CISA Tests
These tests verify Microsoft 365 tenant configuration against CISA Secure Cloud Business Applications baseline guidance.
76 checks31 High44 Medium1 Low
Run these
Invoke-Maester -Suite cisaCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.
Entra ID
Conditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.1, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.3, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighHighHighT1566.002cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1) +4CISA SCuBACISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.3.2, nist-800-53-r5:IA-2(1) +1CISA SCuBACISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra ID
Authentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cisa-scuba:MS.AAD.3.5, nist-800-53-r5:CM-7b +1CISA SCuBACISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1566.002cisa-scuba:MS.AAD.3.6, nist-800-53-r5:IA-2(1) +3CISA SCuBACISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra ID
Logs and monitoringLogging and detectionHighLowMediumT1685.002cisa-scuba:MS.AAD.4.1, nist-800-53-r5:AU-4CISA SCuBACISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra ID
App consent and permissionsApplications and workload identitiesHighMediumLowT1098.001, T1098.003 +2cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.3, nist-800-53-r5:CM-4CISA SCuBACISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra ID
Roles and administratorsPrivileged accessHighLowMediumT1098.003, T1078.004cisa-scuba:MS.AAD.7.1, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.2, nist-800-53-r5:AC-5CISA SCuBACISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1cisa-scuba:MS.AAD.7.3, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra ID
Privileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.4, nist-800-53-r5:AC-2CISA SCuBACISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.5, nist-800-53-r5:AC-2CISA SCuBACISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.
Exchange Online
Mail flowEmail and collaboration protectionHighMediumLowT1114.003, T1048 +1cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange Online
Email authenticationEmail and collaboration protectionHighMediumHighT1566, T1598 +1cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange Online
Client accessAuthenticationHighMediumMedium—cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange Online
Data loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.1, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.4, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange Online
Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.10.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange Online
Anti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange Online
Mailbox auditingLogging and detectionHighLowLowT1070.008, T1098.002 +3cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12cCISA SCuBACISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange Online
Anti-spamEmail and collaboration protectionHighLowLowT1566cisa-scuba:MS.EXO.14.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange Online
Safe LinksEmail and collaboration protectionHighLowLowT1204.001, T1566.002cisa-scuba:MS.EXO.15.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange Online
Alert policiesLogging and detectionHighLowLowT1114.003, T1204.001cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineAudit loggingLogging and detectionHighLowLowT1685.002cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12CISA SCuBACISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra ID
Identity ProtectionLogging and detectionMediumLowLowT1078.004cisa-scuba:MS.AAD.2.2, nist-800-53-r5:AC-2(12)CISA SCuBACISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1110, T1621cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1) +5CISA SCuBACISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDConditional AccessAccess controlMediumHighHighT1078.004cisa-scuba:MS.AAD.3.7, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cisa-scuba:MS.AAD.3.8, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra ID
User and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra ID
Password protectionAuthenticationMediumLowLow—cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)CISA SCuBACISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1)CISA SCuBACISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1)CISA SCuBACISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.8, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.9, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra ID
External identitiesExternal access and sharingMediumLowLowT1087.003, T1087.004 +2cisa-scuba:MS.AAD.8.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1098.003, T1136.003cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)CISA SCuBACISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004cisa-scuba:MS.AAD.8.3, nist-800-53-r5:AC-3CISA SCuBACISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.2.2, nist-800-53-r5:AC-2dCISA SCuBACISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1598 +1cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8CISA SCuBACISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1566, T1598 +1cisa-scuba:MS.EXO.4.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1684.002cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange Online
Calendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567 +1cisa-scuba:MS.EXO.6.2, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.2, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.3CISA SCuBACISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1036.008, T1204.002 +1cisa-scuba:MS.EXO.9.2CISA SCuBACISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.4CISA SCuBACISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.2, nist-800-53-r5:AT-2b +1CISA SCuBACISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.11.3CISA SCuBACISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cisa-scuba:MS.EXO.12.2, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.14.3, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.4CISA SCuBACISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3 +1CISA SCuBACISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineAlert policiesLogging and detectionMediumLowMedium—cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineAudit loggingLogging and detectionMediumLowLowT1070cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11CISA SCuBACISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
SharePoint
External sharingExternal access and sharingMediumHighMediumT1048, T1213.002cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointExternal sharingExternal access and sharingMediumMediumMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePoint
Sharing linksAccess controlMediumLowLowT1048, T1213.002cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointSharing linksExternal access and sharingMediumLowLowT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointSharing linksExternal access and sharingMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointExternal sharingAuthenticationMediumLowLowT1213.002, T1530cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11CISA SCuBACISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDAuthentication methodsAuthenticationLowLowMedium—cisa-scuba:MS.AAD.3.4, nist-800-53-r5:CM-7CISA SCuBA
Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.1, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.3, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighHighHighT1566.002cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1) +4CISA SCuBACISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.3.2, nist-800-53-r5:IA-2(1) +1CISA SCuBACISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cisa-scuba:MS.AAD.3.5, nist-800-53-r5:CM-7b +1CISA SCuBACISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1566.002cisa-scuba:MS.AAD.3.6, nist-800-53-r5:IA-2(1) +3CISA SCuBACISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002cisa-scuba:MS.AAD.4.1, nist-800-53-r5:AU-4CISA SCuBACISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1098.001, T1098.003 +2cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.3, nist-800-53-r5:CM-4CISA SCuBACISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1078.004cisa-scuba:MS.AAD.7.1, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.2, nist-800-53-r5:AC-5CISA SCuBACISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1cisa-scuba:MS.AAD.7.3, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.4, nist-800-53-r5:AC-2CISA SCuBACISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.5, nist-800-53-r5:AC-2CISA SCuBACISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineMail flowEmail and collaboration protectionHighMediumLowT1114.003, T1048 +1cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineEmail authenticationEmail and collaboration protectionHighMediumHighT1566, T1598 +1cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineClient accessAuthenticationHighMediumMedium—cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.1, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.4, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.10.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineAnti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1070.008, T1098.002 +3cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12cCISA SCuBACISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionHighLowLowT1566cisa-scuba:MS.EXO.14.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineSafe LinksEmail and collaboration protectionHighLowLowT1204.001, T1566.002cisa-scuba:MS.EXO.15.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineAlert policiesLogging and detectionHighLowLowT1114.003, T1204.001cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineAudit loggingLogging and detectionHighLowLowT1685.002cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12CISA SCuBACISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDIdentity ProtectionLogging and detectionMediumLowLowT1078.004cisa-scuba:MS.AAD.2.2, nist-800-53-r5:AC-2(12)CISA SCuBACISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1110, T1621cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1) +5CISA SCuBACISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDConditional AccessAccess controlMediumHighHighT1078.004cisa-scuba:MS.AAD.3.7, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cisa-scuba:MS.AAD.3.8, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDPassword protectionAuthenticationMediumLowLow—cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)CISA SCuBACISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1)CISA SCuBACISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1)CISA SCuBACISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.8, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.9, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.003, T1087.004 +2cisa-scuba:MS.AAD.8.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1098.003, T1136.003cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)CISA SCuBACISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004cisa-scuba:MS.AAD.8.3, nist-800-53-r5:AC-3CISA SCuBACISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.2.2, nist-800-53-r5:AC-2dCISA SCuBACISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1598 +1cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8CISA SCuBACISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1566, T1598 +1cisa-scuba:MS.EXO.4.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1684.002cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567 +1cisa-scuba:MS.EXO.6.2, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.2, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.3CISA SCuBACISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1036.008, T1204.002 +1cisa-scuba:MS.EXO.9.2CISA SCuBACISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.4CISA SCuBACISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.2, nist-800-53-r5:AT-2b +1CISA SCuBACISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.11.3CISA SCuBACISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cisa-scuba:MS.EXO.12.2, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.14.3, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.4CISA SCuBACISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3 +1CISA SCuBACISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineAlert policiesLogging and detectionMediumLowMedium—cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineAudit loggingLogging and detectionMediumLowLowT1070cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11CISA SCuBACISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointExternal sharingExternal access and sharingMediumMediumMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointSharing linksAccess controlMediumLowLowT1048, T1213.002cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointSharing linksExternal access and sharingMediumLowLowT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointSharing linksExternal access and sharingMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointExternal sharingAuthenticationMediumLowLowT1213.002, T1530cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11CISA SCuBACISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDAuthentication methodsAuthenticationLowLowMedium—cisa-scuba:MS.AAD.3.4, nist-800-53-r5:CM-7CISA SCuBANo checks match.