CISA Tests
These tests verify Microsoft 365 tenant configuration against CISA Secure Cloud Business Applications baseline guidance.
76 checks31 High44 Medium1 Low
Run these
Invoke-Maester -Suite cisaCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.
Entra IDHighCISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDHighCISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDHighCISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDHighCISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDHighCISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDHighCISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDHighCISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDHighCISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDHighCISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDHighCISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDHighCISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.
Exchange OnlineHighCISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineHighCISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineHighCISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineHighCISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineHighCISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineHighCISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineHighCISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineHighCISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineHighCISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineHighCISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineHighCISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineHighCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDMediumCISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDMediumCISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDMediumCISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDMediumCISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDMediumCISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDMediumCISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDMediumCISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDMediumCISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDMediumCISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDMediumCISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDMediumCISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineMediumCISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineMediumCISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineMediumCISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineMediumCISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMediumCISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineMediumCISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineMediumCISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineMediumCISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineMediumCISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineMediumCISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineMediumCISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineMediumCISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineMediumCISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineMediumCISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineMediumCISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineMediumCISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineMediumCISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
SharePointMediumCISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointMediumCISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointMediumCISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointMediumCISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointMediumCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDLow
Entra IDHighCISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDHighCISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDHighCISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDHighCISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDHighCISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDHighCISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDHighCISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDHighCISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDHighCISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDHighCISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDHighCISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineHighCISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineHighCISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineHighCISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineHighCISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineHighCISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineHighCISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineHighCISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineHighCISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineHighCISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineHighCISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineHighCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDMediumCISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDMediumCISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDMediumCISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDMediumCISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDMediumCISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDMediumCISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDMediumCISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDMediumCISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDMediumCISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDMediumCISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDMediumCISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineMediumCISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineMediumCISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineMediumCISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineMediumCISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMediumCISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineMediumCISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineMediumCISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineMediumCISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineMediumCISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineMediumCISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineMediumCISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineMediumCISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineMediumCISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineMediumCISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineMediumCISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineMediumCISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineMediumCISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointMediumCISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointMediumCISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointMediumCISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointMediumCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDLowNo checks match.