All checks

2,195 checks4 Critical556 High1186 Medium180 Low269 Info

Run theseInvoke-MaesterCopy

2,195 checks

Group byProductAreaSeveritySuiteNone

IDCheckProductSeverity

AD-GPOREP-17No GPOs should contain a cpasswordActive DirectoryCriticalAD-GPOREP-18No GPOs should contain a cpasswordActive DirectoryCriticalAD-SPN-12No domain admin accounts should have SPNs configuredActive DirectoryCriticalAD-SPN-13No domain admin accounts should have SPNs configuredActive DirectoryCriticalAD-DC-02SMBv1 should be disabled on all domain controllersActive DirectoryHighAD-DC-04SMB signing should be enabled on all domain controllersActive DirectoryHighAD-DCOMP-02Non-DC computers should not have unconstrained delegationActive DirectoryHighAD-GPOREP-19No GPOs should contain a default passwordActive DirectoryHighAD-GPOREP-20No GPOs should contain a default passwordActive DirectoryHighAD-TRUST-04No trusts should lack SID filtering (quarantine)Active DirectoryHighAD-USER-29No users should be configured for unconstrained delegationActive DirectoryHighASD.ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.New in 3.0Entra IDHighASD.ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services.New in 3.0Entra IDHighASD.ISM-1649Just-in-time administration is used for the administration of systems and their resources.New in 3.0Entra IDHighASD.ISM-1667Microsoft Office is blocked from creating child processes.New in 3.0IntuneHighASD.ISM-1668Microsoft Office is blocked from creating executable content.New in 3.0IntuneHighASD.ISM-1669Microsoft Office is blocked from injecting code into other processes.New in 3.0IntuneHighASD.ISM-1673Microsoft Office macros are blocked from making Win32 API calls.New in 3.0IntuneHighASD.ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release.New in 3.0IntuneHighASD.ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant.New in 3.0Entra IDHighAZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0Azure DevOpsHighAZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0Azure DevOpsHighAZDO.1002Log Audit Events.New in 3.0Azure DevOpsHighAZDO.1003Restrict public projects.New in 3.0Azure DevOpsHighAZDO.1004Additional protections when using public package registries.New in 3.0Azure DevOpsHighAZDO.1005IP Conditional Access policy validation.New in 3.0Azure DevOpsHighAZDO.1010Audit streaming.New in 3.0Azure DevOpsHighAZDO.1013Organization Owner should not be an individual.New in 3.0Azure DevOpsHighAZDO.1015Limit variables that can be set at queue time.New in 3.0Azure DevOpsHighAZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0Azure DevOpsHighAZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0Azure DevOpsHighAZDO.1018Protect access to repositories in YAML pipelines.New in 3.0Azure DevOpsHighAZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0Azure DevOpsHighAZDO.1023Disable Marketplace tasks.New in 3.0Azure DevOpsHighAZDO.1025Enable shell tasks arguments validation.New in 3.0Azure DevOpsHighAZDO.1030Project Collection Administrators.New in 3.0Azure DevOpsHighAZDO.1031Validate SSH Key Expiration.New in 3.0Azure DevOpsHighAZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0Azure DevOpsHighAZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0Azure DevOpsHighAZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0Azure DevOpsHighAZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0Azure DevOpsHighAZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0Azure DevOpsHighAZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0Azure DevOpsHighAZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0Azure DevOpsHighCIS.GH.1.2.3Ensure repository deletion is limited to specific usersGitHubHighCIS.GH.1.3.8Ensure strict base permissions are set for repositoriesGitHubHighCIS.M365.1.1.1Ensure Administrative accounts are cloud-onlyMicrosoft 365HighCIS.M365.1.1.3Ensure that between two and four global admins are designatedMicrosoft 365HighCIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabledDefenderHighCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0DefenderHighCIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledPurviewHighCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedEntra IDHighCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledEntra IDHighCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Entra IDHighCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Entra IDHighCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Entra IDHighCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Entra IDHighCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Entra IDHighCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Entra IDHighCIS.M365.5.2.3.5Ensure weak authentication methods are disabledEntra IDHighCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Entra IDHighCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Exchange OnlineHighCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Exchange OnlineHighCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Exchange OnlineHighCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.Entra IDHighCISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDHighCISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDHighCISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDHighCISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDHighCISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDHighCISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDHighCISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDHighCISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDHighCISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDHighCISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDHighCISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineHighCISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineHighCISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineHighCISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineHighCISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineHighCISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineHighCISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineHighCISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineHighCISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineHighCISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineHighCISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineHighDISA.V-267334Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneHighDISA.V-267341Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts.New in 3.0Entra IDHighDISA.V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.New in 3.0Entra IDHighDISA.V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA).New in 3.0Entra IDHighDISA.V-270335Microsoft Entra ID must use Privileged Identity Management (PIM).New in 3.0Entra IDHighDISA.V-273868Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneHighEIDSCA.AF01Authentication Method - FIDO2 security key - State.Entra IDHighEIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDHighEIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDHighEIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDHighEIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDHighEIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDHighEIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra IDHighEIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra IDHighEIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDHighEIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDHighEIDSCA.AV01Authentication Method - Voice call - State.Entra IDHighEIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDHighEIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDHighEIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDHighEIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDHighEIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra IDHighEIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDHighMT.1003At least one Conditional Access policy is configured with All Apps.Entra IDHighMT.1004At least one Conditional Access policy is configured with All Apps and All Users.Entra IDHighMT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.Entra IDHighMT.1006At least one Conditional Access policy is configured to require MFA for admins.Entra IDHighMT.1007At least one Conditional Access policy is configured to require MFA for all users.Entra IDHighMT.1008At least one Conditional Access policy is configured to require MFA for Azure management.Entra IDHighMT.1009At least one Conditional Access policy is configured to block other legacy authentication.Entra IDHighMT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.Entra IDHighMT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.Entra IDHighMT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.Entra IDHighMT.1016At least one Conditional Access policy is configured to require MFA for guest access.Entra IDHighMT.1021Security Defaults are enabled.Entra IDHighMT.1025No external user with permanent role assignment on Control Plane.Entra IDHighMT.1026No hybrid user with permanent role assignment on Control Plane.Entra IDHighMT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.Entra IDHighMT.1028No user with mailbox and permanent role assignment on Control Plane.Entra IDHighMT.1029Stale accounts are not assigned to privileged roles.Entra IDHighMT.1030Eligible role assignments on Control Plane are in use by administrators.Entra IDHighMT.1031Privileged role on Control Plane are managed by PIM only.Entra IDHighMT.1032Limited number of Global Admins are assigned.Entra IDHighMT.1033Users should be blocked from using legacy authentication.Entra IDHighMT.1034Emergency access users should not be blocked.Entra IDHighMT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.Entra IDHighMT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.Entra IDHighMT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreviewEntra IDHighMT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreviewEntra IDHighMT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.Entra IDHighMT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scopeAzureHighMT.1063All App registration owners should have MFA registeredEntra IDHighMT.1065Ensure all Recovery Services Vaults have soft delete enabledAzureHighMT.1072Conditional Access policies should not use the deprecated Approved Client App grant.Entra IDHighMT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.Entra IDHighMT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.DefenderHighMT.1092Intune APNS certificate should be valid for more than 30 daysIntuneHighMT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 daysIntuneHighMT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 daysIntuneHighMT.1095Android Enterprise account connection should be healthyIntuneHighMT.1097Ensure all Intune Certificate Connectors are healthy and running supported versionsIntuneHighMT.1098Mobile Threat Defense Connectors should be healthyIntuneHighMT.1100Intune Diagnostic Settings should include Audit LogsIntuneHighMT.1102Windows Feature Update Policy Settings should not reference end of support buildsIntuneHighMT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groupsIntuneHighMT.1113AI agents should not be shared with broad access control policies.Copilot StudioHighMT.1114AI agents should require user authentication.Copilot StudioHighMT.1116AI agents should not send email with AI-controlled inputs.Copilot StudioHighMT.1119AI agents should not have hard-coded credentials in topics.Copilot StudioHighMT.1123Ensure BitLocker full disk encryption is configuredIntuneHighMT.1147Do not sync krbtgt_AzureAD to Entra ID.Entra IDHighMT.1149Behavior Monitoring should be enabled.DefenderHighMT.1150Cloud Protection should be enabled.DefenderHighMT.1152Script Scanning should be enabled.DefenderHighMT.1153Real-time Monitoring should be enabled.DefenderHighMT.1165Network Protection should be enabled.DefenderHighMT.1172Unified audit log ingestion is enabled.PurviewHighMT.1178Ensure ASR Rules are configured correctly.IntuneHighMT.1179Ensure App Control for Business is enabled.IntuneHighMT.1181Conditional Access policy is present that blocks high agent risk sign-ins.Entra IDHighMT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreviewEntra IDHighMT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreviewEntra IDHighMT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreviewEntra IDHighMT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreviewEntra IDHighMT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreviewEntra IDHighMT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.IntuneHighMT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreviewEntra IDHighMT.1259Baseline scope sign-ins should be subject to Conditional Access.New in 3.0-IncludePreviewEntra IDHighORCA.104High Confidence Phish action set to Quarantine message.DefenderHighORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderHighORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.DefenderHighORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderHighORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.DefenderHighORCA.124Safe attachments unknown malware response set to block messages.DefenderHighORCA.189.2Safe Links is not bypassed.DefenderHighORCA.239No exclusions for the built-in protection policies.DefenderHighORCA.242Important protection alerts responsible for AIR activities are enabled.DefenderHighZTA.21771Inactive applications don’t have highly privileged built-in rolesZTAEntra IDHighZTA.21772Applications don't have client secrets configuredZTAEntra IDHighZTA.21774Microsoft services applications don't have credentials configuredZTAEntra IDHighZTA.21776User consent settings are restrictedZTAEntra IDHighZTA.21777App instance property lock is configured for all multitenant applicationsZTAEntra IDHighZTA.21781Privileged users sign in with phishing-resistant methodsZTAEntra IDHighZTA.21782Privileged accounts have phishing-resistant methods registeredZTAEntra IDHighZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsZTAEntra IDHighZTA.21786User sign-in activity uses token protectionZTAEntra IDHighZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleZTAEntra IDHighZTA.21788Global Administrators don't have standing access to Azure subscriptionsZTAAzureHighZTA.21790Outbound cross-tenant access settings are configuredZTAEntra IDHighZTA.21793Tenant restrictions v2 policy is configuredZTAEntra IDHighZTA.21797Restrict access to high risk usersZTAEntra IDHighZTA.21798ID Protection notifications are enabledZTAEntra IDHighZTA.21799Restrict high risk sign-insZTAEntra IDHighZTA.21803Migrate from legacy MFA and SSPR policiesZTAEntra IDHighZTA.21804SMS and Voice Call authentication methods are disabledZTAEntra IDHighZTA.21806Secure the MFA registration (My Security Info) pageZTAEntra IDHighZTA.21808Restrict device code flowZTAEntra IDHighZTA.21809Admin consent workflow is enabledZTAEntra IDHighZTA.21814Privileged accounts are cloud native identitiesZTAEntra IDHighZTA.21815All privileged role assignments are activated just in time and not permanently activeZTAEntra IDHighZTA.21817Global Administrator role activation triggers an approval workflowZTAEntra IDHighZTA.21818Privileged role activations have monitoring and alerting configuredZTAEntra IDHighZTA.21828Secure the MFA registration (My Security Info) pageZTAEntra IDHighZTA.21829Use cloud authenticationZTAEntra IDHighZTA.21830Conditional Access policies for Privileged Access Workstations are configuredZTAEntra IDHighZTA.21836Workload Identities are not assigned privileged rolesZTAEntra IDHighZTA.21847Password protection for on-premises is enabledZTAEntra IDHighZTA.21860Diagnostic settings are configured for all Microsoft Entra logsZTAEntra IDHighZTA.21861All high-risk users are triagedZTAEntra IDHighZTA.21863All high-risk sign-ins are triagedZTAEntra IDHighZTA.21864All risk detections are triagedZTAEntra IDHighZTA.21872Require multifactor authentication for device join and device registration using user actionZTAEntra IDHighZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesZTAAzureHighZTA.21885App registrations use safe redirect URIsZTAEntra IDHighZTA.21888App registrations must not have dangling or abandoned domain redirect URIsZTAEntra IDHighZTA.21891Require password reset notifications for administrator rolesZTAEntra IDHighZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesZTAAzureHighZTA.21992Application certificates must be rotated on a regular basisZTAEntra IDHighZTA.22124High priority Microsoft Entra recommendations are addressedZTAEntra IDHighZTA.22128Guests are not assigned high privileged directory rolesZTAEntra IDHighZTA.22659All risky workload identity sign ins are triagedZTAEntra IDHighZTA.23183Service principals use safe redirect URIsZTAEntra IDHighZTA.24540Windows Firewall policy is created and assignedZTAIntuneHighZTA.24541A compliance policy for Windows devices existsZTAIntuneHighZTA.24542macOS Compliance policy is created and assignedZTAIntuneHighZTA.24543Compliance policy assignment for iOS/iPadOS devicesZTAIntuneHighZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedZTAIntuneHighZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsZTAIntuneHighZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedZTAIntuneHighZTA.24548App Protection Policy assigned on iOS/iPad devicesZTAIntuneHighZTA.24549An App protection policy for Android platform exists in IntuneZTAIntuneHighZTA.24550Windows - BitLocker Policy is created and assignedZTAIntuneHighZTA.24551Windows Hello for Business Policy is Configured and AssignedZTAIntuneHighZTA.24553Windows Update policy is assigned and enforced.ZTAIntuneHighZTA.24554iOS - Update policy is configured and assignedZTAIntuneHighZTA.24555Intune Scope Tags are Configured for Delegated AdministrationZTAIntuneHighZTA.24560Windows Cloud LAPS policy is created and assignedZTAIntuneHighZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSZTAIntuneHighZTA.24564Windows - Local Account Protection policy is configured and assignedZTAIntuneHighZTA.24568macOS - Platform SSO is configured and assignedZTAIntuneHighZTA.24569Intune macOS FileVault policy is created and AssignedZTAIntuneHighZTA.24570Entra Connect Sync is configured with Service Principal CredentialsZTAEntra IDHighZTA.24572Device enrollment notification is configured and assignedZTAIntuneHighZTA.24573Windows - A security baseline is configured and assignedZTAIntuneHighZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesZTAIntuneHighZTA.24575A Windows Defender Antivirus policy is created and assignedZTAIntuneHighZTA.24690macOS - Update policy is configured and assignedZTAIntuneHighZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSZTAIntuneHighZTA.24794Intune Terms and Conditions Policy is configured and assignedZTAIntuneHighZTA.24802Device Clean-up Rule is CreatedZTAIntuneHighZTA.24824Conditional Access policies block access from noncompliant devicesZTAEntra IDHighZTA.24827Conditional Access policies block access from unmanaged appsZTAEntra IDHighZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessZTAIntuneHighZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessZTAIntuneHighZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessZTAIntuneHighZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsZTAIntuneHighZTA.25371Network validation is configured through Universal Continuous Access EvaluationZTAEntra IDHighZTA.25372Global Secure Access client is deployed on all managed endpointsZTAEntra IDHighZTA.25375The tenant holds the licenses required to operate Global Secure AccessZTAEntra IDHighZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessZTAEntra IDHighZTA.25377Universal tenant restrictions block unauthorized external tenant accessZTAEntra IDHighZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementZTAEntra IDHighZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentZTAEntra IDHighZTA.25383Administrative privileges are tightly limited to prevent compromiseZTAEntra IDHighZTA.25384Application admin rights are constrained to specific Private Access appsZTAEntra IDHighZTA.25393Quick Access is enabled and bound to a connectorZTAEntra IDHighZTA.25394Quick Access is bound to a Conditional Access policyZTAEntra IDHighZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessZTAEntra IDHighZTA.25396Conditional Access policies enforce strong authentication for private appsZTAEntra IDHighZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessZTAEntra IDHighZTA.25401Application Proxy applications require preauthentication to block anonymous accessZTAEntra IDHighZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersZTAEntra IDHighZTA.25406Internet access forwarding profile is enabledZTAEntra IDHighZTA.25407Web content filtering integrates with Conditional AccessZTAEntra IDHighZTA.25411TLS inspection is enabled and correctly configured for outbound trafficZTAEntra IDHighZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringZTAEntra IDHighZTA.25413File transfer policies are configured to prevent data exfiltrationZTAEntra IDHighZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksZTAEntra IDHighZTA.25416Global Secure Access cloud firewall protects branch office internet trafficZTAEntra IDHighZTA.25420Network access logs are retained for security analysis and compliance requirementsZTAEntra IDHighZTA.25466At least two Private Access connectors are active and healthy per connector groupZTAEntra IDHighZTA.25481All Private Access apps have user or group assignmentsZTAEntra IDHighZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsZTAAzureHighZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallZTAAzureHighZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallZTAAzureHighZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallZTAAzureHighZTA.25541Application Gateway WAF is Enabled in Prevention modeZTAAzureHighZTA.25543Azure Front Door WAF is Enabled in Prevention ModeZTAAzureHighZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallZTAAzureHighZTA.26879Request Body Inspection is enabled in Application Gateway WAFZTAAzureHighZTA.26880Request Body Inspection is enabled in Azure Front Door WAFZTAAzureHighZTA.26881Default Ruleset is enabled in Application Gateway WAFZTAAzureHighZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFZTAAzureHighZTA.26883Default rule set is assigned in Azure Front Door WAFZTAAzureHighZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFZTAAzureHighZTA.26887Diagnostic logging is enabled in Azure FirewallZTAAzureHighZTA.26888Diagnostic logging is enabled in Application Gateway WAFZTAAzureHighZTA.26889Diagnostic logging is enabled in Azure Front Door WAFZTAAzureHighZTA.27000Web content filtering blocks high-risk categoriesZTAEntra IDHighZTA.27002TLS inspection certificates have a sufficient validity periodZTAEntra IDHighZTA.27003TLS inspection failure rate is below 1%ZTAEntra IDHighZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFZTAAzureHighZTA.27016Rate Limiting is Enabled in Application Gateway WAFZTAAzureHighZTA.27018Rate Limiting is Enabled in Azure Front Door WAFZTAAzureHighZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFZTAAzureHighZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileZTAEntra IDHighZTA.35001Conditional Access policies don't exclude Rights Management workloadsZTAEntra IDHighZTA.35003Sensitivity labels are configuredZTAPurviewHighZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAPurviewHighZTA.35013Sensitivity labels with encryption are configuredZTAPurviewHighZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAPurviewHighZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAPurviewHighZTA.35020Auto-labeling policies are in enforcement modeZTAPurviewHighZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAPurviewHighZTA.35024Azure Rights Management service is activatedZTAPurviewHighZTA.35025Internal Rights Management licensing is enabledZTAPurviewHighZTA.35030Data loss prevention policies are enabledZTAPurviewHighZTA.35033Custom sensitive information types are configuredZTAPurviewHighZTA.35034Exact Data Match is configured for sensitive information detectionZTAPurviewHighZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAPurviewHighZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAPurviewHighZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAPurviewHighZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAPurviewHighZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerZTADefenderHighZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversZTADefenderHighZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAActive DirectoryHighZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAActive DirectoryHighZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAActive DirectoryHighZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAActive DirectoryHighZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAActive DirectoryHighZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantZTADefenderHighZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedZTADefenderHighZTA.41029Anti-malware policies are configured according to recommended settingsZTADefenderHighZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockZTADefenderHighZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsZTADefenderHighZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionZTADefenderHighZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailZTADefenderHighZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessZTADefenderHighZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderHighZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointZTADefenderHighZTA.41050Attack surface reduction (ASR) rules are enabled in block modeZTAIntuneHighZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneZTAIntuneHighZTA.41053Network protection is enabled in block modeZTADefenderHighZTA.41054Controlled folder access is enabled in block modeZTADefenderHighZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusZTADefenderHighZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusZTADefenderHighZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusZTADefenderHighZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedZTADefenderHighZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderHighZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsZTAEntra IDHighZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsZTADefenderHighZTA.41083Step-up authentication is required upon risky in-session actionZTAEntra IDHighZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsZTADefenderHighZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedZTADefenderHighZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowZTADefenderHighZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceZTAAzureHighZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsZTAAzureHighZTA.50001Microsoft Defender for Cloud RecommendationsZTAAzureHighZTA.51001Windows Endpoint Privilege Management is configured and assignedZTAIntuneHighZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)ZTAIntuneHighZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesZTAIntuneHighZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesZTAIntuneHighZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsZTAEntra IDHighZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneZTAIntuneHighZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceZTAAzureHighZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsZTAAzureHighZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryZTAMicrosoft 365HighZTA.61006AI administrative roles have assigned principalsZTAEntra IDHighZTA.61009Conditional Access policies cover both agent identities and agent usersZTAEntra IDHighZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsZTAEntra IDHighZTA.61012Risk-based Conditional Access blocks risky agent identitiesZTAEntra IDHighZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryZTAEntra IDHighZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceZTAAzureHighZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathZTAAzureHighZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsZTAAzureHighZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdActive DirectoryMediumAD-GPOL-05GPO blocked inheritance count should be compliantActive DirectoryMediumAD-GPOREP-01No GPOs should be missing permissionsActive DirectoryMediumAD-GPOREP-02No GPOs should be missing permissionsActive DirectoryMediumAD-GPOREP-03GPOs without authenticated users count should be retrievableActive DirectoryMediumAD-GPOREP-04GPOs without authenticated users details should be retrievableActive DirectoryMediumAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableActive DirectoryMediumAD-GPOREP-07GPOs with deny ACE count should be retrievableActive DirectoryMediumAD-GPOREP-08GPOs with deny ACE details should be retrievableActive DirectoryMediumAD-GPOREP-09GPO inherited permissions count should be retrievableActive DirectoryMediumAD-GPOREP-15No GPOs should have version mismatchesActive DirectoryMediumAD-GPOREP-16No GPOs should have version mismatchesActive DirectoryMediumAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumActive DirectoryMediumAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Active DirectoryMediumAD-PWDPOL-04Password complexity should be enabledActive DirectoryMediumAD-PWDPOL-05Password reversible encryption should be disabledActive DirectoryMediumAD-SCH-05LAPS should be installed in Active DirectoryActive DirectoryMediumASD.ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.New in 3.0Entra IDMediumASD.ISM-1488Microsoft Office macros in files originating from the internet are blocked.New in 3.0IntuneMediumASD.ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity.New in 3.0Entra IDMediumASD.ISM-1672Microsoft Office macro antivirus scanning is enabled.New in 3.0IntuneMediumAZDO.1006External Users access.New in 3.0Azure DevOpsMediumAZDO.1007Team and project administrator are allowed to invite new users.New in 3.0Azure DevOpsMediumAZDO.1014Anonymous access to pipeline badges.New in 3.0Azure DevOpsMediumAZDO.1019Stage chooser.New in 3.0Azure DevOpsMediumAZDO.1020Creation of classic build pipelines.New in 3.0Azure DevOpsMediumAZDO.1021Creation of classic release pipelines.New in 3.0Azure DevOpsMediumAZDO.1024Disable Node 6 tasks.New in 3.0Azure DevOpsMediumAZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0Azure DevOpsMediumAZDO.1028Disable creation of TFVC repositories.New in 3.0Azure DevOpsMediumAZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0Azure DevOpsMediumAZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0Azure DevOpsMediumAZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0Azure DevOpsMediumAZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0Azure DevOpsMediumAZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0Azure DevOpsMediumAZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0Azure DevOpsMediumCIS.GH.1.2.2Ensure repository creation is limited to specific membersGitHubMediumCIS.GH.1.2.4Ensure issue deletion is limited to specific usersGitHubMediumCIS.GH.1.3.2Ensure team creation is limited to specific membersGitHubMediumCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Microsoft 365MediumCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existMicrosoft 365MediumCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedMicrosoft 365MediumCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Microsoft 365MediumCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Microsoft 365MediumCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableMicrosoft 365MediumCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedMicrosoft 365MediumCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledMicrosoft 365MediumCIS.M365.1.3.6Ensure the customer lockbox feature is enabledMicrosoft 365MediumCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Microsoft 365MediumCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)DefenderMediumCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledDefenderMediumCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledDefenderMediumCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsDefenderMediumCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdDefenderMediumCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0DefenderMediumCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsDefenderMediumCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0DefenderMediumCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedDefenderMediumCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0DefenderMediumCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0DefenderMediumCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0DefenderMediumCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)DefenderMediumCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0PurviewMediumCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0PurviewMediumCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0PurviewMediumCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'IntuneMediumCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0IntuneMediumCIS.M365.5.1.2.2Ensure users cannot register applicationsEntra IDMediumCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'Entra IDMediumCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Entra IDMediumCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Entra IDMediumCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Entra IDMediumCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Entra IDMediumCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysEntra IDMediumCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0Entra IDMediumCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0Entra IDMediumCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0Entra IDMediumCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0Entra IDMediumCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0Entra IDMediumCIS.M365.5.1.6.2Ensure that guest user access is restrictedEntra IDMediumCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0Entra IDMediumCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Entra IDMediumCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Entra IDMediumCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Entra IDMediumCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Entra IDMediumCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Entra IDMediumCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Entra IDMediumCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Entra IDMediumCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Entra IDMediumCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Entra IDMediumCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Entra IDMediumCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Entra IDMediumCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Entra IDMediumCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Entra IDMediumCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Entra IDMediumCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Entra IDMediumCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Entra IDMediumCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Entra IDMediumCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Entra IDMediumCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Entra IDMediumCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Entra IDMediumCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Entra IDMediumCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Entra IDMediumCIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Exchange OnlineMediumCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Exchange OnlineMediumCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Exchange OnlineMediumCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0Exchange OnlineMediumCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0Exchange OnlineMediumCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webExchange OnlineMediumCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Exchange OnlineMediumCIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0SharePointMediumCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledSharePointMediumCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownSharePointMediumCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0SharePointMediumCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharePointMediumCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0SharePointMediumCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallySharePointMediumCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharePointMediumCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadSharePointMediumCIS.M365.8.1.1Ensure external file sharing in Teams is enabled for only approved cloud storage servicesTeamsMediumCIS.M365.8.1.2Ensure users can't send emails to a channel email addressNew in 3.0TeamsMediumCIS.M365.8.2.1Ensure external domains are restricted in the Teams admin centerNew in 3.0TeamsMediumCIS.M365.8.2.2Ensure communication with unmanaged Teams users is disabledTeamsMediumCIS.M365.8.2.3Ensure external Teams users cannot initiate conversationsTeamsMediumCIS.M365.8.2.4Ensure the organization cannot communicate with accounts in trial Teams tenantsNew in 3.0TeamsMediumCIS.M365.8.4.1Ensure app permission policies are configuredTeamsMediumCIS.M365.8.5.1Ensure anonymous users can't join a meetingNew in 3.0TeamsMediumCIS.M365.8.5.2Ensure anonymous users and dial-in callers can't start a meetingNew in 3.0TeamsMediumCIS.M365.8.5.3Ensure only people in my org can bypass the lobbyTeamsMediumCIS.M365.8.5.4Ensure users dialing in can't bypass the lobbyNew in 3.0TeamsMediumCIS.M365.8.5.5Ensure meeting chat does not allow anonymous usersNew in 3.0TeamsMediumCIS.M365.8.5.7Ensure external participants can't give or request controlNew in 3.0TeamsMediumCIS.M365.8.5.8Ensure external meeting chat is offNew in 3.0TeamsMediumCIS.M365.8.6.1Ensure users can report security concerns in TeamsTeamsMediumCIS.M365.9.1.1Restrict guest access to FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.2Restrict external guest invitations through FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.4Restrict public publishing of Fabric reportsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.5Disable R and Python visuals in FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.6Enable sensitivity labels for Fabric contentNew in 3.0Microsoft FabricMediumCIS.M365.9.1.8Restrict external sharing of semantic modelsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.9Block resource-key authentication for Fabric datasetsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.10Restrict service principal access to Fabric public APIsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.11Restrict service principal profiles in FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.12Restrict service principal access to Fabric global APIsNew in 3.0Microsoft FabricMediumCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDMediumCISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDMediumCISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDMediumCISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDMediumCISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDMediumCISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDMediumCISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDMediumCISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDMediumCISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDMediumCISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDMediumCISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDMediumCISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineMediumCISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineMediumCISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineMediumCISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineMediumCISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMediumCISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineMediumCISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineMediumCISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineMediumCISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineMediumCISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineMediumCISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineMediumCISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineMediumCISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineMediumCISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineMediumCISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineMediumCISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineMediumCISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineMediumCISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointMediumCISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointMediumCISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointMediumCISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointMediumDISA.V-267303Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-267309Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-267314Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords.New in 3.0Entra IDMediumDISA.V-273867Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-285327The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.New in 3.0IntuneMediumEIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDMediumEIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDMediumEIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDMediumEIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDMediumEIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDMediumEIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDMediumEIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDMediumEIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDMediumEIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra IDMediumEIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDMediumEIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDMediumEIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDMediumEIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDMediumEIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDMediumEIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra IDMediumEIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDMediumEIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDMediumEIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDMediumEIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDMediumEIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDMediumEIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra IDMediumMT.1001At least one Conditional Access policy is configured with device compliance.Entra IDMediumMT.1002App management restrictions on applications and service principals is configured and enabled.Entra IDMediumMT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.Entra IDMediumMT.1013At least one Conditional Access policy is configured to require new password when user risk is high.Entra IDMediumMT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.Entra IDMediumMT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.Entra IDMediumMT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.Entra IDMediumMT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.Entra IDMediumMT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.Entra IDMediumMT.1024Entra recommendations should be completed.Entra IDMediumMT.1036All excluded objects should have a fallback include in another policy.Entra IDMediumMT.1038Conditional Access policies should not include or exclude deleted groups.Entra IDMediumMT.1041Ensure users installing Outlook add-ins is not allowedExchange OnlineMediumMT.1042Restrict dial-in users from bypassing a meeting lobbyTeamsMediumMT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsExchange OnlineMediumMT.1045Only invited users should be automatically admitted to Teams meetingsTeamsMediumMT.1046Restrict anonymous users from joining meetingsTeamsMediumMT.1047Restrict anonymous users from starting Teams meetingsTeamsMediumMT.1048Limit external participants from having control in a Teams meetingTeamsMediumMT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'IntuneMediumMT.1057App registrations should no longer use secrets.Entra IDMediumMT.1058Exchange application access policies must be configured.Entra IDMediumMT.1059Microsoft Defender for Identity health issues should be resolvedDefenderMediumMT.1060Drift folders should match their baseline.New in 3.0Microsoft 365MediumMT.1061Device registration MFA control conflicts with Conditional Access policies.Entra IDMediumMT.1062Ensure Direct Send is set to be rejectedExchange OnlineMediumMT.1064Ensure that write permissions are required to create new management groupsAzureMediumMT.1066Conditional Access policies should not reference non-existent users, groups, or roles.Entra IDMediumMT.1068Restrict non-admin users from creating tenants.Entra IDMediumMT.1070Restrict device join to selected users/groups or none.Entra IDMediumMT.1071At least one Conditional Access policy explicitly includes Azure DevOps.Entra IDMediumMT.1073Soft- and hard-matching of synchronized objects should be blocked.Entra IDMediumMT.1075Require explicit assignment of Third Party Entra Apps.Entra IDMediumMT.1077App registrations with privileged API permissions should not have owners.DefenderMediumMT.1078App registrations with highly privileged directory roles should not have owners.DefenderMediumMT.1079Privileged API permissions on service principals should not remain unused.DefenderMediumMT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.DefenderMediumMT.1081Hybrid users should not be assigned Entra ID role assignments.DefenderMediumMT.1088Devices with critical credentials should be protected by TPM.DefenderMediumMT.1089Devices with critical credentials should be protected by Credential Guard.DefenderMediumMT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra joinEntra IDMediumMT.1091Registering user should not be added as local administrator on the device during Microsoft Entra joinEntra IDMediumMT.1096Ensure at least one Intune Multi Admin Approval policy is configuredIntuneMediumMT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreviewDefenderMediumMT.1115AI agents should not have risky HTTP configurations.Copilot StudioMediumMT.1118AI agents should not use author (maker) authentication for connections.Copilot StudioMediumMT.1120AI agents should not use MCP server tools without review.Copilot StudioMediumMT.1121AI agents with generative orchestration should have custom instructions.Copilot StudioMediumMT.1122AI agents should not have orphaned ownership.Copilot StudioMediumMT.1148Archive Scanning should be enabled.DefenderMediumMT.1151Email Scanning should be enabled.DefenderMediumMT.1154Full Scan Removable Drives should be enabled.DefenderMediumMT.1156Scanning Network Files should be enabled.DefenderMediumMT.1161Cloud Block Level should be High or higher.DefenderMediumMT.1164PUA Protection should be enabled.DefenderMediumMT.1166Local Admin Merge should be disabled.DefenderMediumMT.1167Real-Time Scan Direction should cover both directions.DefenderMediumMT.1171Sample Submission should send safe samples automatically.DefenderMediumMT.1174Insider Risk Management policy for Risky AI usage is enabled.PurviewMediumMT.1175DLP policy is configured for the Microsoft 365 Copilot location.PurviewMediumMT.1176Retention policy is configured for the Microsoft Copilot location.PurviewMediumMT.1177Ensure LAPS Configuration Policy is properly set.IntuneMediumMT.1180Ensure Managed Installer Rules are configured correctly.IntuneMediumMT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.Entra IDMediumMT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.Entra IDMediumMT.1184Conditional Access policy without any target resources configured.Entra IDMediumMT.1185Block legacy MSOnline (MSOL) PowerShell module.Entra IDMediumMT.1186Require explicit assignment of high-privilege first-party Entra Apps.Entra IDMediumMT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreviewEntra IDMediumMT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreviewEntra IDMediumMT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreviewEntra IDMediumMT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreviewEntra IDMediumMT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreviewEntra IDMediumMT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreviewEntra IDMediumMT.1196Review who can change attributes used by dynamic group rules.Entra IDMediumMT.1197Remove memberOf rules.Entra IDMediumMT.1198App registration certificates should not have excessive validity periods.Entra IDMediumMT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreviewEntra IDMediumMT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreviewEntra IDMediumMT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreviewEntra IDMediumMT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreviewEntra IDMediumMT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreviewEntra IDMediumMT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreviewEntra IDMediumMT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreviewEntra IDMediumMT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreviewEntra IDMediumMT.1214Ensure macOS compliance policy requires System Integrity Protection.IntuneMediumMT.1215Ensure Gatekeeper restricts macOS app download locations.IntuneMediumMT.1216Ensure macOS compliance policy requires a Defender machine risk score level.IntuneMediumMT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreviewEntra IDMediumMT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreviewEntra IDMediumMT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0AzureMediumMT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0IntuneMediumMT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0IntuneMediumMT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0IntuneMediumMT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0IntuneMediumMT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0IntuneMediumMT.1233Ensure Android compliance policy requires a strong device password.New in 3.0IntuneMediumMT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0IntuneMediumMT.1235Ensure Android compliance policy requires device threat protection.New in 3.0IntuneMediumMT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0IntuneMediumMT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0IntuneMediumMT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0IntuneMediumMT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0IntuneMediumMT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0IntuneMediumMT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0IntuneMediumMT.1246Ensure Android app protection policy encrypts organization data.New in 3.0IntuneMediumMT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0IntuneMediumMT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0IntuneMediumMT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0Entra IDMediumMT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreviewEntra IDMediumMT.1265Fix dynamic groups whose rule processing failed.New in 3.0Entra IDMediumORCA.103Outbound spam filter policy settings configured.DefenderMediumORCA.105Safe Links Synchronous URL detonation is enabled.DefenderMediumORCA.108DKIM signing is set up for all your custom domains.DefenderMediumORCA.108.1DNS Records have been set up to support DKIM.DefenderMediumORCA.109Senders are not being allow listed in an unsafe manner.DefenderMediumORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.DefenderMediumORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.DefenderMediumORCA.113AllowClickThrough is disabled in Safe Links policies.DefenderMediumORCA.114No IP Allow Lists have been configured.DefenderMediumORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.DefenderMediumORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.DefenderMediumORCA.120.1Zero Hour Autopurge Enabled for Phish.DefenderMediumORCA.120.2Zero Hour Autopurge Enabled for Malware.DefenderMediumORCA.120.3Zero Hour Autopurge Enabled for Spam.DefenderMediumORCA.121Supported filter policy action used.DefenderMediumORCA.140High Confidence Spam action set to Quarantine message.DefenderMediumORCA.142Phish action set to Quarantine message.DefenderMediumORCA.156Safe Links Policies are tracking when user clicks on safe links.DefenderMediumORCA.158Safe Attachments is enabled for SharePoint and Teams.DefenderMediumORCA.179Safe Links is enabled intra-organization.DefenderMediumORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.DefenderMediumORCA.189Safe Attachments is not bypassed.DefenderMediumORCA.205Common attachment type filter is enabled.DefenderMediumORCA.220Advanced Phish filter Threshold level is adequate.DefenderMediumORCA.221Mailbox intelligence is enabled in anti-phishing policies.DefenderMediumORCA.222Domain Impersonation action is set to move to Quarantine.DefenderMediumORCA.223User impersonation action is set to move to Quarantine.DefenderMediumORCA.225Safe Documents is enabled for Office clients.DefenderMediumORCA.226Each domain has a Safe Link policy applied to it.DefenderMediumORCA.227Each domain has a Safe Attachments policy applied to it.DefenderMediumORCA.228No trusted senders in Anti-phishing policy.DefenderMediumORCA.229No trusted domains in Anti-phishing policy.DefenderMediumORCA.233Domains are pointed directly at EOP or enhanced filtering is used.DefenderMediumORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.DefenderMediumORCA.234Click through is disabled for Safe Documents.DefenderMediumORCA.235SPF records is set up for all your custom domains.DefenderMediumORCA.236Safe Links is enabled for emails.DefenderMediumORCA.237Safe Links is enabled for teams messages.DefenderMediumORCA.238Safe Links is enabled for office documents.DefenderMediumORCA.240Outlook is configured to display external tags for external emails.DefenderMediumORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.DefenderMediumORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.DefenderMediumORCA.244Policies are configured to honor sending domains DMARC.DefenderMediumZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsZTAEntra IDMediumZTA.21773Applications don't have certificates with expiration longer than 180 daysZTAEntra IDMediumZTA.21778Line-of-business and partner apps use MSALZTAEntra IDMediumZTA.21779Use recent versions of Microsoft ApplicationsZTAEntra IDMediumZTA.21780No usage of ADAL in the tenantZTAEntra IDMediumZTA.21784All user sign in activity uses phishing-resistant authentication methodsZTAEntra IDMediumZTA.21789Tenant creation events are triagedZTAEntra IDMediumZTA.21791Guests can’t invite other guestsZTAEntra IDMediumZTA.21792Guests have restricted access to directory objectsZTAEntra IDMediumZTA.21795No legacy authentication sign-in activityZTAEntra IDMediumZTA.21796Block legacy authentication policy is configuredZTAEntra IDMediumZTA.21800All user sign-in activity uses strong authentication methodsZTAEntra IDMediumZTA.21801Users have strong authentication methods configuredZTAEntra IDMediumZTA.21802Authenticator app shows sign-in contextZTAEntra IDMediumZTA.21807Creating new applications and service principals is restricted to privileged usersZTAEntra IDMediumZTA.21810Resource-specific consent is restrictedZTAEntra IDMediumZTA.21811Password expiration is disabledZTAEntra IDMediumZTA.21819Activation alert for Global Administrator role assignmentsZTAEntra IDMediumZTA.21821Guest access is restrictedZTAEntra IDMediumZTA.21822Guest access is limited to approved tenantsZTAEntra IDMediumZTA.21823Guest self-service sign-up via user flow is disabledZTAEntra IDMediumZTA.21824Guests don't have long lived sign-in sessionsZTAEntra IDMediumZTA.21825Privileged user sessions don't have long lived sign-in sessionsZTAEntra IDMediumZTA.21831Conditional Access protected actions are enabledZTAEntra IDMediumZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitZTAEntra IDMediumZTA.21849Smart lockout duration is set to a minimum of 60ZTAEntra IDMediumZTA.21850Smart lockout threshold isn't greater than 10ZTAEntra IDMediumZTA.21851Guest access is protected by strong authentication methodsZTAEntra IDMediumZTA.21854Privileged roles aren't assigned to stale identitiesZTAEntra IDMediumZTA.21855Privileged roles have access reviewsZTAEntra IDMediumZTA.21857Guest identities are lifecycle managed with access reviewsZTAEntra IDMediumZTA.21858Inactive guest identities are disabled or removed from the tenantZTAEntra IDMediumZTA.21859GDAP admin least privilegeZTAEntra IDMediumZTA.21862All risky workload identities are triagedZTAEntra IDMediumZTA.21865Named locations are configuredZTAEntra IDMediumZTA.21866All Microsoft Entra recommendations are addressedZTAEntra IDMediumZTA.21868Guests do not own apps in the tenantZTAEntra IDMediumZTA.21869Enterprise applications must require explicit assignment or scoped provisioningZTAEntra IDMediumZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredZTAEntra IDMediumZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationZTAEntra IDMediumZTA.21876Use PIM for Microsoft Entra privileged rolesZTAEntra IDMediumZTA.21877All guests have a sponsorZTAEntra IDMediumZTA.21878All entitlement management policies have an expiration dateZTAEntra IDMediumZTA.21879All entitlement management policies that apply to External users require approvalZTAEntra IDMediumZTA.21882No nested groups in PIM for groupsZTAEntra IDMediumZTA.21883Workload Identities are configured with risk-based policiesZTAEntra IDMediumZTA.21884Workload identities based on known networks are configuredZTAEntra IDMediumZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredZTAEntra IDMediumZTA.21887All registered redirect URIs must have proper DNS records and ownershipsZTAEntra IDMediumZTA.21890Require password reset notifications for user rolesZTAEntra IDMediumZTA.21892All sign-in activity comes from managed devicesZTAEntra IDMediumZTA.21896Service principals don't have certificates or credentials associated with themZTAEntra IDMediumZTA.21897All app assignment and group membership is governedZTAEntra IDMediumZTA.21898All supported access lifecycle resources are managed with entitlement management packagesZTAEntra IDMediumZTA.21899All privileged role assignments have a recipient that can receive notificationsZTAEntra IDMediumZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesZTAEntra IDMediumZTA.21941Token protection policies are configuredZTAEntra IDMediumZTA.21983No Active Medium priority Entra recommendations foundZTAEntra IDMediumZTA.21985Turn off Seamless SSO if there is no usageZTAEntra IDMediumZTA.22072Self-Service Password Reset does not use Q & AZTAEntra IDMediumZTA.24518Enterprise applications have ownersZTAEntra IDMediumZTA.24552macOS - Firewall policy is created and assignedZTAIntuneMediumZTA.24823Company Portal branding and support settings enhance user experience and trustZTAIntuneMediumZTA.25370Source IP restoration is enabledZTAEntra IDMediumZTA.25379Conditional Access policies use compliant network controlsZTAEntra IDMediumZTA.25380Global Secure Access signaling for Conditional Access is enabledZTAEntra IDMediumZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesZTAEntra IDMediumZTA.25392Private network connectors are running the latest versionZTAEntra IDMediumZTA.25399Private DNS is configured for internal name resolutionZTAEntra IDMediumZTA.25405Intelligent Local Access is enabled and configuredZTAEntra IDMediumZTA.25408Web content filtering policies are configuredZTAEntra IDMediumZTA.25409Web content filtering uses category-based rulesZTAEntra IDMediumZTA.25410Web content filtering policies are linked to security profilesZTAEntra IDMediumZTA.25419Network access activity is visible to security operations for threat detection and responseZTAEntra IDMediumZTA.25422Global Secure Access deployment logs are populated and reviewedZTAEntra IDMediumZTA.25480Quick Access has user or group assignmentsZTAEntra IDMediumZTA.26885Metrics are enabled for DDoS-protected public IPsZTAAzureMediumZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsZTAAzureMediumZTA.27001TLS inspection bypass rules are regularly reviewedZTAEntra IDMediumZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFZTAAzureMediumZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFZTAAzureMediumZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFZTAAzureMediumZTA.35006PDF labeling is enabled in SharePointZTAPurviewMediumZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAPurviewMediumZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAPurviewMediumZTA.35012Container labels are configured for collaborative workspacesZTAPurviewMediumZTA.35014Email label policies inherit sensitivity from attachmentsZTAPurviewMediumZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAPurviewMediumZTA.35017A default sensitivity label is configured in label policiesZTAPurviewMediumZTA.35018Users must provide justification to downgrade sensitivity labelsZTAPurviewMediumZTA.35022On-demand scans are configured for sensitive information discoveryZTAPurviewMediumZTA.35023OCR is enabled for sensitive information detectionZTAPurviewMediumZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAPurviewMediumZTA.35028Email retention policies are configuredZTAPurviewMediumZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAExchange OnlineMediumZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAPurviewMediumZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAPurviewMediumZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAPurviewMediumZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageZTADefenderMediumZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedZTADefenderMediumZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsZTADefenderMediumZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxZTADefenderMediumZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsZTADefenderMediumZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersZTAIntuneMediumZTA.41051Removable storage and device control policies are enforced via IntuneZTAIntuneMediumZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalZTADefenderMediumZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeZTAAzureMediumZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceZTAAzureMediumZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesZTAAzureMediumZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelZTAAzureMediumZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelZTAAzureMediumZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelZTAAzureMediumZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksZTAAzureMediumZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseZTAAzureMediumZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseZTAAzureMediumZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantZTAAzureMediumZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementZTAAzureMediumZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)ZTAAzureMediumZTA.51019MAM app access timeout and re-authentication are enforced after idle periodZTAIntuneMediumZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)ZTAEntra IDMediumZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeZTAEntra IDMediumZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMediumAD-DFSR-01All domain controllers should have DFS-R subscriptionsActive DirectoryLowAD-GPO-04Unlinked GPO count should be compliantActive DirectoryLowAD-GPO-05GPO unlinked details should be compliantActive DirectoryLowAD-GPOL-03GPO unlinked target count should be compliantActive DirectoryLowAD-GPOREP-06GPOs without domain computers count should be retrievableActive DirectoryLowAD-REPL-01No replication connections should be disabledActive DirectoryLowAD-ROOTDSE-03Root DSE should be synchronizedActive DirectoryLowASD.ISM-1654Internet Explorer 11 is disabled or removed.New in 3.0IntuneLowAZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0Azure DevOpsLowAZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0Azure DevOpsLowCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Microsoft 365LowCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0PurviewLowCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0Entra IDLowCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0Entra IDLowCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Entra IDLowCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Entra IDLowCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Entra IDLowCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Entra IDLowCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0Exchange OnlineLowCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Exchange OnlineLowCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0Exchange OnlineLowCIS.M365.8.5.6Ensure only organizers and co-organizers can presentNew in 3.0TeamsLowCIS.M365.8.5.9Ensure meeting recording is off by defaultNew in 3.0TeamsLowCIS.M365.9.1.3Restrict guest browsing of Fabric contentNew in 3.0Microsoft FabricLowCIS.M365.9.1.7Restrict organization-wide Fabric linksNew in 3.0Microsoft FabricLowCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDLowDISA.V-267355Microsoft Intune service must enforce a 60-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365LowDISA.V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.New in 3.0-IncludePreviewEntra IDLowDISA.V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365LowEIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDLowEIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDLowEIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDLowEIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDLowEIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDLowEIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDLowEIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDLowEIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDLowMT.1022All users utilizing a P1 license should be licensed.Entra IDLowMT.1023All users utilizing a P2 license should be licensed.Entra IDLowMT.1037Only users with Presenter role are allowed to present in Teams meetingsTeamsLowMT.1039Ensure MailTips are enabled for end usersExchange OnlineLowMT.1044Ensure modern authentication for Exchange Online is enabledExchange OnlineLowMT.1053Ensure intune device clean-up rule is configuredIntuneLowMT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.Entra IDLowMT.1067Authentication method policies should not reference non-existent groups.Entra IDLowMT.1069Restrict non-admin users from creating security groups.Entra IDLowMT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainExchange OnlineLowMT.1076MOERA SHOULD NOT be used for sent mailExchange OnlineLowMT.1083Ensure Delicensing Resiliency is enabledExchange OnlineLowMT.1085Pending approvals for Critical Asset Management should not be present.DefenderLowMT.1086Devices should not share both critical and non-critical user credentials.DefenderLowMT.1099Windows Diagnostic Data Processing should be enabledIntuneLowMT.1101Default Branding Profile should be customizedIntuneLowMT.1105Ensure MDM Authority is set to IntuneIntuneLowMT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).Entra IDLowMT.1107Access packages and catalogs should not reference deleted groups.Entra IDLowMT.1108Access packages should not reference inactive or orphaned assignment policies.Entra IDLowMT.1109Access package approval workflows must have valid approvers.Entra IDLowMT.1110No catalog should contain resources without any associated access packages.Entra IDLowMT.1111High privileged user should be linked to an identity.-IncludePreviewDefenderLowMT.1117Published AI agents should not be dormant.Copilot StudioLowMT.1155Full Scan Mapped Drives should be disabled for performance.DefenderLowMT.1157CPU Load Factor should be optimized (20-30%).DefenderLowMT.1158Scan should be scheduled.DefenderLowMT.1160Signatures should be checked before scan.DefenderLowMT.1162Cloud Extended Timeout should be 30-50 seconds.DefenderLowMT.1163Signature Update Interval should be 1-4 hours.DefenderLowMT.1168Cleaned Malware should be retained for at least 30 days.DefenderLowMT.1169Catch-up Full Scan should be disabled.DefenderLowMT.1170Catch-up Quick Scan should be disabled.DefenderLowMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.PurviewLowMT.1190Entra Private Access applications should not use the Default connector group.-IncludePreviewEntra IDLowMT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreviewEntra IDLowMT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreviewEntra IDLowMT.1199App registration credentials should not be expired or expiring soon.Entra IDLowMT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0Entra IDLowMT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0IntuneLowMT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0IntuneLowMT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0IntuneLowMT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0IntuneLowMT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0IntuneLowMT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0IntuneLowMT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0IntuneLowORCA.100Bulk Complaint Level threshold is between 4 and 6.DefenderLowORCA.101Bulk is marked as spam.DefenderLowORCA.102Advanced Spam filter options are turned off.DefenderLowORCA.106Quarantine retention period is 30 days.DefenderLowORCA.107End-user spam notification is enabled.DefenderLowORCA.110Internal Sender notifications are disabled.DefenderLowORCA.139Spam action set to move message to junk mail folder or quarantine.DefenderLowORCA.141Bulk action set to Move message to Junk Email Folder.DefenderLowORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.DefenderLowORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.DefenderLowORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.DefenderLowZTA.21775Tenant app management policy is configuredZTAEntra IDLowZTA.21812Maximum number of Global Administrators doesn't exceed eight usersZTAEntra IDLowZTA.21813High Global Administrator to privileged user ratioZTAEntra IDLowZTA.21816All privileged role assignments are managed with PIMZTAEntra IDLowZTA.21820Activation alert for all privileged role assignmentsZTAEntra IDLowZTA.21833Directory Sync account credentials haven't been rotated recentlyZTAEntra IDLowZTA.21834Directory sync account is locked down to specific named locationZTAEntra IDLowZTA.21835Emergency account existsZTAEntra IDLowZTA.21837Limit the maximum number of devices per user to 10ZTAEntra IDLowZTA.21838Security key authentication method enabledZTAEntra IDLowZTA.21839Passkey authentication method enabledZTAEntra IDLowZTA.21840Security key attestation is enforcedZTAEntra IDLowZTA.21841Authenticator app report suspicious activity is enabledZTAEntra IDLowZTA.21842Block administrators from using SSPRZTAEntra IDLowZTA.21843Block legacy Microsoft Online PowerShell moduleZTAEntra IDLowZTA.21844Block legacy Azure AD PowerShell moduleZTAEntra IDLowZTA.21845Temporary access pass is enabledZTAEntra IDLowZTA.21846Temporary access pass restricted to one-time useZTAEntra IDLowZTA.21848Enable custom banned passwordsZTAEntra IDLowZTA.21867All enterprise applications have ownersZTAEntra IDLowZTA.21870Enable SSPRZTAEntra IDLowZTA.21889Reduce the user-visible password surface areaZTAEntra IDLowZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationZTAEntra IDLowZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityZTAEntra IDLowZTA.21895Application Certificate Credentials are managed using HSMZTAEntra IDLowZTA.21953Local Admin Password Solution is deployedZTAEntra IDLowZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesZTAEntra IDLowZTA.21955Manage the local administrators on Microsoft Entra joined devicesZTAEntra IDLowZTA.21964Enable protected actions to secure Conditional Access policy creation and changesZTAEntra IDLowZTA.21984No Active low priority Entra recommendations foundZTAEntra IDLowZTA.24576Intune Endpoint Analytics policy is created and AssignedZTAIntuneLowZTA.25400DNS traffic for internal domains is routed through Private AccessZTAEntra IDLowZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsZTAEntra IDLowZTA.35004Sensitivity label policies are published to usersZTAPurviewLowZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAPurviewLowZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAPurviewLowZTA.35010Double Key Encryption labels are configuredZTAPurviewLowZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAPurviewLowZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorZTAAzureLowZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingZTAAzureLowZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesZTAAzureLowAD-CFG-01Tombstone lifetime configuration should be retrievableActive DirectoryInfoAD-CFG-02dSHeuristics count should be retrievableActive DirectoryInfoAD-CFG-03SPN mappings should be retrievableActive DirectoryInfoAD-CFG-04Optional features count should be retrievableActive DirectoryInfoAD-CFG-05Recycle bin enabled paths should be retrievableActive DirectoryInfoAD-CFG-06LDAP query policy count should be retrievableActive DirectoryInfoAD-CFG-07Default query policy should be retrievableActive DirectoryInfoAD-CFG-08AuthN policy container count should be retrievableActive DirectoryInfoAD-CFG-09AD activation objects count should be retrievableActive DirectoryInfoAD-CFG-10Well-known security principals count should be retrievableActive DirectoryInfoAD-CFG-11Registered DHCP servers count should be retrievableActive DirectoryInfoAD-CFG-12Enterprise CA count should be retrievableActive DirectoryInfoAD-CFG-13Certificate templates count should be retrievableActive DirectoryInfoAD-CFG-14Enrollment templates count should be retrievableActive DirectoryInfoAD-CFG-15Enrollment CA certificate details should be retrievableActive DirectoryInfoAD-CFG-16Trusted root CA count should be retrievableActive DirectoryInfoAD-CFG-17Trusted root CA details should be retrievableActive DirectoryInfoAD-CFG-18Intermediate CA count should be retrievableActive DirectoryInfoAD-CFG-19Intermediate CA details should be retrievableActive DirectoryInfoAD-CFG-20CRL distribution points count should be retrievableActive DirectoryInfoAD-CFG-21NTAuth certificates count should be retrievableActive DirectoryInfoAD-CFG-22KDS root key count should be acceptableActive DirectoryInfoAD-CFG-23SMTP site links count should be retrievableActive DirectoryInfoAD-CFG-24IP site links count should be retrievableActive DirectoryInfoAD-COMP-01Computer disabled count should be retrievableActive DirectoryInfoAD-COMP-02Computer dormant count should be retrievableActive DirectoryInfoAD-COMP-03Computer CreatorSid count should be retrievableActive DirectoryInfoAD-COMP-04Computer non-standard primary group count should be retrievableActive DirectoryInfoAD-COMP-05Computer SID History count should be retrievableActive DirectoryInfoAD-COMP-06Computer default container count should be retrievableActive DirectoryInfoAD-COMP-07Computer OU count should be retrievableActive DirectoryInfoAD-COMP-08Computer per OU average should be retrievableActive DirectoryInfoAD-COMP-09Computer delegation count should be retrievableActive DirectoryInfoAD-COMP-10Computer delegation details should be retrievableActive DirectoryInfoAD-DACL-01Distinct DACL object count should be investigatedActive DirectoryInfoAD-DACL-02OU DACL entry count should be investigatedActive DirectoryInfoAD-DACL-03Conflict object count should be investigatedActive DirectoryInfoAD-DACL-04Conflict object details should be investigatedActive DirectoryInfoAD-DACL-05Deny ACE count should be investigatedActive DirectoryInfoAD-DACL-06Deny ACE details should be investigatedActive DirectoryInfoAD-DACL-07Distinct DACL identity count should be investigatedActive DirectoryInfoAD-DACL-08DACL ACE distribution per identity should be investigatedActive DirectoryInfoAD-DACL-09Privileged allow ACE count should be investigatedActive DirectoryInfoAD-DACL-10Privileged allow ACE details should be investigatedActive DirectoryInfoAD-DACL-11Privileged extended right count should be investigatedActive DirectoryInfoAD-DACL-12Privileged extended right details should be investigatedActive DirectoryInfoAD-DACL-13Privileged extended right identities should be investigatedActive DirectoryInfoAD-DACL-14Non-inherited ACE count should be investigatedActive DirectoryInfoAD-DACL-15Unresolved SID count should be investigatedActive DirectoryInfoAD-DACL-16Unresolved SID details should be investigatedActive DirectoryInfoAD-DACL-17Inherited object type count should be investigatedActive DirectoryInfoAD-DACL-18Inherited object type details should be investigatedActive DirectoryInfoAD-DC-01DC site coverage count should be retrievableActive DirectoryInfoAD-DC-03SMBv3.1.1 enabled count should be retrievableActive DirectoryInfoAD-DC-05DCs with all FSMO roles count should be retrievableActive DirectoryInfoAD-DC-06FSMO role holder details should be retrievableActive DirectoryInfoAD-DC-07DC operating system count should be retrievableActive DirectoryInfoAD-DC-08DC operating system details should be retrievableActive DirectoryInfoAD-DCD-01DC non-standard LDAP port count should be retrievableActive DirectoryInfoAD-DCD-02DC non-standard LDAPS port count should be retrievableActive DirectoryInfoAD-DCD-03Read-only domain controller count should be retrievableActive DirectoryInfoAD-DCD-04Non-Global Catalog DC count should be retrievableActive DirectoryInfoAD-DCOMP-01Computers with unconstrained delegation count should be investigatedActive DirectoryInfoAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedActive DirectoryInfoAD-DCOMP-04Computer operating system count should be investigatedActive DirectoryInfoAD-DCOMP-05Computer operating system details should be investigatedActive DirectoryInfoAD-DCOMP-07Computer DNS host name count should be investigatedActive DirectoryInfoAD-DCOMP-08Computer DNS zone count should be investigatedActive DirectoryInfoAD-DCOMP-09Computer DNS zone details should be investigatedActive DirectoryInfoAD-DNS-01DNS zone count should be retrievableActive DirectoryInfoAD-DNS-02Zones with only SOA/NS records should be retrievableActive DirectoryInfoAD-DNS-03Root servers with incorrect IPs should be retrievableActive DirectoryInfoAD-DNS-04Root server incorrect IP details should be retrievableActive DirectoryInfoAD-DNS-05Dynamic DNS record count should be retrievableActive DirectoryInfoAD-DNS-06Zones with non-default records should be retrievableActive DirectoryInfoAD-DNS-07Zone record count details should be retrievableActive DirectoryInfoAD-DNS-08Zone delegation count should be retrievableActive DirectoryInfoAD-DNS-09Zone delegation details should be retrievableActive DirectoryInfoAD-DNS-10SOA record details should be retrievableActive DirectoryInfoAD-DNS-11AD DS SRV record count should be retrievableActive DirectoryInfoAD-DNS-12AD DS SRV record details should be retrievableActive DirectoryInfoAD-DNS-13DNSSEC record count should be retrievableActive DirectoryInfoAD-DNS-14Empty zone count should be retrievableActive DirectoryInfoAD-DNS-15Duplicate zone count should be retrievableActive DirectoryInfoAD-DNS-16Reverse lookup zone count should be retrievableActive DirectoryInfoAD-DNS-17Non-standard zone count should be retrievableActive DirectoryInfoAD-DNS-18Reverse zone network count should be retrievableActive DirectoryInfoAD-DNS-19Reverse zone network details should be retrievableActive DirectoryInfoAD-DOM-01Domain functional level should be retrievableActive DirectoryInfoAD-DOM-02Machine account quota should be retrievableActive DirectoryInfoAD-DOM-03Domain controller count should be retrievableActive DirectoryInfoAD-DOM-04RIDs remaining should be retrievableActive DirectoryInfoAD-DOM-05Domain name standard compliance should be retrievableActive DirectoryInfoAD-DOM-06Domain name non-standard details should be retrievableActive DirectoryInfoAD-DOM-07NetBIOS name standard compliance should be retrievableActive DirectoryInfoAD-DOM-08NetBIOS name non-standard details should be retrievableActive DirectoryInfoAD-DOMS-01Allowed DNS suffixes count should be retrievableActive DirectoryInfoAD-FEAT-01Optional feature count should be investigatedActive DirectoryInfoAD-FEAT-02Optional feature enabled details should be investigatedActive DirectoryInfoAD-FGPP-01Fine-grained password policy count should be retrievableActive DirectoryInfoAD-FGPP-02Fine-grained password policy value count should be retrievableActive DirectoryInfoAD-FGPP-03Fine-grained password policy setting counts should be retrievableActive DirectoryInfoAD-FGPP-04Fine-grained password policy application targets should be retrievableActive DirectoryInfoAD-FOR-01Forest functional level should be retrievableActive DirectoryInfoAD-FOR-02Forest domain count should be retrievableActive DirectoryInfoAD-FOR-03Tombstone lifetime should be retrievableActive DirectoryInfoAD-FOR-04Recycle Bin status should be retrievableActive DirectoryInfoAD-FORS-01UPN suffixes count should be retrievableActive DirectoryInfoAD-FORS-02UPN suffixes details should be retrievableActive DirectoryInfoAD-FORS-03SPN suffixes count should be retrievableActive DirectoryInfoAD-FORS-04Cross-forest references count should be retrievableActive DirectoryInfoAD-GCHG-01Average group membership changes per year should be investigatedActive DirectoryInfoAD-GMC-01Distinct groups with members count should be retrievableActive DirectoryInfoAD-GMC-02Distinct account types of members count should be retrievableActive DirectoryInfoAD-GMC-03Member account types breakdown should be retrievableActive DirectoryInfoAD-GMC-04Trust members count should be investigatedActive DirectoryInfoAD-GMC-05Trust members details by group should be investigatedActive DirectoryInfoAD-GMC-06Foreign SID principals count should be investigatedActive DirectoryInfoAD-GMC-07Foreign SID details by domain should be investigatedActive DirectoryInfoAD-GMC-08Empty non-privileged group count should be investigatedActive DirectoryInfoAD-GMC-09Empty non-privileged group details should be investigatedActive DirectoryInfoAD-GMC-10Privileged groups with members count should be investigatedActive DirectoryInfoAD-GMC-11Privileged groups with members details should be investigatedActive DirectoryInfoAD-GPO-01GPO total count should be retrievableActive DirectoryInfoAD-GPO-02GPO created before 2020 count should be retrievableActive DirectoryInfoAD-GPO-03GPO stale-before-2020 count should be investigatedActive DirectoryInfoAD-GPOL-01GPO linked count should be investigatedActive DirectoryInfoAD-GPOL-02Disabled GPO link count should be retrievableActive DirectoryInfoAD-GPOL-04Enforced GPO link count should be retrievableActive DirectoryInfoAD-GPOL-06GPO linked OU count should be retrievableActive DirectoryInfoAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedActive DirectoryInfoAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedActive DirectoryInfoAD-GPOREP-12GPO disabled link count should be retrievableActive DirectoryInfoAD-GPOREP-13GPO disabled link details should be investigatedActive DirectoryInfoAD-GPOREP-14GPO enforcement count should be investigatedActive DirectoryInfoAD-GPOS-01GPO state total count should be investigatedActive DirectoryInfoAD-GPOS-02WMI filter count should be investigatedActive DirectoryInfoAD-GPOS-03WMI filter details should be investigatedActive DirectoryInfoAD-GPOS-04Disabled GPO settings count should be investigatedActive DirectoryInfoAD-GPOS-05Computer disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-06User disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-07All disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-08GPO owner distinct count should be investigatedActive DirectoryInfoAD-GPOS-09GPO owner details should be investigatedActive DirectoryInfoAD-GRP-01Group AdminCount should be retrievableActive DirectoryInfoAD-GRP-02Groups in container objects count should be retrievableActive DirectoryInfoAD-GRP-03Stale groups count should be retrievableActive DirectoryInfoAD-GRP-04Groups with manager count should be retrievableActive DirectoryInfoAD-GRP-05Group SID History count should be retrievableActive DirectoryInfoAD-GRP-06Distribution group count should be retrievableActive DirectoryInfoAD-GRP-07Security group count should be retrievableActive DirectoryInfoAD-GRP-08Domain local group count should be retrievableActive DirectoryInfoAD-GRP-09Global group count should be retrievableActive DirectoryInfoAD-GRP-10Universal group count should be retrievableActive DirectoryInfoAD-KRBTGT-02KRBTGT last logon should be investigatedActive DirectoryInfoAD-MSA-01Managed service account count should be investigatedActive DirectoryInfoAD-OU-01OU overlapping name count should be retrievableActive DirectoryInfoAD-OU-02OU at domain root count should be retrievableActive DirectoryInfoAD-OU-03OU stale count should be retrievableActive DirectoryInfoAD-OU-04OU empty count should be retrievableActive DirectoryInfoAD-OU-05OU empty details should be retrievableActive DirectoryInfoAD-PRINT-01Printer total count should be retrievableActive DirectoryInfoAD-PWDPOL-01Password history count should be retrievableActive DirectoryInfoAD-PWDPOL-02Password maximum age should be retrievableActive DirectoryInfoAD-PWDPOL-03Password minimum length should be retrievableActive DirectoryInfoAD-PWDPOL-06Account lockout duration should be retrievableActive DirectoryInfoAD-PWDPOL-07Account lockout threshold should be retrievableActive DirectoryInfoAD-REPL-02Non-auto replication connection count should be investigatedActive DirectoryInfoAD-ROOTDSE-01Supported SASL mechanism count should be investigatedActive DirectoryInfoAD-ROOTDSE-02Supported SASL mechanism details should be investigatedActive DirectoryInfoAD-SCH-01Schema modification year count should be retrievableActive DirectoryInfoAD-SCH-02Schema modification year details should be retrievableActive DirectoryInfoAD-SCH-03Schema version entry count should be retrievableActive DirectoryInfoAD-SCH-04Schema version details should be retrievableActive DirectoryInfoAD-SITE-01Site total count should be retrievableActive DirectoryInfoAD-SITE-02Sites without domain controllers count should be retrievableActive DirectoryInfoAD-SITE-03Sites without domain controllers details should be retrievableActive DirectoryInfoAD-SITE-04Sites without subnet associations count should be retrievableActive DirectoryInfoAD-SITE-05Sites without subnet associations details should be retrievableActive DirectoryInfoAD-SPN-01Computer SPN service class count should be retrievableActive DirectoryInfoAD-SPN-02Computer SPN service class usage should be retrievableActive DirectoryInfoAD-SPN-03Computer SPN unknown service class count should be retrievableActive DirectoryInfoAD-SPN-04Computer SPN unknown service class details should be investigatedActive DirectoryInfoAD-SPN-05Computer SPN non-FQDN hosts should be investigatedActive DirectoryInfoAD-SPN-06User SPN total count should be investigatedActive DirectoryInfoAD-SPN-07User SPN service class count should be investigatedActive DirectoryInfoAD-SPN-08User SPN service class usage should be investigatedActive DirectoryInfoAD-SPN-09User SPN unknown service class count should be investigatedActive DirectoryInfoAD-SPN-10User SPN unknown service class details should be investigatedActive DirectoryInfoAD-SPN-11User SPN non-FQDN hosts should be investigatedActive DirectoryInfoAD-SUB-01Subnet total count should be retrievableActive DirectoryInfoAD-SUB-02Sites with subnet associations count should be retrievableActive DirectoryInfoAD-SUB-03Catch-all subnets count should be retrievableActive DirectoryInfoAD-SUB-04IPv6 subnets count should be retrievableActive DirectoryInfoAD-SUB-05IPv6 catch-all subnets count should be retrievableActive DirectoryInfoAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableActive DirectoryInfoAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableActive DirectoryInfoAD-SUB-08Distinct first octets count should be retrievableActive DirectoryInfoAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableActive DirectoryInfoAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableActive DirectoryInfoAD-SUB-11Subnets without site associations count should be retrievableActive DirectoryInfoAD-TRUST-01Trust total count should be investigatedActive DirectoryInfoAD-TRUST-02Trust inter-forest count should be investigatedActive DirectoryInfoAD-TRUST-03Trust quarantined count should be investigatedActive DirectoryInfoAD-TRUST-05Trust configuration details should be investigatedActive DirectoryInfoAD-TRUST-06Trust stale count should be investigatedActive DirectoryInfoAD-TRUST-07Trust stale details should be investigatedActive DirectoryInfoAD-USER-01Disabled user count should be retrievableActive DirectoryInfoAD-USER-02Dormant enabled user count should be retrievableActive DirectoryInfoAD-USER-03Non-expiring password user count should be retrievableActive DirectoryInfoAD-USER-04Reversible encryption user count should be retrievableActive DirectoryInfoAD-USER-05Delegation-enabled user count should be retrievableActive DirectoryInfoAD-USER-06DES-only Kerberos user count should be retrievableActive DirectoryInfoAD-USER-07No pre-authentication user count should be retrievableActive DirectoryInfoAD-USER-08Never-logged-in enabled user count should be retrievableActive DirectoryInfoAD-USER-09Password-not-required user count should be retrievableActive DirectoryInfoAD-USER-10Workstation-restricted user count should be retrievableActive DirectoryInfoAD-USER-11User AdminCount count should be retrievableActive DirectoryInfoAD-USER-12User non-standard primary group count should be retrievableActive DirectoryInfoAD-USER-13User SID History count should be retrievableActive DirectoryInfoAD-USER-14User SPN count should be retrievableActive DirectoryInfoAD-USER-15User manager count should be retrievableActive DirectoryInfoAD-USER-16User home directory count should be retrievableActive DirectoryInfoAD-USER-17User profile path count should be retrievableActive DirectoryInfoAD-USER-18User script path count should be retrievableActive DirectoryInfoAD-USER-19User in container count should be retrievableActive DirectoryInfoAD-USER-20Known service account count should be retrievableActive DirectoryInfoAD-USER-21Known service account details should be investigatedActive DirectoryInfoAD-USER-22Built-in administrator account count should be investigatedActive DirectoryInfoAD-USER-23Enabled built-in administrator details should be investigatedActive DirectoryInfoAD-USER-24Built-in administrator last logon details should be investigatedActive DirectoryInfoAD-USER-25Built-in administrator password age details should be investigatedActive DirectoryInfoAD-USER-26Honey pot user count should be investigatedActive DirectoryInfoAD-USER-27Honey pot user details should be investigatedActive DirectoryInfoAD-USER-28User delegation configured count should be investigatedActive DirectoryInfoAZDO.1009Feedback Collection.New in 3.0Azure DevOpsInfoAZDO.1011Project Resource Limits.New in 3.0Azure DevOpsInfoAZDO.1012Work Items Tags Limits.New in 3.0Azure DevOpsInfoAZDO.1029Storage Usage Limit.New in 3.0Azure DevOpsInfoAZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreviewAzure DevOpsInfoEIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDInfoMT.1159Quick Scan Time configuration is not required.DefenderInfoORCA.119Similar Domains Safety Tips is enabled.DefenderInfoORCA.123Unusual Characters Safety Tips is enabled.DefenderInfoORCA.143Safety Tips are enabled.DefenderInfoORCA.224Similar Users Safety Tips is enabled.DefenderInfoMP.CLT.UA.1001All member users have a usage location.Community pack · CLT.UAEntra IDHighMP.JL.CISDEFINT.L1.014ASR: Block abuse of exploited vulnerable signed drivers is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.015ASR: Block Adobe Reader from creating child processes is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.016ASR: Block all Office applications from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.017ASR: Block credential stealing from the Windows local security authority subsystem is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.018ASR: Block executable content from email client and webmail is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.019ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.020ASR: Block execution of potentially obfuscated scripts is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.021ASR: Block JavaScript or VBScript from launching downloaded executable content is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.022ASR: Block Office applications from creating executable content is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.023ASR: Block Office applications from injecting code into other processes is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.024ASR: Block Office communication application from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.025ASR: Block persistence through WMI event subscription is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.026ASR: Block process creations originating from PSExec and WMI commands is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.027ASR: Block rebooting machine in Safe Mode is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.028ASR: Block untrusted and unsigned processes that run from USB is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.029ASR: Block Win32 API calls from Office macros is set to BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.030ASR: Use advanced protection against ransomware is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISDEFINT.L1.031Check For Signatures Before Running Scan is set to EnabledCommunity pack · JL.CISDEFINT.L1IntuneHighMP.JL.CISIOSINT.L1.001Block viewing corporate documents in unmanaged apps is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.008Force encrypted backup is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.009Block managed apps from storing data in iCloud is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.012Block iCloud Photos sync is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.013Block iCloud Photo Library is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.014Block My Photo Stream is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.016Block iCloud backup is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.017Block iCloud document and data sync is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.018Block iCloud Keychain sync is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.029Block users from erasing all content and settings on device is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.030Block modification of device name is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.031Block configuration profile changes is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.032Allow activation lock is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.038Require password is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.039Block simple passwords is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.040Minimum password length is at least 6Community pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.041Maximum minutes after screen lock before password is required is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.042Maximum minutes of inactivity until screen locks is at most 2Community pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.043Block password proximity requests is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.044Block password sharing is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.045Require Touch ID or Face ID authentication for AutoFill of password or credit card information is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.047Lock Screen Message is configuredCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.048Locked enrollment is set to YesCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.049Sync with computers is set to Deny AllCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.050Jailbroken devices is set to BlockCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.051Minimum OS version is configuredCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.052Mark device noncompliant is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.053Device compliance status is set to CompliantCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.054Mark devices with no compliance policy assigned as is set to Not compliantCommunity pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISIOSINT.L1.055Compliance status validity period (days) is at most 7Community pack · JL.CISIOSINT.L1IntuneHighMP.JL.CISMACINT.L1.024Require Passcode on Device is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.026Enforce Latest Software Update Version is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.027Allow Standard User OS Updates is set to AllowedCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.028Download is set to AlwaysOnCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.029Install OS Updates is set to Always OnCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.030Install Security Update is set to AlwaysOnCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.033Defer is set to EnabledCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.034Defer Force At User Login Max Bypass Attempts is set to 0Community pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.035Enable is set to OnCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.036Force Enable In Setup Assistant is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.037Show Recovery Key is set to DisabledCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.038User Enters Missing Info is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.039Prevent FileVault From Being Disabled is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.042Enable Firewall is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.043Enable Stealth Mode is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.083Destroy FV Key On Standby is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.084Ask For Password is set to TrueCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.089Removal Password is configuredCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISMACINT.L1.090Locked enrollment is set to YesCommunity pack · JL.CISMACINT.L1IntuneHighMP.JL.CISOFFINT.L1.003Add-on Management is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.013Restrict ActiveX Install is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.017Enable Automatic Updates is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.019Access: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.022Access: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.031Default file format is set to Enabled: Excel Workbook (*.xlsx)Community pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.039Excel: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.040Excel: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.041Prevent Excel from running XLM macros is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.042Excel: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.051Excel 2 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.052Excel 2 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.053Excel 3 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.054Excel 3 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.055Excel 4 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.056Excel 4 workbooks is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.057Excel 4 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.058Excel 95 workbooks is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.059Excel 95-97 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.060Excel 97-2003 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.061Excel: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.062Web pages and Excel 2003 XML spreadsheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.064Excel: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.065Excel: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.069Excel: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.077Block signing into Office is set to Enabled: Org ID onlyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.162Junk E-mail protection level is set to Enabled: HighCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.163Minimum encryption settings is set to Enabled: 256Community pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.175Default file format is set to Enabled: PowerPoint Presentation (*pptx)Community pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.181PowerPoint: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.182PowerPoint: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.185PowerPoint: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.186PowerPoint 97-2003 presentations, shows, templates and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.193PowerPoint: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.195Publisher: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.196Publisher: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.198Publisher: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.204Word: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.206Word: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.210Word: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.211Word: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.212Word 2 and earlier binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.213Word 2000 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.214Word 2003 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.215Word 2007 and later binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.216Word 6.0 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.217Word 95 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.218Word 97 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.219Word XP binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.220Word: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.221Word: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISOFFINT.L1.225Word: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneHighMP.JL.CISW11INT.BL.001Require Device Encryption is set to EnabledCommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.BL.004Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.BL.005Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.BL.006Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for removable data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.BL.025Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.BL.026Enforce drive encryption type on operating system drives: Select the encryption type is set to Enabled: Full encryption or Used Space Only encryptionCommunity pack · JL.CISW11INT.BLIntuneHighMP.JL.CISW11INT.L1.131Configure System Guard Launch is set to Unmanaged Enables Secure Launch if supported by hardwareCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.132Credential Guard is set to (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock.Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.133Enable Virtualization Based Security is set to enable virtualization based security.Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.134Require Platform Security Features is set to Turns on VBS with Secure Boot, with or without DMACommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.139Enable Domain Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.140Enable Domain Network Firewall: Default Inbound Action for Domain Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.141Enable Domain Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.142Enable Domain Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.143Enable Domain Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.144Enable Domain Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\domainfw.logCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.145Enable Domain Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.146Enable Private Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.147Enable Private Network Firewall: Default Inbound Action for Private Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.148Enable Private Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.149Enable Private Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.150Enable Private Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.151Enable Private Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\privatefw.logCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.152Enable Private Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.153Enable Public Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.154Enable Public Network Firewall: Allow Local Ipsec Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.155Enable Public Network Firewall: Allow Local Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.156Enable Public Network Firewall: Default Inbound Action for Public Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.157Enable Public Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.158Enable Public Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.159Enable Public Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.160Enable Public Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\publicfw.logCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.161Enable Public Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.257Hypervisor Enforced Code Integrity is set to (Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock.Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.258Require UEFI Memory Attributes Table is set to Require UEFI Memory Attributes TableCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.260Enable ESS with Supported Peripherals is set to Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For system…Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.261Facial Features Use Enhanced Anti Spoofing is set to trueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.262Minimum PIN Length is set to 6Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.263Require Security Device is set to trueCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.273Backup Directory is set to Backup the password to Microsoft Entra ID onlyCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.274Password Age Days is at most 30Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.275Password Complexity is set to Large letters + small letters + numbers + special characters or strongerCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.276Password Length is at least 15Community pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.277Post Authentication Actions is set to Reset the password and logoff, or reset and rebootCommunity pack · JL.CISW11INT.L1IntuneHighMP.JL.CISW11INT.L1.278Post Authentication Reset Delay is set to 1 to 8 hoursCommunity pack · JL.CISW11INT.L1IntuneHighMP.RKS.IA.1001Windows devices are BitLocker-encrypted and their recovery key is in Entra IDCommunity pack · RKS.IAIntuneHighMP.RKS.IA.1002Windows devices back up their local administrator password to Entra IDCommunity pack · RKS.IAIntuneHighMP.CLT.ADUA.1001All Active Directory users have a manager.Community pack · CLT.ADUAActive DirectoryMediumMP.CLT.ADUA.1004All Active Directory users have an employee ID.Community pack · CLT.ADUAActive DirectoryMediumMP.CLT.ADUA.1011Every Active Directory employee ID belongs to only one user.Community pack · CLT.ADUAActive DirectoryMediumMP.CLT.UA.1002All member users have a manager.Community pack · CLT.UAEntra IDMediumMP.CLT.UA.1005All member users have an employee ID.Community pack · CLT.UAEntra IDMediumMP.CLT.UA.1006All member users have an employee hire date.Community pack · CLT.UAEntra IDMediumMP.CLT.UA.1009All guest users have a sponsor.Community pack · CLT.UAEntra IDMediumMP.CLT.UA.1010Every employee ID belongs to only one user.Community pack · CLT.UAEntra IDMediumMP.JL.CISDEFINT.L1.001Configure local setting override for reporting to Microsoft MAPS is set to DisabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.002Configure the 'Block at First Sight' feature is set to EnabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.003Turn on process scanning whenever real-time protection is enabled is set to EnabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.004Turn off routine remediation is set to DisabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.005Allow Archive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.006Allow Behavior Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.007Allow Cloud Protection is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.008Allow Email Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.009Allow Full Scan Removable Drive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.010Allow On Access Protection is set to AllowCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.011Allow Realtime Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.012Allow scanning of all downloaded files and attachments is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.013Allow Script Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.032Cloud Block Level is set to High or higherCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.033Cloud Extended Timeout is at least 1Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.034Days Until Aggressive Catchup Quick Scan is set to 7Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.035Enable Dynamic Signature Dropped Event Reporting is set to Dynamic Security intelligence update events will be reportedCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.036Enable File Hash Computation is set to EnableCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.037Enable Network Protection is set to Enabled (block mode)Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.038Hide Exclusions From Local Users is set to EnabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.039Oobe Enable Rtp And Sig Update is set to EnabledCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.040PUA Protection is set to PUA Protection onCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.041Quick Scan Include Exclusions is set to 1Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.042Real Time Scan Direction is set to Monitor all files bi-directionalCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.043Remote Encryption Protection Configured State is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.044Scan Parameter is set to Quick scan or Full scanCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.045Schedule Quick Scan Time is at least 1Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.046Schedule Scan Time is at least 1Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.047Schedule Scan Day is not set to No scheduled scanCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.048Signature Update Interval is set to 1 to 4Community pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.049Submit Samples Consent is set to Send safe samples or all samples automaticallyCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.050Remediation action for Moderate severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.051Remediation action for High severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISDEFINT.L1.052Remediation action for Severe threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.001Enable Google Cast is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.002Allow users to manage installed CA certificates is set to Enabled: Disallow users from managing certificatesCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.003Control use of insecure content exceptions is set to Enabled: Do not allow any site to load blockable mixed contentCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.004Control use of the File System API for writing is set to Enabled: Don't allow any site to request write access to files and directoriesCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.005Default automatic downloads setting is set to Enabled: Don't allow any website to perform automatic downloadsCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.006Default geolocation setting is set to Enabled: Don't allow any site to track users' physical locationCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.007Enable insecure download warnings is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.008Configure Edge Website Typo Protection is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.009Configure users ability to override feature flags is set to Enabled: Prevent users from overriding feature flagsCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.010Blocks external extensions from being installed is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.011Enable Gamer Mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.012Allow Basic authentication for HTTP is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.013Allow cross-origin HTTP Basic Auth prompts is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.014Guided Switch Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.015Specifies whether to block requests from public websites to devices on a user's local network is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.016Enable saving passwords to the password manager is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.017Enable startup boost is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.018Configure Microsoft Defender SmartScreen is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.019Configure Microsoft Defender SmartScreen to block potentially unwanted apps is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.020Enable Microsoft Defender SmartScreen DNS requests is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.021Force Microsoft Defender SmartScreen checks on downloads from trusted sources is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.022Prevent bypassing Microsoft Defender SmartScreen prompts for sites is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.023Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.024Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.025Ads setting for sites with intrusive ads is set to Enabled: Block ads on sites with intrusive adsCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.026Allow download restrictions is set to Enabled: Block malicious downloadsCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.027Allow Google Cast to connect to Cast devices on all IP addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.028Allow import of data from other browsers on each Microsoft Edge launch is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.029Allow importing of autofill form data is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.030Allow importing of browser settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.031Allow importing of home page settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.032Allow importing of payment info is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.033Allow importing of saved passwords is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.034Allow importing of search engine settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.035Allow managed extensions to use the Enterprise Hardware Platform API is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.036Allow personalization of ads, search and news by sending browsing history to Microsoft is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.037Allow queries to a Browser Network Time service is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.038Allow remote debugging is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.039Allow the audio sandbox to run is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.040Allow user feedback is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.041Allow Web Authentication requests on sites with broken TLS certificates is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.042Allow websites to query for available payment methods is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.043Automatically import another browser's data and settings at first run is set to Enabled: Disables automatic import, and the import section of the first-run experience is skippedCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.044Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.045Block tracking of users' web-browsing activity is set to Enabled: Balanced or StrictCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.046Clear browsing data when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.047Clear cached images and files when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.048Clear history for IE and IE mode every time you exit is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.049Configure browser process code integrity guard setting is set to Enabled: Enable code integrity guard enforcement in the browser processCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.050Configure InPrivate mode availability is set to Enabled: InPrivate mode disabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.051Configure the list of names that will bypass the HSTS policy check is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.052Configure the list of types that are excluded from synchronization is set to Enabled and includes passwordsCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.053Configure the Share experience is set to Enabled: Don't allow using the Share experienceCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.054Continue running background apps after Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.055Control communication with the Experimentation and Configuration Service is set to Enabled: Disable communication with the Experimentation and Configuration ServiceCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.056Control where security restrictions on insecure origins apply is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.057Delete old browser data on migration is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.058Disable saving browser history is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.059Disable synchronization of data using Microsoft sync services is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.060DNS interception checks enabled is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.061Dynamic Code Settings is set to Enabled: Prevent the browser process from creating dynamic codeCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.062Edge 3P SERP Telemetry Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.063Edge Wallet E-Tree Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.064Enable Application Bound Encryption is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.065Enable AutoFill for addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.066Enable AutoFill for payment instruments is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.067Enable browser legacy extension point blocking is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.068Enable component updates in Microsoft Edge is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.069Enable deleting browser and download history is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.070Enable globally scoped HTTP auth cache is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.071Enable network prediction is set to Enabled: Don't predict network actions on any network connectionCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.072Enable profile creation from the Identity flyout menu or the Settings page is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.073Enable resolution of navigation errors using a web service is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.074Enable security warnings for command-line flags is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.075Enable site isolation for every site is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.076Enable the Search bar is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.077Enable tab organization suggestions is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.078Enable upload files from mobile in Microsoft Edge desktop is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.079Enable use of ephemeral profiles is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.080Enable warnings for insecure forms is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.081Enables DALL-E themes generation is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.082Enhance the security state in Microsoft Edge is set to Enabled: Balanced mode or Strict modeCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.083Hide the First-run experience and splash screen is set to EnabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.084In-app support Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.085Manage exposure of local IP addressess by WebRTC is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.086Notify a user that a browser restart is recommended or required for pending updates is set to Enabled: Required - Show a recurring prompt to the user indicating that a restart is requiredCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.087Set disk cache size, in bytes is set to Enabled: 250609664Community pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.088Set the time period for update notifications is set to Enabled: 86400000Community pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.089Shopping in Microsoft Edge Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.090Show Microsoft Rewards experiences is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.091Show the Reload in Internet Explorer mode button in the toolbar is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.092Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.093Standalone Sidebar Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.094Suggest similar pages when a webpage can't be found is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.095Suppress the unsupported OS warning is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.096Wait for Internet Explorer mode tabs to completely unload before ending the browser session is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.097Wallet Donation Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.098Update policy override default is set to Enabled: Always allow updates or Automatic silent updates onlyCommunity pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISEDGEINT.L1.099Auto-update check period override is set to Enabled: any value except 0Community pack · JL.CISEDGEINT.L1IntuneMediumMP.JL.CISIOSINT.L1.002Treat AirDrop as an unmanaged destination is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.003Allow copy/paste to be affected by managed open-in is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.004Block App Store is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.005Block access to network drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.006Block Siri while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.007Require Safari fraud warnings is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.010Block backup of enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.011Block notes and highlights sync for enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.015Block Handoff is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.019Force Apple Watch wrist detection is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.020Require AirPlay outgoing requests pairing password is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.021Block Apple Watch auto unlock is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.022Block iBeacon discovery of AirPrint printers is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.023Block access to USB drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.024Block sending diagnostic and usage data to Apple is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.025Block screenshots and screen recording is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.026Force limited ad tracking is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.027Block trusting new enterprise app authors is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.028Limit Apple personalized advertising is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.033Force automatic date and time is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.034Block VPN creation is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.035Block Control Center access in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.036Block Today view in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.037Block Wallet notifications in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISIOSINT.L1.046Block voice dialing while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1IntuneMediumMP.JL.CISMACINT.L1.001Disable Guest Account is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.002Allow Sign In is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.003Enabled is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.004Allow Apple Intelligence Report is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.005Allow Genmoji is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.006Allow Image Playground is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.007Allow Writing Tools is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.008Allow Smart Replies is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.009Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.010Allow Transcription is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.011Allow Transcription Summary is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.012Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.013Force On Device Only Dictation is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.014Automatic Device Lock is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.015Change At Next Auth is set to EnabledCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.016Regex is configuredCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.017Failed Attempts Reset In Minutes is at least 15Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.018Maximum Grace Period is set to 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.019Maximum Number of Failed Attempts is set to 5 or less, but not 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.020Maximum Passcode Age In Days is set to 365 or less, but not 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.021Minimum Passcode Length is at least 15Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.022Passcode Reuse Limit is at least 24Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.023Require Alphanumeric Passcode is set to EnabledCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.025Enabled is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.031Enable is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.032Enable Rollback is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.040Show Full Name is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.041Disable Login Items Suppression is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.044Allow Activity Continuation is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.045Allow Air Play Incoming Requests is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.046Allow AirDrop is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.047Allow Apple Personalized Advertising is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.048Allow ARD Remote Management Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.049Allow Auto Unlock is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.050Allow Bluetooth Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.051Allow Cloud Address Book is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.052Allow Cloud Bookmarks is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.053Allow Cloud Calendar is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.054Allow Cloud Desktop And Documents is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.055Allow Cloud Document Sync is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.056Allow Cloud Freeform is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.057Allow Cloud Keychain Sync is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.058Allow Cloud Mail is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.059Allow Cloud Notes is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.060Allow Cloud Photo Library is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.061Allow Cloud Reminders is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.062Allow Device Name Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.063Allow Diagnostic Submission is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.064Allow Erase Content And Settings is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.065Allow File Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.066Allow Find My Friends is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.067Allow Internet Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.068Allow iPhone Mirroring is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.069Allow iTunes File Sharing is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.070Allow Local User Creation is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.071Allow Media Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.072Allow Multiplayer Gaming is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.073Allow Password Proximity Requests is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.074Allow Password Sharing is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.075Allow Printer Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.076Allow Startup Disk Modification is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.077Allow UI Configuration Profile Installation is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.078Allow Universal Control is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.079Display Sleep Timer is set to 10 or less, but not 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.080System Sleep Timer is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.081Wake on LAN is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.082Wake On Modem Ring is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.085Allow User Overrides is set to FalseCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.086Allow Identified Developers is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.087Enable XProtect Malware Upload is set to DisabledCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISMACINT.L1.088Disable Override is set to TrueCommunity pack · JL.CISMACINT.L1IntuneMediumMP.JL.CISOFFINT.L1.001Block Flash activation in Office documents is set to Enabled: Block all activationCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.002Restrict legacy JScript execution for Office is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.004Bind to object is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.005Consistent Mime Handling is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.006Disable user name and password is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.007Information Bar is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.008Local Machine Zone Lockdown Security is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.009Mime Sniffing Safety Feature is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.010Navigate URL is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.011Object Caching Protection is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.012Protection From Zone Elevation is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.014Restrict File Download is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.015Saved from URL is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.016Scripted Window Security Restrictions is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.018Hide option to enable or disable updates is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.020Access: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.021Access: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.023Underline hyperlinks is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.024Default file format is set to Enabled: Access 2007Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.025Do not prompt to convert older databases is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.026Modal Trust Decision Only is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.027Do not show data extraction options when opening corrupt workbooks is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.028Ask to update automatic links is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.029Load Pictures from Web pages not created in Excel is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.030Internet and network paths as hyperlinks is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.032Disable AutoRepublish is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.033Do not show AutoRepublish warning alert is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.034Force file extension to match file type is set to Enabled: Always match file typeCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.035Scan encrypted macros in Excel Open XML workbooks is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.036Excel: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.037WEBSERVICE Function Notification Settings is set to Enabled: Disable all with notification or Disable all without notificationCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.038Block Excel XLL Add-ins that come from an untrusted source is set to Enabled: BlockedCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.043Excel: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.044Store macro in Personal Macro Workbook by default is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.045Excel: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.046Always prevent untrusted Microsoft Query files from opening is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.047Don't allow Dynamic Data Exchange (DDE) server launch in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.048Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.049dBase III /IV files is set to Enable: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.050Dif and Sylk files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.063Always open untrusted database files in Protected View is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.066Excel: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.067Excel: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.068Excel: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.070Disable UI extending from documents and templates is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.071Document Information Panel Beaconing UI is set to Enabled: Always show UICommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.072Allow users with earlier versions of Office to read with browsers... is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.073Always expand groups in Office when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.074Always require users to connect to verify permission is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.075Never allow users to specify groups when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.076Prevent users from changing permissions on rights managed content is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.078Control Blogging is set to Enabled: All Blogging DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.079Block opening of pre-release versions of file formats new to Excel 2016 through the Compatibility Pack for Office 2016 and Excel 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.080Block opening of pre-release versions of file formats new to PowerPoint 2016 through the Compatibility Pack for Office 2016 and PowerPoint 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.081ActiveX Control Initialization is set to Enabled: 6Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.082Allow Basic Authentication prompts from network proxies is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.083Allow VBA to load typelib references by path from untrusted intranet locations is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.084Automation Security is set to Enabled: Disable Macros by defaultCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.085Control how Office handles form-based sign-in prompts is set to Enabled: Block all promptsCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.086Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.087Disable all Trust Bar notifications for security issues is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.088Disable password to open UI is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.089Encryption mode for Information Rights Management (IRM) is set to Enabled: Cipher Block Chaining (CBC)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.090Encryption type for password protected Office 97-2003 files is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.091Encryption type for password protected Office Open XML files is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.092Load Controls in Forms3 is set to Enabled: 4Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.093Macro Runtime Scan Scope is set to Enabled: Enable for all documentsCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.094Protect document metadata for password protected files is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.095Protect document metadata for rights managed Office Open XML Files is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.096Suppress hyperlink warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.097Allow mix of policy and user locations is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.098Disable the Office client from polling the SharePoint Server for published links is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.099Disable Internet Fax feature is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.100Legacy format signatures is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.101Suppress external signature services menu item is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.102Disable Smart Document's use of manifests is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.103Open Office documents as read/write while browsing is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.104Send Office Feedback is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.105Automatically receive small updates to improve reliability is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.106Disable Opt-in Wizard on first run is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.107Enable Customer Experience Improvement Program is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.108Send personal information is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.109Do not allow users to change permissions on folders is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.110Automatically download attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.111Do not include Internet Calendar integration in Outlook is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.112Download full text of articles as HTML attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.113Synchronize Outlook RSS Feeds with Common Feed List is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.114Turn off RSS feature is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.115Do not allow Home Page URL to be set in folder Properties is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.116Disable user entries to server list is set to Enabled: Publish default, disallow othersCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.117PST Null Data on Delete is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.118Plain Text Options is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.119Make Outlook the default program for E-mail, Contacts, and Calendar is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.120Do not allow folders in non-default stores to be set as folder home pages is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.121Access to published calendars is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.122Prevent publishing to a DAV server is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.123Prevent publishing to Office.com is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.124Restrict level of calendar details users can publish is set to Enabled: Disables Full details and Limited detailsCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.125Restrict upload method is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.126Add e-mail recipients to users' Safe Senders Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.127Hide Junk Mail UI is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.128Trust e-mail from contacts is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.129Turn off Outlook Social Connector is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.130Disable 'Remember password' for Internet e-mail accounts is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.131Do not automatically sign replies is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.132Prompt user to choose security settings if default settings fail is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.133Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.134Block Trusted Zones is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.135Display pictures and external content in HTML e-mail is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.136Do not permit download of content from safe zones is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.137Do not display 'Publish to GAL' button is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.138Do not provide Continue option on Encryption warning dialog boxes is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.139Message Formats is set to Enabled: S/MIMECommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.140S/MIME interoperability with external clients is set to Enabled: Handle internallyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.141Attachment Secure Temporary Folder is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.142Missing CRLs is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.143Missing Root Certificates is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.144Promote Level 2 errors as errors, not warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.145Outlook Security Mode is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.146Allow Active X One Off Forms is set to Enabled: Load only Outlook ControlsCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.147Allow hyperlinks in suspected phishing e-mail messages is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.148Allow scripts in one-off Outlook forms is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.149Allow users to demote attachments to Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.150Authentication with Exchange server is set to Enabled: Kerberos Password AuthenticationCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.151Configure Outlook object model prompt when accessing an address book is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.152Configure Outlook object model prompt When accessing the Formula property of a UserProperty object is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.153Configure Outlook object model prompt when executing Save As is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.154Configure Outlook object model prompt when reading address information is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.155Configure Outlook object model prompt when responding to meeting and task requests is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.156Display Level 1 attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.157Configure Outlook object model prompt when sending mail is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.158Do not allow Outlook object model scripts to run for public folders is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.159Do not allow Outlook object model scripts to run for shared folders is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.160Enable RPC encryption is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.161Include Internet in Safe Zones for Automatic Picture Download is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.164Outlook Security Policy is set to Use Outlook Security Group PolicyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.165Prevent users from customizing attachment security settings is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.166Remove file extensions blocked as Level 1 is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.167Remove file extensions blocked as Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.168Retrieving CRLs (Certificate Revocation Lists) is set to Enabled: When online always retrieve the CRLCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.169Security setting for macros is set to Enabled: Warn for signed, disable unsignedCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.170Set Outlook object model custom actions execution prompt is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.171Signature Warning is set to Enabled: Always warn about invalid signaturesCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.172Use Unicode format when dragging e-mail message to file system is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.173Do not prompt about Level 1 attachments when closing an item is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.174Do not prompt about Level 1 attachments when sending an item is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.176PowerPoint: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.177Run Programs is set to Enabled: disable (don't run any programs)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.178Scan encrypted macros in PowerPoint Open XML presentations is set to Enabled: Scan encrypted macrosCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.179PowerPoint: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.180Unblock automatic download of linked images is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.183PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.184PowerPoint: Trust Access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.187PowerPoint: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.188PowerPoint: Do not open files from the Internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.189PowerPoint: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.190PowerPoint: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.191PowerPoint: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.192PowerPoint: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.194Publisher Automation Security Level is set to Enabled: By UI (prompted)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.197Publisher: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.199Update automatic links at Open is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.200Hidden text is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.201Default file format is set to Enabled: Word Document (.docx)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.202Word: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.203Word: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.205Dynamic Data Exchange is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.207Word: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.208Scan encrypted macros in Word Open XML Documents is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.209Word: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.222Word: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.223Word: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISOFFINT.L1.224Word: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1IntuneMediumMP.JL.CISW11INT.BL.002Allow Warning For Other Disk Encryption is set to DisabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.003Allow Warning For Other Disk Encryption: Allow Standard User Encryption is set to Disabled: EnabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.007Prevent installation of devices using drivers that match these device setup classes is set to EnabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.008Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed. is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.009Prevent installation of devices using drivers that match these device setup classes: Prevented Classes is set to Enabled: {d48179be-ec20-11d1-b6b8-00c04fa372a7}, {7ebefbc0-3200-11d2-b4c2-00a0C9697d07…Community pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.010Choose how BitLocker-protected fixed drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.011Choose how BitLocker-protected fixed drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Allow 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.012Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.013Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.014Choose how BitLocker-protected fixed drives can be recovered: FDVRecoveryKeyUsageDropDown_Name is set to Enabled: Allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.015Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Backup recovery passwords onlyCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.016Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.017Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.018Choose how BitLocker-protected operating system drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.019Choose how BitLocker-protected operating system drives can be recovered: OSRecoveryKeyUsageDropDown_Name is set to Enabled: Do not allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.020Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Store recovery passwords and key packagesCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.021Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.022Choose how BitLocker-protected operating system drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Require 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.023Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.024Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.027Deny write access to removable drives not protected by BitLocker is set to EnabledCommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.BL.028Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntuneMediumMP.JL.CISW11INT.L1.001Allow Cortana Above Lock is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.002Allow Toasts is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.003Prevent enabling lock screen camera is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.004Apply UAC restrictions to local accounts on network logons is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.005Configure SMB v1 client driver is set to Enabled: Disable driver (recommended)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.006Configure SMB v1 server is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.007Enable Structured Exception Handling Overwrite Protection (SEHOP) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.008WDigest Authentication (disabling may require KB2871997) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.009MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.010MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.011MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.012MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.013MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.014MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.015MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning: WarningLevel is set to Enabled: 90% or lessCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.016Turn off multicast name resolution is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.017Prohibit installation and configuration of Network Bridge on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.018Prohibit use of Internet Connection Sharing on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.019Require domain users to elevate when setting a network's location is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.020Hardened UNC Paths is set to Enabled: \\*\NETLOGON and \\*\SYSVOL with RequireIntegrity=1,RequireMutualAuthentication=1,RequirePrivacy=1Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.021Minimize the number of simultaneous connections to the Internet or a Windows Domain is set to Enabled: 3 = Prevent Wi-Fi when on EthernetCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.022Prohibit connection to non-domain networks when connected to domain authenticated network is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.023Allow Print Spooler to accept client connections is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.024Configure Redirection Guard: Redirection Guard Options is set to Enabled: Redirection Guard EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.025Configure RPC connection settings: Protocol to use for outgoing RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.026Configure RPC connection settings: Use authentication for outgoing RPC connections is set to Enabled: DefaultCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.027Configure RPC listener settings: Authentication protocol to use for incoming RPC connections is set to Enabled: Negotiate or KerberosCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.028Configure RPC listener settings: Protocols to allow for incoming RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.029Configure RPC over TCP port: RPC over TCP port is set to Enabled: 0Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.030Limits print driver installation to Administrators is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.031Manage processing of Queue-specific files: Manage processing of Queue-Specific files is set to Enabled: Limit Queue-specific files to Color profilesCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.032Point and Print Restrictions: When installing drivers for a new connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.033Point and Print Restrictions: When updating drivers for an existing connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.034Include command line in process creation events is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.035Encryption Oracle Remediation is set to Enabled: Force Updated ClientsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.036Remote host allows delegation of non-exportable credentials is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.037Prevent automatic download of applications associated with device metadata is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.038Boot-Start Driver Initialization Policy is set to Enabled: Good, unknown and bad but criticalCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.039Continue experiences on this device is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.040Turn off downloading of print drivers over HTTP is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.041Turn off Internet download for Web publishing and online ordering wizards is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.042Allow Custom SSPs and APs to be loaded into LSASS is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.043Block user from showing account details on sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.044Do not display network selection UI is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.045Do not enumerate connected users on domain-joined computers is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.046Enumerate local users on domain-joined computers is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.047Turn off app notifications on the lock screen is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.048Turn off picture password sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.049Turn on convenience PIN sign-in is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.050Require a password when a computer wakes (on battery) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.051Require a password when a computer wakes (plugged in) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.052Configure Offer Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.053Configure Solicited Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.054Enable RPC Endpoint Mapper Client Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.055Restrict Unauthenticated RPC clients is set to Enabled: AuthenticatedCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.056Enable Windows NTP Client is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.057Enable Windows NTP Server is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.058Allow Microsoft accounts to be optional is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.059Do not preserve zone information in file attachments (User) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.060Notify antivirus programs when opening attachments (User) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.061Disallow Autoplay for non-volume devices is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.062Set the default behavior for AutoRun is set to Enabled: Do not execute any autorun commandsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.063Turn off Autoplay is set to Enabled: All drivesCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.064Do not display the password reveal button is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.065Enumerate administrator accounts on elevation is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.066Prevent the use of security questions for local accounts is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.067Enable App Installer Experimental Features is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.068Enable App Installer Hash Override is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.069Enable App Installer ms-appinstaller protocol is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.070Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.071Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.072Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.073Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 196,608 or moreCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.074Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.075Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.076Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.077Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.078Configure Windows Defender SmartScreen is set to Enabled: Warn and prevent bypassCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.079Turn off Data Execution Prevention for Explorer is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.080Turn off heap termination on corruption is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.081Turn off shell protocol protected mode is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.082Block all consumer Microsoft account user authentication is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.083Prevent users from sharing files within their profile. (User) is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.084Do not allow passwords to be saved is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.085Do not allow drive redirection is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.086Always prompt for password upon connection is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.087Require secure RPC communication is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.088Require use of specific security layer for remote (RDP) connections is set to Enabled: SSLCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.089Require user authentication for remote connections by using Network Level Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.090Set client connection encryption level is set to Enabled: High LevelCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.091Do not delete temp folders upon exit is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.092Prevent downloading of enclosures is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.093Turn off the offer to update to the latest version of Windows is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.094Configure the transmission of the user's password in the content of MPR notifications sent by winlogon. is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.095Sign-in and lock last interactive user automatically after a restart is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.096Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.097Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.098Disallow Digest authentication is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.099Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.100Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.101Disallow WinRM from storing RunAs credentials is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.102Account Logon Audit Credential Validation is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.103Account Logon Logoff Audit Account Lockout is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.104Account Logon Logoff Audit Group Membership is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.105Account Logon Logoff Audit Logoff is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.106Account Logon Logoff Audit Logon is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.107Account Management Audit Application Group Management is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.108Audit Authentication Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.109Audit Authorization Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.110Audit Changes to Audit Policy is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.111Audit File Share Access is set to Success+FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.112Audit Other Logon Logoff Events is set to Success+FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.113Audit Security Group Management is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.114Audit Security System Extension is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.115Audit Special Logon is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.116Audit User Account Management is set to Success+FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.117Detailed Tracking Audit PNP Activity is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.118Detailed Tracking Audit Process Creation is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.119Object Access Audit Detailed File Share is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.120Object Access Audit Other Object Access Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.121Object Access Audit Removable Storage is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.122Policy Change Audit MPSSVC Rule Level Policy Change is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.123Policy Change Audit Other Policy Change Events is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.124Privilege Use Audit Sensitive Privilege Use is set to SuccessCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.125System Audit I Psec Driver is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.126System Audit Other System Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.127System Audit Security State Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.128System Audit System Integrity is set to Success+ FailureCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.129Refresh cadence is at most 90Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.130DO Download Mode is not set to HTTP blended with Internet peeringCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.135Allow Cortana is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.136Allow Spotlight Collection (User) is set to 0Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.137Disable Consumer Account State Content is set to Enabled.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.138Do Not Show Feedback Notifications is set to Feedback notifications are disabled.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.162Audit Client Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.163Audit Client Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.164Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.165Auth Rate Limiter Delay In Ms is at least 2000Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.166Enable Auth Rate Limiter is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.167Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.168Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.169Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.170Audit Server Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.171Audit Server Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.172Enable Insecure Guest Logons is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.173Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.174Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.175Require Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.176Accounts Enable Guest Account Status is set to DisableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.177Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.178Accounts Rename Administrator Account is not AdministratorCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.179Accounts Rename Guest Account is not GuestCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.180Interactive Logon Do Not Display Last Signed In is set to Enabled (username will not be shown)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.181Interactive Logon Machine Inactivity Limit is set to 1 to 900 secondsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.182Interactive Logon Message Title For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.183Interactive Logon Message Text For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.184Interactive Logon Smart Card Removal Behavior is set to Lock Workstation, Force Logoff or Disconnect Remote Desktop SessionCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.185Microsoft Network Client Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.186Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers is set to DisableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.187Microsoft Network Server Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.188Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.189Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.190Network Access Restrict Anonymous Access To Named Pipes And Shares is set to EnableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.191Network Access Restrict Clients Allowed To Make Remote Calls To SAM is set to O:BAG:BAD:(A;;RC;;;BA)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.192Network Security Allow Local System To Use Computer Identity For NTLM is set to AllowCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.193Network Security Allow PKU2U Authentication Requests is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.194Network Security LAN Manager Authentication Level is set to Send LM and NTLMv2 responses only. Refuse LM and NTLMCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.195Network Security Minimum Session Security For NTLMSSP Based Clients is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.196Network Security Minimum Session Security For NTLMSSP Based Servers is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.197Network Security Restrict NTLM Audit Incoming NTLM Traffic is set to Enable auditing for all accountsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.198User Account Control Behavior Of The Elevation Prompt For Administrators is set to Prompt for consent or credentials on the secure desktopCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.199User Account Control Behavior Of The Elevation Prompt For Standard Users is set to Automatically deny elevation requestsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.200User Account Control Detect Application Installations And Prompt For Elevation is set to EnableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.201User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations is set to Enabled: Application runs with UIAccess integrity only if it resides in secure location.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.202User Account Control Use Admin Approval Mode is set to EnableCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.203User Account Control Switch To The Secure Desktop When Prompting For Elevation is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.204User Account Control Run All Administrators In Admin Approval Mode is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.205User Account Control Virtualize File And Registry Write Failures To Per User Locations is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.206Configure Lsa Protected Process is set to Enabled with UEFI lock. LSA will run as protected process and this configuration is UEFI locked.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.207Allow apps from the Microsoft app store to auto update is set to Allowed.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.208Allow Game DVR is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.209Block Non Admin User Install is set to AllowCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.210MSI Allow User Control Over Install is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.211MSI Always Install With Elevated Privileges is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.212Allow Input Personalization is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.213Let Apps Activate With Voice Above Lock is set to Force deny. Windows apps cannot be activated by voice while the screen is locked, and users cannot change it.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.214Allow Indexing Encrypted Stores Or Items is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.215Allow Search To Use Location is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.216Notify Malicious is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.217Notify Password Reuse is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.218Notify Unsafe App is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.219Service Enabled is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.220Enable Sudo is set to Sudo is disabled.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.221Allow Telemetry is set to BasicCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.222Enable One Settings Auditing is set to Enabled.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.223Access Credential Manager As Trusted Caller is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.224Access From Network is set to *S-1-5-32-544, *S-1-5-32-555Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.225Act As Part Of The Operating System is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.226Allow Local Log On is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.227Backup Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.228Change System Time is set to *S-1-5-32-544, *S-1-5-19Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.229Create Global Objects is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.230Create Page File is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.231Create Permanent Shared Objects is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.232Create Symbolic Links is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.233Create Token is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.234Debug Programs is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.235Deny Access From Network includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.236Deny Local Log On includes *S-1-5-32-546Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.237Deny Log On As Batch Job includes *S-1-5-32-546Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.238Deny Log On As Service includes *S-1-5-32-546Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.239Deny Remote Desktop Services Log On includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.240Enable Delegation is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.241Generate Security Audits is set to *S-1-5-19, *S-1-5-20, *S-1-5-99Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.242Impersonate Client is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6, *S-1-5-99Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.243Increase Scheduling Priority is set to *S-1-5-32-544, *S-1-5-90-0Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.244Load Unload Device Drivers is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.245Lock Memory is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.246Manage Auditing And Security Log is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.247Manage Volume is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.248Modify Firmware Environment is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.249Modify Object Label is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.250Profile Single Process is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.251Profile System Performance is set to *S-1-5-32-544, *S-1-5-80Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.252Remote Shutdown is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.253Replace Process Level Token is set to *S-1-5-19, *S-1-5-20Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.254Restore Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.255Shut Down The System is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.256Take Ownership is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.259Allow Auto Connect To Wi Fi Sense Hotspots is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.264Allow Windows Ink Workspace is set to Disabled, or enabled but not above the lock screenCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.265Allow Clipboard Redirection is set to Not allowed.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.266Allow Networking is set to Not allowed.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.267Allow Auto Update is not set to Turn off automatic updatesCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.268Defer Feature Updates Period In Days is at least 180Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.269Manage Preview Builds is set to Disable Preview buildsCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.270Scheduled Install Day is set to Every dayCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.271Block "Pause Updates" ability is set to BlockCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.272Require Pin For Pairing is set to Pairing ceremony for new devices will always require a PINCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.299Prevent enabling lock screen slide show is set to EnabledCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.300Config refresh is set to Enabled.Community pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.301Require BitLocker is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.302Require Secure Boot to be enabled on the device is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.303Require code integrity is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.304Firewall is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.305Trusted Platform Module (TPM) is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.306Antivirus is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.JL.CISW11INT.L1.307Antispyware is set to RequireCommunity pack · JL.CISW11INT.L1IntuneMediumMP.LPMS.1001Service principals hold only the Microsoft Graph permissions their activity requiresCommunity pack · LPMSEntra IDMediumMP.LPMS.1004Service principals with Microsoft Graph permissions show activity in the analysis windowCommunity pack · LPMSEntra IDMediumMP.RKS.IA.1003Windows devices are compliantCommunity pack · RKS.IAIntuneMediumMP.RKS.IA.1005The primary user of every Windows device is enabledCommunity pack · RKS.IAIntuneMediumMP.RKS.IA.1007Single-user Autopilot devices are used by one personCommunity pack · RKS.IAIntuneMediumMP.CLT.ADUA.1002All Active Directory users have a job title.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1003All Active Directory users have a department.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1005All Active Directory users have a company name.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1006All Active Directory users have a complete office address.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1007All Active Directory users have a business phone.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1008All Active Directory users have a mobile phone.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1010All Active Directory users have an office location.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1012Active Directory phone numbers use international E.164 format.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1013Active Directory name, job and location attributes have no stray spaces.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1014Active Directory country values use an approved spelling.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1015Active Directory departments are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1016Active Directory job titles are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1017Active Directory company names are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1018Active Directory street addresses are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1019Active Directory cities are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1020Active Directory states or provinces are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1021Active Directory postal codes are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1022Active Directory business phone numbers are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1023Active Directory user addresses match an approved office location.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1024All Active Directory users have the extension attributes your organisation requires.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.ADUA.1025Active Directory extension attribute values are on the approved list.Community pack · CLT.ADUAActive DirectoryLowMP.CLT.UA.1003All member users have a job title.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1004All member users have a department.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1007All member users have a company name.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1008All member users have a complete office address.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1011User phone numbers use international E.164 format.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1012User name, job and location attributes have no stray spaces.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1013User country values use an approved spelling.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1014All member users have a business phone.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1015All member users have a mobile phone.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1017All member users have an office location.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1018User departments are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1019User job titles are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1020User company names are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1021User street addresses are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1022User cities are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1023User states or provinces are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1024User postal codes are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1025User business phone numbers are on the approved list.Community pack · CLT.UAEntra IDLowMP.CLT.UA.1026User addresses match an approved office location.Community pack · CLT.UAEntra IDLowMP.LPMS.1002All Microsoft Graph activity of service principals matches a known endpointCommunity pack · LPMSEntra IDLowMP.LPMS.1003Service principals are not throttled at Warning or Critical level by Microsoft GraphCommunity pack · LPMSEntra IDLowMP.RKS.IA.1004Windows devices have checked in with Intune recentlyCommunity pack · RKS.IAIntuneLowMP.RKS.IA.1006Windows devices are registered in Windows AutopilotCommunity pack · RKS.IAIntuneLowMP.RKS.IA.1008Settings Catalog policies use no deprecated settingsCommunity pack · RKS.IAIntuneLowMP.CLT.ADUA.1009All Active Directory users have a fax number.Community pack · CLT.ADUAActive DirectoryInfoMP.CLT.UA.1016All member users have a fax number.Community pack · CLT.UAEntra IDInfoMP.JL.CISW11INT.L1.279Computer Browser (Browser) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.280IIS Admin Service (IISADMIN) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.281Infrared monitor service (irmon) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.282LxssManager (LxssManager) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.283Microsoft FTP Service (FTPSVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.284OpenSSH SSH Server (sshd) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.285Remote Procedure Call (RPC) Locator (RpcLocator) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.286Routing and Remote Access (RemoteAccess) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.287Simple TCP/IP Services (simptcp) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.288Special Administration Console Helper (sacsvr) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.289SSDP Discovery (SSDPSRV) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.290UPnP Device Host (upnphost) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.291Web Management Service (WMSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.292Windows Media Player Network Sharing Service (WMPNetworkSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.293Windows Mobile Hotspot Service (icssvc) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.294World Wide Web Publishing Service (W3SVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.295Xbox Accessory Management Service (XboxGipSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.296Xbox Live Auth Manager (XblAuthManager) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.297Xbox Live Game Save (XblGameSave) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.JL.CISW11INT.L1.298Xbox Live Networking Service (XboxNetApiSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1IntuneInfoMP.LPMS.1005Least Privileged MSGraph permission analysis reportCommunity pack · LPMSEntra IDInfo