DISA STIG Tests
These tests verify Microsoft 365 tenant configuration against the Security Technical Implementation Guides (STIGs) that the US Defense Information Systems Agency (DISA) publishes for Microsoft Entra ID, the Intune MDM service (desktop and mobile) and the Intune service (desktop). Each test is named after the STIG rule it checks: DISA.V-270233 checks rule V-270233. Where another suite already checks the same setting, the DISA test runs that test with DISA’s values. Rules that need a person to confirm a process, such as alerting the ISSO when accounts change, have no test. Some rules are DoD-specific, such as the DoD Notice and Consent Banner, and fail outside DoD by design.
19 checks6 High10 Medium3 Low
Run these
Invoke-Maester -Suite disaDISA.V-267334Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0
IntuneHighDISA.V-267341Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts.New in 3.0
Entra IDHighDISA.V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.New in 3.0Entra IDHighDISA.V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA).New in 3.0Entra IDHighDISA.V-270335Microsoft Entra ID must use Privileged Identity Management (PIM).New in 3.0Entra IDHighDISA.V-273868Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneHighDISA.V-267303Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreview
Microsoft 365MediumDISA.V-267309Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-267314Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords.New in 3.0Entra IDMediumDISA.V-273867Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-285327The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.New in 3.0IntuneMediumDISA.V-267355Microsoft Intune service must enforce a 60-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365LowDISA.V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.New in 3.0-IncludePreviewEntra IDLowDISA.V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365Low
IntuneHighDISA.V-267341Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts.New in 3.0Entra IDHighDISA.V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.New in 3.0Entra IDHighDISA.V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA).New in 3.0Entra IDHighDISA.V-270335Microsoft Entra ID must use Privileged Identity Management (PIM).New in 3.0Entra IDHighDISA.V-273868Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneHighDISA.V-267303Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-267309Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-267314Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.New in 3.0Entra IDMediumDISA.V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.New in 3.0-IncludePreviewEntra IDMediumDISA.V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords.New in 3.0Entra IDMediumDISA.V-273867Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365MediumDISA.V-285327The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.New in 3.0IntuneMediumDISA.V-267355Microsoft Intune service must enforce a 60-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365LowDISA.V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.New in 3.0-IncludePreviewEntra IDLowDISA.V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365LowNo checks match.