensure repository deletion is limited to specific usersGitHubOrganization settingsAccess controlHighLowLowT1485, T1070cis-github:1.2.3, nist-800-53-r5:AC-6CISCIS.GH.1.3.8Ensure strict base permissions are set for repositoriesGitHubOrganization settingsAccess controlHighMediumMediumT1677, T1195.002cis-github:1.3.8, nist-800-53-r5:AC-6 +1CISCIS.M365.1.1.1Ensure Administrative accounts are cloud-onlyMicrosoft 365Administrative accountsPrivileged accessHighLowMediumT1078.002, T1078.004 +1cis-m365:1.1.1, nist-800-53-r5:AC-6(5)CISCIS.M365.1.1.3Ensure that between two and four global admins are designatedMicrosoft 365Administrative accountsPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:1.1.3, nist-800-53-r5:AC-6(5)CISCIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabledDefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002cis-m365:2.1.4, nist-800-53-r5:SI-3CISCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002cis-m365:2.1.14, nist-800-53-r5:SI-8CISCIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledPurviewAuditLogging and detectionHighLowLowT1685.002cis-m365:3.1.1, nist-800-53-r5:AU-12CISCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedEntra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002cis-m365:5.1.5.1, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledEntra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528cis-m365:5.1.5.2, nist-800-53-r5:CM-4CISCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110.003cis-m365:5.2.2.1, nist-800-53-r5:IA-2(1)CISCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110cis-m365:5.2.2.2, nist-800-53-r5:IA-2(2)CISCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.2.3, nist-800-53-r5:CM-7CISCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1111cis-m365:5.2.2.5, nist-800-53-r5:IA-2(1) +1CISCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Entra IDConditional AccessAuthenticationHighLowMediumT1078.004, T1528 +1cis-m365:5.2.2.12, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Entra IDAuthentication methodsAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.3.4, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.5Ensure weak authentication methods are disabledEntra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cis-m365:5.2.3.5, nist-800-53-r5:CM-7 +1CISCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:5.3.1, nist-800-53-r5:AC-6(5)CISCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1685.002cis-m365:6.1.1, nist-800-53-r5:AU-12CISCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Exchange OnlineMail flowExternal access and sharingHighMediumLowT1114.003cis-m365:6.2.1, nist-800-53-r5:AC-4CISCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Exchange OnlineClient accessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:6.5.4, nist-800-53-r5:CM-7CISCIS.GH.1.2.2Ensure repository creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLowT1567.001cis-github:1.2.2, nist-800-53-r5:AC-6CISCIS.GH.1.2.4Ensure issue deletion is limited to specific usersGitHubOrganization settingsAccess controlMediumLowLowT1070, T1485cis-github:1.2.4, nist-800-53-r5:AC-6CISCIS.GH.1.3.2Ensure team creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLow—cis-github:1.3.2, nist-800-53-r5:AC-6CISCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Microsoft 365Administrative accountsPrivileged accessMediumLowMediumT1566cis-m365:1.1.4, nist-800-53-r5:AC-6(5)CISCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existMicrosoft 365Teams and groupsAccess controlMediumLowMediumT1213.002cis-m365:1.2.1, nist-800-53-r5:AC-3CISCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedMicrosoft 365Teams and groupsAccess controlMediumLowLowT1078.004cis-m365:1.2.2, nist-800-53-r5:AC-2CISCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Microsoft 365Organization settingsAuthenticationMediumLowLow—cis-m365:1.3.1, nist-800-53-r5:IA-5(1)CISCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Microsoft 365Organization settingsAuthenticationMediumMediumMediumT1550.004cis-m365:1.3.2, nist-800-53-r5:AC-12CISCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableMicrosoft 365Organization settingsExternal access and sharingMediumLowLowT1591cis-m365:1.3.3, nist-800-53-r5:AC-3 +1CISCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedMicrosoft 365Organization settingsApplications and workload identitiesMediumMediumLowT1137.006cis-m365:1.3.4, nist-800-53-r5:CM-7 +1CISCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledMicrosoft 365Organization settingsEmail and collaboration protectionMediumLowLowT1534, T1598cis-m365:1.3.5, nist-800-53-r5:SI-8CISCIS.M365.1.3.6Ensure the customer lockbox feature is enabledMicrosoft 365Organization settingsAccess controlMediumLowLowT1199cis-m365:1.3.6CISCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Microsoft 365Organization settingsExternal access and sharingMediumLowLowT1567.002cis-m365:1.3.7, nist-800-53-r5:AC-20 +1CISCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cis-m365:2.1.1, nist-800-53-r5:SI-3CISCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)DefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cis-m365:2.1.2, nist-800-53-r5:SI-3CISCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledDefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.3, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledDefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:2.1.5, nist-800-53-r5:SI-3CISCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsDefenderAnti-spamEmail and collaboration protectionMediumLowLowT1078.004cis-m365:2.1.6, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdDefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001 +1cis-m365:2.1.7, nist-800-53-r5:SI-8CISCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.8, nist-800-53-r5:SI-8CISCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsDefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.9, nist-800-53-r5:SC-8CISCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.10, nist-800-53-r5:SI-8CISCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedDefenderAnti-malwareEmail and collaboration protectionMediumMediumMediumT1566.001, T1204.002cis-m365:2.1.11, nist-800-53-r5:SI-3CISCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.12, nist-800-53-r5:AC-4CISCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:2.1.13, nist-800-53-r5:AC-4CISCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.15, nist-800-53-r5:AC-4CISCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowMediumT1566cis-m365:2.4.1, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.2, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.4, nist-800-53-r5:SI-3CISCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.1, nist-800-53-r5:AC-4CISCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.2, nist-800-53-r5:AC-4CISCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0PurviewData loss preventionData protectionMediumLowMediumT1213.002, T1530cis-m365:3.2.3, nist-800-53-r5:AC-4CISCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'IntuneDevice complianceDevices and endpointsMediumMediumMediumT1078.004cis-m365:4.1, nist-800-53-r5:AC-19 +1CISCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0IntuneDevice enrollmentDevices and endpointsMediumMediumLowT1098.005cis-m365:4.2, nist-800-53-r5:AC-19CISCIS.M365.5.1.2.2Ensure users cannot register applicationsEntra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528cis-m365:5.1.2.2, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'Entra IDUser and directory settingsAccess controlMediumLowLow—cis-m365:5.1.2.3, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Entra IDDevice identityDevices and endpointsMediumLowLowT1098.005cis-m365:5.1.4.1, nist-800-53-r5:IA-3CISCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.004cis-m365:5.1.4.3, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumMediumLowT1685, T1003cis-m365:5.1.4.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.003cis-m365:5.1.4.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysEntra IDDevice identityAccess controlMediumLowLowT1552cis-m365:5.1.4.6, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.3, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.4, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1110.001, T1110.003cis-m365:5.1.5.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.6, nist-800-53-r5:IA-5CISCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1136.003cis-m365:5.1.6.1, nist-800-53-r5:AC-20CISCIS.M365.5.1.6.2Ensure that guest user access is restrictedEntra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003cis-m365:5.1.6.2, nist-800-53-r5:AC-6CISCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003cis-m365:5.1.6.3, nist-800-53-r5:AC-2CISCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Entra IDHybrid identityAuthenticationMediumLowLowT1078.004cis-m365:5.1.8.1, nist-800-53-r5:IA-5CISCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Entra IDConditional AccessPrivileged accessMediumLowMediumT1550.004cis-m365:5.2.2.4, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.6, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.7, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.8, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Entra IDConditional AccessAccess controlMediumHighHighT1078.004cis-m365:5.2.2.9, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cis-m365:5.2.2.10, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1098.005cis-m365:5.2.2.11, nist-800-53-r5:IA-11CISCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.13, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.15, nist-800-53-r5:AC-3CISCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.16, nist-800-53-r5:SC-23CISCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Entra IDConditional AccessAuthenticationMediumLowMediumT1078.004cis-m365:5.2.2.17, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Entra IDAuthentication methodsAuthenticationMediumLowLowT1621cis-m365:5.2.3.1, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.003cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Entra IDPassword protectionAuthenticationMediumLowMediumT1110.003cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationMediumMediumLowT1078.004, T1111cis-m365:5.2.3.7, nist-800-53-r5:CM-7 +1CISCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003cis-m365:5.2.3.8, nist-800-53-r5:AC-7CISCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001cis-m365:5.2.3.9, nist-800-53-r5:AC-7CISCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Entra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004cis-m365:5.3.2, nist-800-53-r5:AC-2CISCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Entra IDIdentity GovernancePrivileged accessMediumLowMediumT1078.004cis-m365:5.3.3, nist-800-53-r5:AC-6(7)CISCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1548.005cis-m365:5.3.4, nist-800-53-r5:AC-5CISCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1098.003cis-m365:5.3.5, nist-800-53-r5:AC-5CISCIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.2, nist-800-53-r5:AU-12CISCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.3, nist-800-53-r5:AU-12CISCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:6.2.2, nist-800-53-r5:SI-8CISCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0Exchange OnlineOutlookEmail and collaboration protectionMediumLowLowT1566cis-m365:6.2.3, nist-800-53-r5:SI-8CISCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0Exchange OnlineOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002cis-m365:6.3.1, nist-800-53-r5:CM-7CISCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webExchange OnlineOutlookExternal access and sharingMediumLowLowT1567.002, T1204.002cis-m365:6.5.3, nist-800-53-r5:AC-20 +1CISCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002cis-m365:6.5.5, nist-800-53-r5:SI-8CISCIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0SharePointAccess controlAuthenticationMediumMediumLowT1110cis-m365:7.2.1, nist-800-53-r5:IA-2CISCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledSharePointExternal sharingExternal access and sharingMediumLowLowT1078.004, T1213.002cis-m365:7.2.2CISCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.3, nist-800-53-r5:AC-21CISCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.4, nist-800-53-r5:AC-21CISCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownSharePointExternal sharingExternal access and sharingMediumLowLowT1213.002, T1530cis-m365:7.2.5, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530 +1cis-m365:7.2.6, nist-800-53-r5:AC-21CISCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharePointSharing linksAccess controlMediumLowLowT1213.002cis-m365:7.2.7, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530cis-m365:7.2.8, nist-800-53-r5:AC-21CISCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallySharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.9, nist-800-53-r5:AC-2(2)CISCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0SharePointExternal sharingAuthenticationMediumLowLowT1078.004cis-m365:7.2.10, nist-800-53-r5:IA-5CISCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cis-m365:7.2.11, nist-800-53-r5:AC-6CISCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadSharePointAccess controlEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:7.3.1, nist-800-53-r5:SI-3CISCIS.M365.8.1.1Ensure external file sharing in Teams is enabled for only approved cloud storage servicesTeamsFile sharingExternal access and sharingMediumLowLowT1567.002cis-m365:8.1.1, nist-800-53-r5:AC-20 +1CISCIS.M365.8.1.2Ensure users can't send emails to a channel email addressNew in 3.0TeamsMessagingExternal access and sharingMediumMediumLowT1566cis-m365:8.1.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.1Ensure external domains are restricted in the Teams admin centerNew in 3.0TeamsExternal accessExternal access and sharingMediumMediumLowT1566cis-m365:8.2.1, nist-800-53-r5:AC-20CISCIS.M365.8.2.2Ensure communication with unmanaged Teams users is disabledTeamsExternal accessExternal access and sharingMediumMediumLowT1566, T1204.001 +1cis-m365:8.2.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.3Ensure external Teams users cannot initiate conversationsTeamsExternal accessExternal access and sharingMediumLowLowT1566, T1204.001 +1cis-m365:8.2.3, nist-800-53-r5:AC-20CISCIS.M365.8.2.4Ensure the organization cannot communicate with accounts in trial Teams tenantsNew in 3.0TeamsExternal accessExternal access and sharingMediumLowLowT1566cis-m365:8.2.4, nist-800-53-r5:AC-20CISCIS.M365.8.4.1Ensure app permission policies are configuredTeamsAppsApplications and workload identitiesMediumMediumMediumT1195, T1671cis-m365:8.4.1, nist-800-53-r5:CM-7CISCIS.M365.8.5.1Ensure anonymous users can't join a meetingNew in 3.0TeamsMeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.1, nist-800-53-r5:AC-3CISCIS.M365.8.5.2Ensure anonymous users and dial-in callers can't start a meetingNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.2, nist-800-53-r5:AC-3CISCIS.M365.8.5.3Ensure only people in my org can bypass the lobbyTeamsMeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.3, nist-800-53-r5:AC-3CISCIS.M365.8.5.4Ensure users dialing in can't bypass the lobbyNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.4, nist-800-53-r5:AC-3CISCIS.M365.8.5.5Ensure meeting chat does not allow anonymous usersNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1566cis-m365:8.5.5, nist-800-53-r5:AC-3CISCIS.M365.8.5.7Ensure external participants can't give or request controlNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1219cis-m365:8.5.7, nist-800-53-r5:AC-3CISCIS.M365.8.5.8Ensure external meeting chat is offNew in 3.0TeamsMeetingsExternal access and sharingMediumMediumLowT1566cis-m365:8.5.8, nist-800-53-r5:AC-3CISCIS.M365.8.6.1Ensure users can report security concerns in TeamsTeamsMessagingEmail and collaboration protectionMediumLowLowT1566cis-m365:8.6.1CISCIS.M365.9.1.1Restrict guest access to FabricNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1078.004cis-m365:9.1.1, nist-800-53-r5:AC-3CISCIS.M365.9.1.2Restrict external guest invitations through FabricNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1136.003cis-m365:9.1.2, nist-800-53-r5:AC-2CISCIS.M365.9.1.4Restrict public publishing of Fabric reportsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.4, nist-800-53-r5:AC-22CISCIS.M365.9.1.5Disable R and Python visuals in FabricNew in 3.0Microsoft FabricTenant settingsInfrastructure hardeningMediumMediumMediumT1059cis-m365:9.1.5, nist-800-53-r5:CM-7CISCIS.M365.9.1.6Enable sensitivity labels for Fabric contentNew in 3.0Microsoft FabricInformation protectionData protectionMediumLowMedium—cis-m365:9.1.6, nist-800-53-r5:AC-16CISCIS.M365.9.1.8Restrict external sharing of semantic modelsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.8, nist-800-53-r5:AC-21CISCIS.M365.9.1.9Block resource-key authentication for Fabric datasetsNew in 3.0Microsoft FabricDeveloper settingsAuthenticationMediumMediumMedium—cis-m365:9.1.9, nist-800-53-r5:IA-5CISCIS.M365.9.1.10Restrict service principal access to Fabric public APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.10, nist-800-53-r5:AC-3CISCIS.M365.9.1.11Restrict service principal profiles in FabricNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.11, nist-800-53-r5:AC-3CISCIS.M365.9.1.12Restrict service principal access to Fabric global APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.12, nist-800-53-r5:AC-3CISCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Microsoft 365Organization settingsExternal access and sharingLowLowLowT1566cis-m365:1.3.9, nist-800-53-r5:AC-3CISCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0PurviewInformation protectionData protectionLowMediumMedium—cis-m365:3.3.1, nist-800-53-r5:AC-4CISCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0Entra IDGroupsAccess controlLowMediumLowT1098cis-m365:5.1.3.1, nist-800-53-r5:AC-6CISCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0Entra IDGroupsAccess controlLowMediumLow—cis-m365:5.1.3.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Entra IDDevice identityDevices and endpointsLowLowLowT1098.005cis-m365:5.1.4.2, nist-800-53-r5:CM-8CISCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Entra IDConditional AccessAccess controlLowLowLow—cis-m365:5.2.2.14, nist-800-53-r5:AC-3CISCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowLowLowT1111cis-m365:5.2.3.6, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowMediumLowT1111cis-m365:5.2.3.10, nist-800-53-r5:IA-2CISCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0Exchange OnlineOutlookExternal access and sharingLowLowLowT1566cis-m365:6.3.2, nist-800-53-r5:AC-20CISCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Exchange OnlineClient accessAuthenticationLowLowLow—cis-m365:6.5.1, nist-800-53-r5:IA-2CISCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0Exchange OnlineOutlookEmail and collaboration protectionLowLowLow—cis-m365:6.5.2, nist-800-53-r5:AC-4CISCIS.M365.8.5.6Ensure only organizers and co-organizers can presentNew in 3.0TeamsMeetingsEmail and collaboration protectionLowMediumLowT1566.003cis-m365:8.5.6, nist-800-53-r5:AC-3CISCIS.M365.8.5.9Ensure meeting recording is off by defaultNew in 3.0TeamsMeetingsData protectionLowMediumLow—cis-m365:8.5.9, nist-800-53-r5:CM-7CISCIS.M365.9.1.3Restrict guest browsing of Fabric contentNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingLowMediumLowT1213cis-m365:9.1.3, nist-800-53-r5:AC-3CISCIS.M365.9.1.7Restrict organization-wide Fabric linksNew in 3.0Microsoft FabricExport and sharing settingsAccess controlLowMediumLow—cis-m365:9.1.7, nist-800-53-r5:AC-3CIS