DISA Microsoft Entra ID STIG

Version V1R2. The framework. A check that names a requirement in its Control attribute supports it; it does not make the tenant compliant.

10 of 10 requirements have a Maester check.

Run theseInvoke-Maester -Suite disa

CAT II9 of 9

V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity. DISA.V-270200Has a check

V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity. DISA.V-270204Has a check

V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period. DISA.V-270208Has a check

V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application. DISA.V-270209Has a check

V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting. DISA.V-270227Has a check

V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction. DISA.V-270239Has a check

V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested. DISA.V-270255Has a check

V-270335Microsoft Entra ID must use Privileged Identity Management (PIM). DISA.V-270335Has a check

V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords. DISA.V-270475Has a check

CAT I1 of 1

V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA). DISA.V-270233Has a check