CISA SCuBA Secure Configuration Baselines for Microsoft 365
Version ScubaGear main, 2026-10-11. The framework. A check that names a requirement in its Control attribute supports it; it does not make the tenant compliant.
76 of 79 requirements have a Maester check. 3 have none yet: a place to contribute, or a requirement that cannot be checked from a tenant.
Run these
Invoke-Maester -Suite cisaMS.AAD · Entra ID29 of 30
MS.AAD.2.2SHOULDA notification SHOULD be sent to the administrator when high-risk users are detected. CISA.MS.AAD.2.2Has a check
MS.AAD.3.2SHALLIf phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. CISA.MS.AAD.3.2Has a check
MS.AAD.3.3SHALLIf Microsoft Authenticator is enabled, it SHALL be configured to show login context information. CISA.MS.AAD.3.3Has a check
MS.AAD.3.4SHALLThe Authentication Methods Manage Migration feature SHALL be set to Migration Complete. CISA.MS.AAD.3.4Has a check
MS.AAD.3.5SHALLThe authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled. CISA.MS.AAD.3.5Has a check
MS.AAD.3.6SHALLPhishing-resistant MFA SHALL be required for highly privileged roles. CISA.MS.AAD.3.6Has a check
MS.AAD.4.1SHALLSecurity logs SHALL be sent to the agency's security operations center for monitoring. CISA.MS.AAD.4.1Has a check
MS.AAD.5.1SHALLOnly administrators SHALL be allowed to register applications. CISA.MS.AAD.5.1Has a check
MS.AAD.5.2SHALLOnly administrators SHALL be allowed to consent to applications. CISA.MS.AAD.5.2Has a check
MS.AAD.5.3SHALLAn admin consent workflow SHALL be configured for applications. CISA.MS.AAD.5.3Has a check
MS.AAD.5.4SHALLNo Maester check yetNo check
MS.AAD.7.1SHALLA minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. CISA.MS.AAD.7.1Has a check
MS.AAD.7.2SHALLPrivileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. CISA.MS.AAD.7.2Has a check
MS.AAD.7.3SHALLPrivileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. CISA.MS.AAD.7.3Has a check
MS.AAD.7.4SHALLPermanent active role assignments SHALL NOT be allowed for highly privileged roles. CISA.MS.AAD.7.4Has a check
MS.AAD.7.5SHALLProvisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. CISA.MS.AAD.7.5Has a check
MS.AAD.7.6SHALLActivation of the Global Administrator role SHALL require approval. CISA.MS.AAD.7.6Has a check
MS.AAD.7.7SHALLEligible and Active highly privileged role assignments SHALL trigger an alert. CISA.MS.AAD.7.7Has a check
MS.AAD.7.8SHALLUser activation of the Global Administrator role SHALL trigger an alert. CISA.MS.AAD.7.8Has a check
MS.AAD.7.9SHOULDUser activation of other highly privileged roles SHOULD trigger an alert. CISA.MS.AAD.7.9Has a check
MS.AAD.8.1SHOULDGuest users SHOULD have limited or restricted access to Entra ID directory objects. CISA.MS.AAD.8.1Has a check
MS.AAD.8.2SHOULDOnly users with the Guest Inviter role SHOULD be able to invite guest users. CISA.MS.AAD.8.2Has a check
MS.EXO · Exchange Online39 of 41
MS.EXO.1.1SHALLAutomatic forwarding to external domains SHALL be disabled. CISA.MS.EXO.1.1Has a check
MS.EXO.2.1SHALLNo Maester check yetNo check
MS.EXO.2.2SHALLAn SPF policy SHALL be published for each domain, designating only these addresses as approved senders. CISA.MS.EXO.2.2Has a check
MS.EXO.4.1SHALLA DMARC policy SHALL be published for every second-level domain. CISA.MS.EXO.4.1Has a check
MS.EXO.4.3SHALLThe DMARC point of contact for aggregate reports SHALL include [email protected]. CISA.MS.EXO.4.3Has a check
MS.EXO.8.2SHALLThe DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency. CISA.MS.EXO.8.2Has a check
MS.EXO.8.3SHOULDThe selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft. CISA.MS.EXO.8.3Has a check
MS.EXO.8.4SHALLAt a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email. CISA.MS.EXO.8.4Has a check
MS.EXO.9.2SHOULDThe attachment filter SHOULD attempt to determine the true file type and assess the file extension. CISA.MS.EXO.9.2Has a check
MS.EXO.9.4SHOULDAlternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter. CISA.MS.EXO.9.4Has a check
MS.EXO.9.5SHOULDAt a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe). CISA.MS.EXO.9.5Has a check
MS.EXO.10.2SHALLEmails identified as containing malware SHALL be quarantined or dropped. CISA.MS.EXO.10.2Has a check
MS.EXO.10.3SHALLEmail scanning SHALL be capable of reviewing emails after delivery. CISA.MS.EXO.10.3Has a check
MS.EXO.11.2SHOULDUser warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. CISA.MS.EXO.11.2Has a check
MS.EXO.11.3SHOULDThe phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. CISA.MS.EXO.11.3Has a check
MS.EXO.14.2SHALLSpam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. CISA.MS.EXO.14.2Has a check
MS.EXO.14.3SHALLAllowed domains SHALL NOT be added to inbound anti-spam protection policies. CISA.MS.EXO.14.3Has a check
MS.EXO.14.4SHOULDIf a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. CISA.MS.EXO.14.4Has a check
MS.EXO.16.2SHOULDAlerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. CISA.MS.EXO.16.2Has a check
MS.EXO.17.1SHALLMicrosoft Purview Audit (Standard) logging SHALL be enabled. CISA.MS.EXO.17.1Has a check
MS.EXO.17.2SHALLNo Maester check yetNo check
MS.SHAREPOINT · SharePoint8 of 8
MS.SHAREPOINT.1.1SHALLExternal sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.1Has a check
MS.SHAREPOINT.1.2SHALLExternal sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.2Has a check
MS.SHAREPOINT.1.3SHALLExternal sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. CISA.MS.SHAREPOINT.1.3Has a check
MS.SHAREPOINT.2.1SHALLFile and folder default sharing scope SHALL be set to Specific People. CISA.MS.SHAREPOINT.2.1Has a check
MS.SHAREPOINT.2.2SHALLFile and folder default sharing permissions SHALL be set to View only. CISA.MS.SHAREPOINT.2.2Has a check
MS.SHAREPOINT.3.1SHALLExpiration days for Anyone links SHALL be set to 30 days or less. CISA.MS.SHAREPOINT.3.1Has a check
MS.SHAREPOINT.3.2SHALLAllowable file and folder permissions for Anyone links SHALL be set to View only. CISA.MS.SHAREPOINT.3.2Has a check
MS.SHAREPOINT.3.3SHALLReauthentication days for people who use a verification code SHALL be set to 30 days or less. CISA.MS.SHAREPOINT.3.3Has a check