CIS Microsoft 365 Foundations Benchmark
Version 7.0.0. The framework. A check that names a requirement in its Control attribute supports it; it does not make the tenant compliant.
144 of 144 requirements have a Maester check.
Run these
Invoke-Maester -Suite cis1 · Microsoft 365 admin center13 of 13
1.1.4L1Ensure administrative accounts use licenses with a reduced application footprint CIS.M365.1.1.4Has a check
1.2.1L2Ensure that only organizationally managed/approved public groups exist CIS.M365.1.2.1Has a check
1.3.1L1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' CIS.M365.1.3.1Has a check
1.3.2L2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices CIS.M365.1.3.2Has a check
2 · Microsoft 365 Defender18 of 18
2.1.1L2Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) CIS.M365.2.1.1Has a check
2.1.2L1Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) CIS.M365.2.1.2Has a check
2.1.5L2Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled CIS.M365.2.1.5Has a check
2.1.6L1Ensure Exchange Online Spam Policies are set to notify administrators CIS.M365.2.1.6Has a check
2.1.10L1Ensure DMARC records for all Exchange Online domains are published CIS.M365.2.1.10Has a check
2.1.12L1Ensure the connection filter IP allow list is not used (Only Checks Default Policy) CIS.M365.2.1.12Has a check
2.1.13L1Ensure the connection filter safe list is off (Only Checks Default Policy) CIS.M365.2.1.13Has a check
3 · Microsoft Purview5 of 5
4 · Microsoft Intune2 of 2
5 · Microsoft Entra admin center52 of 52
5.1.2.3L1Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' CIS.M365.5.1.2.3Has a check
5.1.3.4L2Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' CIS.M365.5.1.3.4Has a check
5.1.4.3L1Ensure the GA role is not added as a local administrator during Entra join CIS.M365.5.1.4.3Has a check
5.1.4.4L1Ensure local administrator assignment is limited during Entra join CIS.M365.5.1.4.4Has a check
5.1.5.1L2Ensure user consent to apps accessing company data on their behalf is not allowed CIS.M365.5.1.5.1Has a check
5.1.5.4L1Ensure password lifetime for applications does not exceed 180 days CIS.M365.5.1.5.4Has a check
5.1.5.6L1Ensure maximum certificate lifetime for applications does not exceed 180 days CIS.M365.5.1.5.6Has a check
5.1.6.1L2Ensure that collaboration invitations are sent to allowed domains only CIS.M365.5.1.6.1Has a check
5.1.8.1L1Ensure that password hash sync is enabled for hybrid deployments CIS.M365.5.1.8.1Has a check
5.2.2.1L1Ensure multifactor authentication is enabled for all users in administrative roles CIS.M365.5.2.2.1Has a check
5.2.2.3L1Enable Conditional Access policies to block legacy authentication CIS.M365.5.2.2.3Has a check
5.2.2.4L1Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users CIS.M365.5.2.2.4Has a check
5.2.2.5L2Ensure 'Phishing-resistant MFA strength' is required for Administrators CIS.M365.5.2.2.5Has a check
5.2.2.10L1Ensure a managed device is required to register security information CIS.M365.5.2.2.10Has a check
5.2.2.11L1Ensure sign-in frequency for Intune Enrollment is set to 'Every time' CIS.M365.5.2.2.11Has a check
5.2.2.13L1Ensure that periodic reauthentication is required for all users CIS.M365.5.2.2.13Has a check
5.2.3.1L1Ensure Microsoft Authenticator is configured to protect against MFA fatigue CIS.M365.5.2.3.1Has a check
5.2.3.3L1Ensure password protection is enabled for on-prem Active Directory CIS.M365.5.2.3.3Has a check
5.2.3.9L1Ensure that Account 'Lockout duration in seconds' is at least 60 seconds CIS.M365.5.2.3.9Has a check
5.2.3.10L1Ensure Microsoft Authenticator on companion applications is disabled CIS.M365.5.2.3.10Has a check
6 · Exchange admin center13 of 13
6.3.2L1Ensure the ability to add personal email accounts and calendars is disabled CIS.M365.6.3.2Has a check
7 · SharePoint admin center12 of 12
7.2.1L1Ensure modern authentication for SharePoint applications is required CIS.M365.7.2.1Has a check
7.2.2L1Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled CIS.M365.7.2.2Has a check
7.2.5L2Ensure that SharePoint guest users cannot share items they don't own CIS.M365.7.2.5Has a check
7.2.6L2Ensure SharePoint external sharing is managed through domain whitelist/blacklists CIS.M365.7.2.6Has a check
8 · Microsoft Teams admin center17 of 17
8.1.1L2Ensure external file sharing in Teams is enabled for only approved cloud storage services CIS.M365.8.1.1Has a check