NIST SP 800-53 Rev. 5
Version 5.2.0. The framework. A check that names a requirement in its Control attribute supports it; it does not make the tenant compliant.
75 controls have a Maester check, with 522 checks in all. Only those are listed.
Access Control28 of 28
AC-2Account ManagementPermanent active role assignments SHALL NOT be allowed for highly privileged roles. CISA.MS.AAD.7.4Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. CISA.MS.AAD.7.5Ensure that no person has permanent access to all Azure subscriptions at the root scope MT.1056Ensure sign-in to shared mailboxes is blocked CIS.M365.1.2.2Ensure guest user invitations are limited CIS.M365.5.1.6.3Ensure 'Access reviews' for guest users are configured CIS.M365.5.3.2Restrict external guest invitations through Fabric CIS.M365.9.1.2External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.1External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.2Default Authorization Settings - User can join the tenant by email validation. EIDSCA.AP06Privileged user accounts should not remain enabled when the linked primary account is disabled. MT.1112Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview). MT.1204Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview). MT.1205High privileged user should be linked to an identity. MT.1111Has a check
AC-2(1)Account Management | Automated System Account ManagementEligible and Active highly privileged role assignments SHALL trigger an alert. CISA.MS.AAD.7.7Has a check
AC-2(2)Account Management | Automated Temporary and Emergency Account ManagementEnsure guest access to a site or OneDrive will expire automatically CIS.M365.7.2.9Has a check
AC-2(3)Account Management | Disable AccountsStale accounts are not assigned to privileged roles. MT.1029Eligible role assignments on Control Plane are in use by administrators. MT.1030No enabled computers should be stale beyond the configured threshold AD-DCOMP-06Privileged access to systems and their resources is disabled after 45 days of inactivity. ASD.ISM-1648Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview). MT.1206Dormant enabled user count should be retrievable AD-USER-02Has a check
AC-2(7)Account Management | Privileged User AccountsJust-in-time administration is used for the administration of systems and their resources. ASD.ISM-1649No external user with permanent role assignment on Control Plane. MT.1025No hybrid user with permanent role assignment on Control Plane. MT.1026Privileged role on Control Plane are managed by PIM only. MT.1031Has a check
AC-2(11)Account Management | Usage ConditionsAt least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins. MT.1014Conditional Access policies should not use the deprecated Approved Client App grant. MT.1072At least one Conditional Access policy is configured with device compliance. MT.1001At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms. MT.1015Has a check
AC-2(12)Account Management | Account Monitoring for Atypical UsageUsers detected as high risk SHALL be blocked. CISA.MS.AAD.2.1Sign-ins detected as high risk SHALL be blocked. CISA.MS.AAD.2.3Conditional Access policies for User Risk and Sign-in Risk should be configured separately. MT.1049Conditional Access policy is present that blocks high agent risk sign-ins. MT.1181Enable Identity Protection user risk policies CIS.M365.5.2.2.6Enable Identity Protection sign-in risk policies CIS.M365.5.2.2.7Ensure 'sign-in risk' is blocked for medium and high risk CIS.M365.5.2.2.8A notification SHOULD be sent to the administrator when high-risk users are detected. CISA.MS.AAD.2.2At least one Conditional Access policy is configured to require MFA for risky sign-ins. MT.1012At least one Conditional Access policy is configured to require new password when user risk is high. MT.1013High-risk users should not be left unremediated in Entra ID Protection. MT.1260Has a check
AC-2(13)Account Management | Disable Accounts for High-risk IndividualsUsers detected as high risk SHALL be blocked. CISA.MS.AAD.2.1Sign-ins detected as high risk SHALL be blocked. CISA.MS.AAD.2.3Conditional Access policy is present that blocks high agent risk sign-ins. MT.1181Has a check
AC-3Access EnforcementRestrict public projects. AZDO.1003Protect access to repositories in YAML pipelines. AZDO.1018Ensure strict base permissions are set for repositories CIS.GH.1.3.8All security groups assigned to Conditional Access Policies should be protected by RMAU. MT.1035Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups MT.1103AI agents should not be shared with broad access control policies. MT.1113External Users access. AZDO.1006Ensure that only organizationally managed/approved public groups exist CIS.M365.1.2.1Ensure 'External sharing' of calendars is not available CIS.M365.1.3.3Ensure exclusionary geographic access controls are utilized CIS.M365.5.2.2.15Ensure that SharePoint guest users cannot share items they don't own CIS.M365.7.2.5Ensure link sharing is restricted in SharePoint and OneDrive CIS.M365.7.2.7Ensure anonymous users can't join a meeting CIS.M365.8.5.1Ensure anonymous users and dial-in callers can't start a meeting CIS.M365.8.5.2Ensure only people in my org can bypass the lobby CIS.M365.8.5.3Ensure users dialing in can't bypass the lobby CIS.M365.8.5.4Ensure meeting chat does not allow anonymous users CIS.M365.8.5.5Ensure external participants can't give or request control CIS.M365.8.5.7Ensure external meeting chat is off CIS.M365.8.5.8Restrict guest access to Fabric CIS.M365.9.1.1Restrict service principal access to Fabric public APIs CIS.M365.9.1.10Restrict service principal profiles in Fabric CIS.M365.9.1.11Restrict service principal access to Fabric global APIs CIS.M365.9.1.12Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. CISA.MS.AAD.8.3Contact folders SHALL NOT be shared with all domains. CISA.MS.EXO.6.1Calendar details SHALL NOT be shared with all domains. CISA.MS.EXO.6.2External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.1External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.2External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. CISA.MS.SHAREPOINT.1.3Expiration days for Anyone links SHALL be set to 30 days or less. CISA.MS.SHAREPOINT.3.1Restrict dial-in users from bypassing a meeting lobby MT.1042Only invited users should be automatically admitted to Teams meetings MT.1045Restrict anonymous users from joining meetings MT.1046Restrict anonymous users from starting Teams meetings MT.1047Exchange application access policies must be configured. MT.1058At least one Conditional Access policy explicitly includes Azure DevOps. MT.1071Require explicit assignment of Third Party Entra Apps. MT.1075Require explicit assignment of high-privilege first-party Entra Apps. MT.1186Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview). MT.1212Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID. MT.1252Ensure shared bookings pages are restricted to select users CIS.M365.1.3.9Ensure trusted 'named locations' are defined CIS.M365.5.2.2.14Ensure only organizers and co-organizers can present CIS.M365.8.5.6Restrict guest browsing of Fabric content CIS.M365.9.1.3Restrict organization-wide Fabric links CIS.M365.9.1.7Default Authorization Settings - Default User Role Permissions - Allowed to read other users. EIDSCA.AP14Has a check
AC-3(2)Access Enforcement | Dual AuthorizationEnsure at least one Intune Multi Admin Approval policy is configured MT.1096Has a check
AC-4Information Flow EnforcementNo trusts should lack SID filtering (quarantine) AD-TRUST-04Ensure all forms of mail forwarding are blocked and/or disabled CIS.M365.6.2.1Automatic forwarding to external domains SHALL be disabled. CISA.MS.EXO.1.1AI agents should not send email with AI-controlled inputs. MT.1116Ensure the connection filter IP allow list is not used (Only Checks Default Policy) CIS.M365.2.1.12Ensure the connection filter safe list is off (Only Checks Default Policy) CIS.M365.2.1.13Ensure outbound anti-spam message limits are in place (Default policy only) CIS.M365.2.1.15Ensure DLP policies are enabled CIS.M365.3.2.1Ensure DLP policies are enabled for Microsoft Teams CIS.M365.3.2.2Ensure DLP policies are published for Copilot users CIS.M365.3.2.3IP allow lists SHOULD NOT be created. CISA.MS.EXO.12.1Safe lists SHOULD NOT be enabled. CISA.MS.EXO.12.2Subscriptions should be blocked from leaving and entering the tenant MT.1227Ensure iOS app protection policy keeps organization data inside managed apps. MT.1239Ensure Android app protection policy keeps organization data inside managed apps. MT.1245No IP Allow Lists have been configured. ORCA.114Ensure Information Protection sensitivity label policies are published CIS.M365.3.3.1Ensure MailTips are enabled for end users CIS.M365.6.5.2Ensure Android app protection policy blocks screen capture of organization data. MT.1250Has a check
AC-5Separation of DutiesPrivileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. CISA.MS.AAD.7.2Ensure approval is required for Global Administrator role activation CIS.M365.5.3.4Ensure approval is required for Privileged Role Administrator activation CIS.M365.5.3.5Has a check
AC-6Least PrivilegeNon-DC computers should not have unconstrained delegation AD-DCOMP-02No users should be configured for unconstrained delegation AD-USER-29Limit job authorization scope to current project for non-release pipelines. AZDO.1016Limit job authorization scope to current project for classic release pipelines. AZDO.1017Protect access to repositories in YAML pipelines. AZDO.1018(Tenant) Restrict Personal Access Token full scope. AZDO.1036Ensure repository deletion is limited to specific users CIS.GH.1.2.3Ensure strict base permissions are set for repositories CIS.GH.1.3.8Eligible role assignments on Control Plane are in use by administrators. MT.1030All security groups assigned to Conditional Access Policies should be protected by RMAU. MT.1035Apps with high-risk permissions having a direct path to Global Administrator MT.1050Apps with high-risk permissions having an indirect path to Global Administrator MT.1051All App registration owners should have MFA registered MT.1063Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups MT.1103Do not sync krbtgt_AzureAD to Entra ID. MT.1147Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview). MT.1207Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview). MT.1211Agent Identities should not have high-risk Microsoft Graph permissions (Preview). MT.1223Ensure repository creation is limited to specific members CIS.GH.1.2.2Ensure issue deletion is limited to specific users CIS.GH.1.2.4Ensure team creation is limited to specific members CIS.GH.1.3.2Ensure the GA role is not added as a local administrator during Entra join CIS.M365.5.1.4.3Ensure local administrator assignment is limited during Entra join CIS.M365.5.1.4.4Ensure that guest user access is restricted CIS.M365.5.1.6.2Ensure link sharing is restricted in SharePoint and OneDrive CIS.M365.7.2.7Ensure the SharePoint default sharing link permission is set CIS.M365.7.2.11Guest users SHOULD have limited or restricted access to Entra ID directory objects. CISA.MS.AAD.8.1File and folder default sharing scope SHALL be set to Specific People. CISA.MS.SHAREPOINT.2.1File and folder default sharing permissions SHALL be set to View only. CISA.MS.SHAREPOINT.2.2Allowable file and folder permissions for Anyone links SHALL be set to View only. CISA.MS.SHAREPOINT.3.2Default Authorization Settings - Guest user access. EIDSCA.AP07Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants. EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints. EIDSCA.AP15Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. EIDSCA.ST08Limit external participants from having control in a Teams meeting MT.1048Exchange application access policies must be configured. MT.1058Ensure that write permissions are required to create new management groups MT.1064Restrict non-admin users from creating tenants. MT.1068Restrict device join to selected users/groups or none. MT.1070Require explicit assignment of Third Party Entra Apps. MT.1075App registrations with privileged API permissions should not have owners. MT.1077App registrations with highly privileged directory roles should not have owners. MT.1078Privileged API permissions on service principals should not remain unused. MT.1079Global Administrator role should not be added as local administrator on the device during Microsoft Entra join MT.1090Registering user should not be added as local administrator on the device during Microsoft Entra join MT.1091AI agents should not use author (maker) authentication for connections. MT.1118Require explicit assignment of high-privilege first-party Entra Apps. MT.1186Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview). MT.1212Users should not be able to create Agent Identity Blueprints. MT.1225Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID. MT.1252Ensure users cannot create security groups CIS.M365.5.1.3.1Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' CIS.M365.5.1.3.4Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. EIDSCA.ST09Only users with Presenter role are allowed to present in Teams meetings MT.1037Microsoft 365 Group (and Team) creation should be restricted to approved users. MT.1055Restrict non-admin users from creating security groups. MT.1069Has a check
AC-6(1)Least Privilege | Authorize Access to Security FunctionsActivation of the Global Administrator role SHALL require approval. CISA.MS.AAD.7.6Has a check
AC-6(2)Least Privilege | Non-privileged Access for Nonsecurity FunctionsPrivileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. ASD.ISM-1175No user with mailbox and permanent role assignment on Control Plane. MT.1028LAPS should be installed in Active Directory AD-SCH-05Has a check
AC-6(5)Least Privilege | Privileged AccountsNo domain admin accounts should have SPNs configured AD-SPN-12No domain admin accounts should have SPNs configured AD-SPN-13Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services. ASD.ISM-1175Just-in-time administration is used for the administration of systems and their resources. ASD.ISM-1649Project Collection Administrators. AZDO.1030Ensure Administrative accounts are cloud-only CIS.M365.1.1.1Ensure that between two and four global admins are designated CIS.M365.1.1.3Ensure privileged role assignments are activated and not assigned CIS.M365.5.3.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. CISA.MS.AAD.7.1Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. CISA.MS.AAD.7.3No external user with permanent role assignment on Control Plane. MT.1025No hybrid user with permanent role assignment on Control Plane. MT.1026No Service Principal with Client Secret and permanent role assignment on Control Plane. MT.1027No user with mailbox and permanent role assignment on Control Plane. MT.1028Stale accounts are not assigned to privileged roles. MT.1029Privileged role on Control Plane are managed by PIM only. MT.1031Limited number of Global Admins are assigned. MT.1032Ensure that no person has permanent access to all Azure subscriptions at the root scope MT.1056Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview). MT.1209Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview). MT.1210Ensure administrative accounts use licenses with a reduced application footprint CIS.M365.1.1.4Hybrid users should not be assigned Entra ID role assignments. MT.1081Has a check
AC-6(7)Least Privilege | Review of User PrivilegesEnsure 'Access reviews' for privileged roles are configured CIS.M365.5.3.3Has a check
AC-6(9)Least Privilege | Log Use of Privileged FunctionsUser activation of the Global Administrator role SHALL trigger an alert. CISA.MS.AAD.7.8User activation of other highly privileged roles SHOULD trigger an alert. CISA.MS.AAD.7.9Has a check
AC-6(10)Least Privilege | Prohibit Non-privileged Users from Executing Privileged FunctionsEnsure user consent to apps accessing company data on their behalf is not allowed CIS.M365.5.1.5.1Only administrators SHALL be allowed to consent to applications. CISA.MS.AAD.5.2Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline. EIDSCA.AP08Default Authorization Settings - Allow user consent on risk-based apps. EIDSCA.AP09Default Settings - Consent Policy Settings - Group owner consent for apps accessing data. EIDSCA.CP01Default Settings - Consent Policy Settings - Block user consent for risky apps. EIDSCA.CP03Ensure users cannot register applications CIS.M365.5.1.2.2Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' CIS.M365.5.1.2.3Ensure users are restricted from recovering BitLocker keys CIS.M365.5.1.4.6Only administrators SHALL be allowed to register applications. CISA.MS.AAD.5.1Only users with the Guest Inviter role SHOULD be able to invite guest users. CISA.MS.AAD.8.2External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. CISA.MS.SHAREPOINT.1.3Default Authorization Settings - Guest invite restrictions. EIDSCA.AP04Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. EIDSCA.AP10Has a check
AC-7Unsuccessful Logon AttemptsUser accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts. ASD.ISM-1403Ensure that Account 'Lockout threshold' is '10' or less CIS.M365.5.2.3.8Ensure that Account 'Lockout duration in seconds' is at least 60 seconds CIS.M365.5.2.3.9Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold. EIDSCA.PR06Has a check
AC-11Device LockEnsure iOS compliance policy requires a strong device passcode. MT.1229Ensure Android compliance policy requires a strong device password. MT.1233Has a check
AC-12Session TerminationEnsure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices CIS.M365.1.3.2Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users CIS.M365.5.2.2.4Ensure that periodic reauthentication is required for all users CIS.M365.5.2.2.13At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices. MT.1017At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices. MT.1018Ensure iOS app protection policy limits offline access to organization data. MT.1242Ensure Android app protection policy limits offline access to organization data. MT.1248Has a check
AC-16Security and Privacy AttributesEnable sensitivity labels for Fabric content CIS.M365.9.1.6Sensitivity labels are published for files used by Microsoft 365 Copilot. MT.1173Has a check
AC-17Remote AccessIP Conditional Access policy validation. AZDO.1005At least one Conditional Access policy is configured to secure security info registration only from a trusted location. MT.1011Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device. MT.1188Entra Private Access application segments should avoid broad or risky destinations. MT.1193Has a check
AC-19Access Control for Mobile DevicesEnsure devices without a compliance policy are marked 'not compliant' CIS.M365.4.1Ensure device enrollment for personally owned devices is blocked by default CIS.M365.4.2At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices. MT.1017Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant' MT.1054Ensure macOS compliance policy requires a Defender machine risk score level. MT.1216Ensure iOS compliance policy blocks jailbroken devices. MT.1228Ensure iOS compliance policy requires a Defender machine risk score level. MT.1231Ensure Android compliance policy blocks rooted devices. MT.1232Ensure Android compliance policy requires device threat protection. MT.1235Ensure iOS app protection policy requires a strong app PIN. MT.1238Ensure iOS app protection policy keeps organization data inside managed apps. MT.1239Ensure iOS app protection policy encrypts organization data. MT.1240Ensure iOS app protection policy acts on the device threat level. MT.1243Ensure Android app protection policy requires a strong app PIN. MT.1244Ensure Android app protection policy keeps organization data inside managed apps. MT.1245Ensure Android app protection policy encrypts organization data. MT.1246Ensure Android app protection policy acts on the device threat level. MT.1249Ensure Android app protection policy requires Play Integrity device attestation. MT.1251Ensure Android compliance policy blocks devices managed with device administrator. MT.1237Ensure iOS app protection policy requires a minimum OS and app version. MT.1241Ensure iOS app protection policy limits offline access to organization data. MT.1242Ensure Android app protection policy requires a minimum OS and app version. MT.1247Ensure Android app protection policy limits offline access to organization data. MT.1248Ensure Android app protection policy blocks screen capture of organization data. MT.1250Has a check
AC-20Use of External SystemsAt least one Conditional Access policy is configured to require MFA for guest access. MT.1016Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview). MT.1207Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web' CIS.M365.1.3.7Ensure that collaboration invitations are sent to allowed domains only CIS.M365.5.1.6.1Ensure additional storage providers are restricted in Outlook on the web CIS.M365.6.5.3Ensure external file sharing in Teams is enabled for only approved cloud storage services CIS.M365.8.1.1Ensure users can't send emails to a channel email address CIS.M365.8.1.2Ensure external domains are restricted in the Teams admin center CIS.M365.8.2.1Ensure communication with unmanaged Teams users is disabled CIS.M365.8.2.2Ensure external Teams users cannot initiate conversations CIS.M365.8.2.3Ensure the organization cannot communicate with accounts in trial Teams tenants CIS.M365.8.2.4Ensure the ability to add personal email accounts and calendars is disabled CIS.M365.6.3.2Has a check
AC-21Information SharingExternal Users access. AZDO.1006Ensure external content sharing is restricted CIS.M365.7.2.3Ensure OneDrive content sharing is restricted CIS.M365.7.2.4Ensure that SharePoint guest users cannot share items they don't own CIS.M365.7.2.5Ensure SharePoint external sharing is managed through domain whitelist/blacklists CIS.M365.7.2.6Ensure external sharing is restricted by security group CIS.M365.7.2.8Restrict external sharing of semantic models CIS.M365.9.1.8Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. EIDSCA.ST09Has a check
AC-22Publicly Accessible ContentRestrict public projects. AZDO.1003Restrict public publishing of Fabric reports CIS.M365.9.1.4Has a check
Audit and Accountability5 of 5
AU-4Audit Log Storage CapacitySecurity logs SHALL be sent to the agency's security operations center for monitoring. CISA.MS.AAD.4.1Has a check
AU-11Audit Record RetentionAudit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C). CISA.MS.EXO.17.3Has a check
AU-12Audit Record GenerationLog Audit Events. AZDO.1002Ensure Microsoft 365 audit log search is Enabled CIS.M365.3.1.1Ensure 'AuditDisabled' organizationally is set to 'False' CIS.M365.6.1.1Microsoft Purview Audit (Standard) logging SHALL be enabled. CISA.MS.EXO.17.1Intune Diagnostic Settings should include Audit Logs MT.1100Unified audit log ingestion is enabled. MT.1172Ensure mailbox audit actions are configured CIS.M365.6.1.2Ensure 'AuditBypassEnabled' is not enabled on mailboxes CIS.M365.6.1.3Safe Links Policies are tracking when user clicks on safe links. ORCA.156Has a check
Configuration Management9 of 9
CM-3Configuration Change ControlMicrosoft-managed Conditional Access policies should not be left in report-only mode. MT.1224Has a check
CM-4Impact AnalysesEnsure the admin consent workflow is enabled CIS.M365.5.1.5.2An admin consent workflow SHALL be configured for applications. CISA.MS.AAD.5.3Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to. EIDSCA.CP04Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature. EIDSCA.CR01Has a check
CM-5Access Restrictions for ChangeEnsure user consent to apps accessing company data on their behalf is not allowed CIS.M365.5.1.5.1Only administrators SHALL be allowed to consent to applications. CISA.MS.AAD.5.2Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline. EIDSCA.AP08Default Authorization Settings - Allow user consent on risk-based apps. EIDSCA.AP09Default Settings - Consent Policy Settings - Group owner consent for apps accessing data. EIDSCA.CP01Default Settings - Consent Policy Settings - Block user consent for risky apps. EIDSCA.CP03Ensure users cannot register applications CIS.M365.5.1.2.2Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' CIS.M365.5.1.2.3Only administrators SHALL be allowed to register applications. CISA.MS.AAD.5.1Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. EIDSCA.AP10Has a check
CM-5(4)Access Restrictions for Change | Dual AuthorizationEnsure at least one Intune Multi Admin Approval policy is configured MT.1096Has a check
CM-6Configuration SettingsKRBTGT should have standard UAC settings (disabled account) AD-KRBTGT-03Ensure devices without a compliance policy are marked 'not compliant' CIS.M365.4.1Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant' MT.1054Soft- and hard-matching of synchronized objects should be blocked. MT.1073Local Admin Merge should be disabled. MT.1166Ensure macOS compliance policy requires System Integrity Protection. MT.1214Ensure iOS compliance policy requires a minimum operating system version. MT.1230Ensure Android compliance policy requires a recent security patch level. MT.1234Ensure Android compliance policy blocks devices managed with device administrator. MT.1237Has a check
CM-7Least FunctionalitySMBv1 should be disabled on all domain controllers AD-DC-02Microsoft Office is blocked from creating child processes. ASD.ISM-1667Microsoft Office is blocked from creating executable content. ASD.ISM-1668Microsoft Office is blocked from injecting code into other processes. ASD.ISM-1669Microsoft Office macros are blocked from making Win32 API calls. ASD.ISM-1673Disable Marketplace tasks. AZDO.1023Enable Conditional Access policies to block legacy authentication CIS.M365.5.2.2.3Ensure the device code sign-in flow is blocked CIS.M365.5.2.2.12Ensure weak authentication methods are disabled CIS.M365.5.2.3.5Ensure SMTP AUTH is disabled CIS.M365.6.5.4Legacy authentication SHALL be blocked. CISA.MS.AAD.1.1SMTP AUTH SHALL be disabled. CISA.MS.EXO.5.1Authentication Method - SMS - Use for sign-in. EIDSCA.AS04Authentication Method - Voice call - State. EIDSCA.AV01At least one Conditional Access policy is configured to block other legacy authentication. MT.1009At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. MT.1010Users should be blocked from using legacy authentication. MT.1033At least one Conditional Access policy is targeting the Device Code authentication flow. MT.1052Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers. MT.1084Ensure ASR Rules are configured correctly. MT.1178Microsoft Office macros in files originating from the internet are blocked. ASD.ISM-1488Ensure 'User owned apps and services' is restricted CIS.M365.1.3.4Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web' CIS.M365.1.3.7Ensure authentication transfer is blocked CIS.M365.5.2.2.17Ensure the email OTP authentication method is disabled CIS.M365.5.2.3.7Ensure users installing Outlook add-ins is not allowed CIS.M365.6.3.1Ensure additional storage providers are restricted in Outlook on the web CIS.M365.6.5.3Ensure external file sharing in Teams is enabled for only approved cloud storage services CIS.M365.8.1.1Ensure app permission policies are configured CIS.M365.8.4.1Disable R and Python visuals in Fabric CIS.M365.9.1.5Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants. EIDSCA.AP12At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms. MT.1015Ensure users installing Outlook add-ins is not allowed MT.1041Ensure Direct Send is set to be rejected MT.1062Restrict non-admin users from creating tenants. MT.1068Block legacy MSOnline (MSOL) PowerShell module. MT.1185Internet Explorer 11 is disabled or removed. ASD.ISM-1654Ensure meeting recording is off by default CIS.M365.8.5.9The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. CISA.MS.AAD.3.4Authentication Method - General Settings - Manage migration. EIDSCA.AG01Microsoft 365 Group (and Team) creation should be restricted to approved users. MT.1055Ensure Android compliance policy blocks USB debugging. MT.1236Has a check
CM-7(5)Least Functionality | Authorized Software — Allow-by-exceptionEnsure App Control for Business is enabled. MT.1179Ensure Managed Installer Rules are configured correctly. MT.1180Ensure Gatekeeper restricts macOS app download locations. MT.1215Has a check
Contingency Planning1 of 1
Identification and Authentication12 of 12
IA-2Identification and Authentication (Organizational Users)Ensure all member users are 'MFA capable' CIS.M365.5.2.3.4At least one Conditional Access policy is targeting the Device Code authentication flow. MT.1052Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers. MT.1084AI agents should require user authentication. MT.1114Ensure Microsoft Authenticator is configured to protect against MFA fatigue CIS.M365.5.2.3.1Ensure modern authentication for SharePoint applications is required CIS.M365.7.2.1Ensure system-preferred multifactor authentication is enabled CIS.M365.5.2.3.6Ensure Microsoft Authenticator on companion applications is disabled CIS.M365.5.2.3.10Ensure modern authentication for Exchange Online is enabled CIS.M365.6.5.1Has a check
IA-2(1)Identification and Authentication (Organizational Users) | Multi-factor Authentication to Privileged AccountsEnsure multifactor authentication is enabled for all users in administrative roles CIS.M365.5.2.2.1Ensure 'Phishing-resistant MFA strength' is required for Administrators CIS.M365.5.2.2.5Phishing-resistant MFA SHALL be enforced for all users. CISA.MS.AAD.3.1If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. CISA.MS.AAD.3.2Phishing-resistant MFA SHALL be required for highly privileged roles. CISA.MS.AAD.3.6Authentication Method - FIDO2 security key - State. EIDSCA.AF01Authentication Method - Microsoft Authenticator - State. EIDSCA.AM01Authentication Method - Microsoft Authenticator - Require number matching for push notifications. EIDSCA.AM03Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. EIDSCA.AM04At least one Conditional Access policy is configured to require MFA for admins. MT.1006At least one Conditional Access policy is configured to require MFA for all users. MT.1007At least one Conditional Access policy is configured to require MFA for Azure management. MT.1008At least one Conditional Access policy is configured to require MFA for guest access. MT.1016Security Defaults are enabled. MT.1021All App registration owners should have MFA registered MT.1063If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. CISA.MS.AAD.3.3Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. EIDSCA.AM06Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. EIDSCA.AM07Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. EIDSCA.AM09Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. EIDSCA.AM10At least one Conditional Access policy is configured to require MFA for risky sign-ins. MT.1012Has a check
IA-2(2)Identification and Authentication (Organizational Users) | Multi-factor Authentication to Non-privileged AccountsMulti-factor authentication is used to authenticate human users to their organisation's online services. ASD.ISM-1504Ensure multifactor authentication is enabled for all users CIS.M365.5.2.2.2Phishing-resistant MFA SHALL be enforced for all users. CISA.MS.AAD.3.1If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. CISA.MS.AAD.3.2Authentication Method - FIDO2 security key - State. EIDSCA.AF01Authentication Method - Microsoft Authenticator - State. EIDSCA.AM01At least one Conditional Access policy is configured to require MFA for all users. MT.1007At least one Conditional Access policy is configured to require MFA for Azure management. MT.1008Security Defaults are enabled. MT.1021If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. CISA.MS.AAD.3.3Has a check
IA-2(8)Identification and Authentication (Organizational Users) | Access to Accounts — Replay ResistantEnsure 'Phishing-resistant MFA strength' is required for Administrators CIS.M365.5.2.2.5Phishing-resistant MFA SHALL be enforced for all users. CISA.MS.AAD.3.1Phishing-resistant MFA SHALL be required for highly privileged roles. CISA.MS.AAD.3.6Authentication Method - Microsoft Authenticator - Require number matching for push notifications. EIDSCA.AM03Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. EIDSCA.AM04If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. CISA.MS.AAD.3.3Has a check
IA-2(13)Identification and Authentication (Organizational Users) | Out-of-band AuthenticationIf Microsoft Authenticator is enabled, it SHALL be configured to show login context information. CISA.MS.AAD.3.3Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. EIDSCA.AM06Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. EIDSCA.AM07Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. EIDSCA.AM09Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. EIDSCA.AM10Has a check
IA-3Device Identification and AuthenticationAt least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins. MT.1014Conditional Access policies should not use the deprecated Approved Client App grant. MT.1072Ensure the ability to join devices to Entra is restricted CIS.M365.5.1.4.1Ensure a managed device is required for authentication CIS.M365.5.2.2.9Ensure a managed device is required to register security information CIS.M365.5.2.2.10Managed devices SHOULD be required for authentication. CISA.MS.AAD.3.7Managed Devices SHOULD be required to register MFA. CISA.MS.AAD.3.8At least one Conditional Access policy is configured with device compliance. MT.1001Restrict device join to selected users/groups or none. MT.1070Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device. MT.1188Has a check
IA-4Identifier ManagementSoft- and hard-matching of synchronized objects should be blocked. MT.1073GitHub and GitLab federated identity credentials should use immutable subject identifiers. MT.1226Has a check
IA-5Authenticator ManagementNo domain admin accounts should have SPNs configured AD-SPN-12No domain admin accounts should have SPNs configured AD-SPN-13Validate SSH Key Expiration. AZDO.1031(Tenant) Restrict creation of global Personal Access Tokens. AZDO.1032(Tenant) Enable automatic revocation of leaked Personal Access Tokens. AZDO.1033(Tenant) Restrict Personal Access Token lifespan. AZDO.1035(Organization) Restrict Personal Access Token creation. AZDO.1037Ensure weak authentication methods are disabled CIS.M365.5.2.3.5Authentication Method - FIDO2 security key - Enforce attestation. EIDSCA.AF03Default Authorization Settings - Enabled Self service password reset for administrators. EIDSCA.AP01Authentication Method - SMS - Use for sign-in. EIDSCA.AS04Authentication Method - Voice call - State. EIDSCA.AV01At least one Conditional Access policy is configured to secure security info registration only from a trusted location. MT.1011No Service Principal with Client Secret and permanent role assignment on Control Plane. MT.1027Do not sync krbtgt_AzureAD to Entra ID. MT.1147Ensure macOS LAPS is configured on Automated Device Enrollment profiles. MT.1217KRBTGT password age should not exceed the configured maximum AD-KRBTGT-01LAPS should be installed in Active Directory AD-SCH-05Ensure Local Administrator Password Solution is enabled CIS.M365.5.1.4.5Ensure password addition is blocked for applications CIS.M365.5.1.5.3Ensure password lifetime for applications does not exceed 180 days CIS.M365.5.1.5.4Ensure new application passwords are system-generated CIS.M365.5.1.5.5Ensure maximum certificate lifetime for applications does not exceed 180 days CIS.M365.5.1.5.6Ensure that password hash sync is enabled for hybrid deployments CIS.M365.5.1.8.1Ensure the email OTP authentication method is disabled CIS.M365.5.2.3.7Ensure reauthentication with verification code is restricted CIS.M365.7.2.10Block resource-key authentication for Fabric datasets CIS.M365.9.1.9Authentication Method - FIDO2 security key - Restrict specific keys. EIDSCA.AF06Authentication Method - Temporary Access Pass - One-time. EIDSCA.AT02At least one Conditional Access policy is configured to require new password when user risk is high. MT.1013App registrations should no longer use secrets. MT.1057Ensure LAPS Configuration Policy is properly set. MT.1177App registration certificates should not have excessive validity periods. MT.1198Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview). MT.1208Ensure iOS app protection policy requires a strong app PIN. MT.1238Ensure Android app protection policy requires a strong app PIN. MT.1244Authentication Method - FIDO2 security key - Enforce key restrictions. EIDSCA.AF04Authentication Method - FIDO2 security key - Restricted. EIDSCA.AF05Has a check
IA-5(1)Authenticator Management | Password-based AuthenticationNo GPOs should contain a cpassword AD-GPOREP-17No GPOs should contain a cpassword AD-GPOREP-18No GPOs should contain a default password AD-GPOREP-19No GPOs should contain a default password AD-GPOREP-20Default Settings - Password Rule Settings - Password Protection - Mode. EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. EIDSCA.PR02Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' CIS.M365.1.3.1Ensure custom banned passwords lists are used CIS.M365.5.2.3.2Ensure password protection is enabled for on-prem Active Directory CIS.M365.5.2.3.3User passwords SHALL NOT expire. CISA.MS.AAD.6.1Default Settings - Password Rule Settings - Enforce custom list. EIDSCA.PR03Ensure iOS compliance policy requires a strong device passcode. MT.1229Ensure Android compliance policy requires a strong device password. MT.1233Has a check
IA-5(7)Authenticator Management | No Embedded Unencrypted Static Authenticators(Organization) Secret Protection: existing repositories enrolled. AZDO.1040(Organization) Secret Protection: push protection blocks secret commits. AZDO.1041AI agents should not have hard-coded credentials in topics. MT.1119Enable automatic enrollment to Advanced Security for Azure DevOps. AZDO.1026(Organization) Secret Protection: new repositories enrolled automatically. AZDO.1039Has a check
IA-8Identification and Authentication (Non-organizational Users)External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.1External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization. CISA.MS.SHAREPOINT.1.2Has a check
IA-11Re-authenticationEnsure sign-in frequency for Intune Enrollment is set to 'Every time' CIS.M365.5.2.2.11Reauthentication days for people who use a verification code SHALL be set to 30 days or less. CISA.MS.SHAREPOINT.3.3At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices. MT.1018Has a check
Incident Response1 of 1
IR-4Incident HandlingHigh-risk users should not be left unremediated in Entra ID Protection. MT.1260Has a check
System and Services Acquisition1 of 1
SA-11Developer Testing and EvaluationEnable automatic enrollment to Advanced Security for Azure DevOps. AZDO.1026(Organization) Code Security: new repositories enrolled automatically. AZDO.1042(Organization) Code Security: existing repositories enrolled. AZDO.1043(Organization) Code Security: dependency and CodeQL alerts enabled. AZDO.1044Has a check
System and Communications Protection8 of 8
SC-7Boundary ProtectionNo trusts should lack SID filtering (quarantine) AD-TRUST-04AI agents should not have risky HTTP configurations. MT.1115Entra Private Access application segments should avoid broad or risky destinations. MT.1193Has a check
SC-7(10)Boundary Protection | Prevent ExfiltrationA DLP solution SHALL be used. CISA.MS.EXO.8.1At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email. CISA.MS.EXO.8.4Ensure 'External sharing' of calendars is not available CIS.M365.1.3.3The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency. CISA.MS.EXO.8.2DLP policy is configured for the Microsoft 365 Copilot location. MT.1175Has a check
SC-8Transmission Confidentiality and IntegritySMB signing should be enabled on all domain controllers AD-DC-04Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview). MT.1213Ensure that DKIM is enabled for all Exchange Online Domains CIS.M365.2.1.9DKIM SHOULD be enabled for all domains. CISA.MS.EXO.3.1DKIM signing is set up for all your custom domains. ORCA.108DNS Records have been set up to support DKIM. ORCA.108.1Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO. ORCA.243Has a check
SC-23Session AuthenticityAgent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview). MT.1213Ensure Token Protection is enforced for session tokens CIS.M365.5.2.2.16Has a check
SC-28Protection of Information at RestNo GPOs should contain a cpassword AD-GPOREP-17No GPOs should contain a cpassword AD-GPOREP-18No GPOs should contain a default password AD-GPOREP-19No GPOs should contain a default password AD-GPOREP-20Has a check
SC-28(1)Protection of Information at Rest | Cryptographic ProtectionEnsure BitLocker full disk encryption is configured MT.1123Ensure iOS app protection policy encrypts organization data. MT.1240Ensure Android app protection policy encrypts organization data. MT.1246Has a check
SC-28(3)Protection of Information at Rest | Cryptographic KeysEnsure users are restricted from recovering BitLocker keys CIS.M365.5.1.4.6Has a check
SC-41Port and I/O Device AccessEnsure Android compliance policy blocks USB debugging. MT.1236Has a check
System and Information Integrity9 of 9
SI-2Flaw RemediationWindows Feature Update Policy Settings should not reference end of support builds MT.1102Disable Node 6 tasks. AZDO.1024(Organization) Code Security: dependency and CodeQL alerts enabled. AZDO.1044Ensure iOS compliance policy requires a minimum operating system version. MT.1230Ensure Android compliance policy requires a recent security patch level. MT.1234Ensure iOS app protection policy requires a minimum OS and app version. MT.1241Ensure Android app protection policy requires a minimum OS and app version. MT.1247Has a check
SI-2(3)Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective ActionsPatches for vulnerabilities in the operating systems of workstations are applied within one month of release. ASD.ISM-1695Has a check
SI-3Malicious Code ProtectionEnsure the highest-priority Safe Attachments policy is enabled CIS.M365.2.1.4Disallowed file types SHALL be determined and enforced. CISA.MS.EXO.9.3At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe). CISA.MS.EXO.9.5Emails SHALL be scanned for malware. CISA.MS.EXO.10.1Emails identified as containing malware SHALL be quarantined or dropped. CISA.MS.EXO.10.2Email scanning SHALL be capable of reviewing emails after delivery. CISA.MS.EXO.10.3Direct download links SHOULD be scanned for malware. CISA.MS.EXO.15.2Behavior Monitoring should be enabled. MT.1149Cloud Protection should be enabled. MT.1150Script Scanning should be enabled. MT.1152Real-time Monitoring should be enabled. MT.1153Network Protection should be enabled. MT.1165Ensure ASR Rules are configured correctly. MT.1178Safe attachments unknown malware response set to block messages. ORCA.124Safe Links is not bypassed. ORCA.189.2No exclusions for the built-in protection policies. ORCA.239Microsoft Office macro antivirus scanning is enabled. ASD.ISM-1672Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) CIS.M365.2.1.1Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) CIS.M365.2.1.2Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled CIS.M365.2.1.5Ensure comprehensive attachment filtering is applied CIS.M365.2.1.11Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled) CIS.M365.2.4.4Ensure Office 365 SharePoint infected files are disallowed for download CIS.M365.7.3.1Emails SHALL be filtered by attachment file types. CISA.MS.EXO.9.1URL comparison with a block-list SHOULD be enabled. CISA.MS.EXO.15.1User click tracking SHOULD be enabled. CISA.MS.EXO.15.3Archive Scanning should be enabled. MT.1148Email Scanning should be enabled. MT.1151Full Scan Removable Drives should be enabled. MT.1154Scanning Network Files should be enabled. MT.1156Cloud Block Level should be High or higher. MT.1161PUA Protection should be enabled. MT.1164Real-Time Scan Direction should cover both directions. MT.1167Safe Links Synchronous URL detonation is enabled. ORCA.105AllowClickThrough is disabled in Safe Links policies. ORCA.113Zero Hour Autopurge Enabled for Malware. ORCA.120.2Safe Links Policies are tracking when user clicks on safe links. ORCA.156Safe Attachments is enabled for SharePoint and Teams. ORCA.158Safe Links is enabled intra-organization. ORCA.179Safe Attachments is not bypassed. ORCA.189Common attachment type filter is enabled. ORCA.205Safe Documents is enabled for Office clients. ORCA.225Each domain has a Safe Link policy applied to it. ORCA.226Each domain has a Safe Attachments policy applied to it. ORCA.227Click through is disabled for Safe Documents. ORCA.234Safe Links is enabled for emails. ORCA.236Safe Links is enabled for teams messages. ORCA.237Safe Links is enabled for office documents. ORCA.238Scan should be scheduled. MT.1158Signatures should be checked before scan. MT.1160Signature Update Interval should be 1-4 hours. MT.1163Each domain has a malware filter policy applied to it, or the default policy is being used. ORCA.232Has a check
SI-4System MonitoringAudit streaming. AZDO.1010Insider Risk Management policy for Risky AI usage is enabled. MT.1174Ensure macOS compliance policy requires a Defender machine risk score level. MT.1216Ensure iOS compliance policy requires a Defender machine risk score level. MT.1231Ensure Android compliance policy requires device threat protection. MT.1235Ensure iOS app protection policy acts on the device threat level. MT.1243Ensure Android app protection policy acts on the device threat level. MT.1249Has a check
SI-4(5)System Monitoring | System-generated AlertsAlerts SHALL be enabled. CISA.MS.EXO.16.1Important protection alerts responsible for AIR activities are enabled. ORCA.242Ensure notifications for internal users sending malware is Enabled CIS.M365.2.1.3Ensure Exchange Online Spam Policies are set to notify administrators CIS.M365.2.1.6Ensure Priority account protection is enabled and configured CIS.M365.2.4.1Ensure Priority accounts have 'Strict protection' presets applied CIS.M365.2.4.2The DMARC point of contact for aggregate reports SHALL include [email protected]. CISA.MS.EXO.4.3Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. CISA.MS.EXO.16.2Authentication Method - General Settings - Report suspicious activity - State. EIDSCA.AG02Has a check
SI-7Software, Firmware, and Information IntegrityEnsure macOS compliance policy requires System Integrity Protection. MT.1214Ensure iOS compliance policy blocks jailbroken devices. MT.1228Ensure Android compliance policy blocks rooted devices. MT.1232Ensure Android app protection policy requires Play Integrity device attestation. MT.1251Has a check
SI-8Spam ProtectionEnsure inbound anti-spam policies do not contain allowed domains CIS.M365.2.1.14The DMARC message rejection option SHALL be p=reject. CISA.MS.EXO.4.2Impersonation protection checks SHOULD be used. CISA.MS.EXO.11.1A spam filter SHALL be enabled. CISA.MS.EXO.14.1High Confidence Phish action set to Quarantine message. ORCA.104Domains are not being allow listed in an unsafe manner in Anti-Spam Policies. ORCA.118.1Domains are not being allow listed in an unsafe manner in Transport Rules. ORCA.118.2Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies. ORCA.118.3Your own domains are not being allow listed in an unsafe manner in Transport Rules. ORCA.118.4Ensure internal phishing protection for Forms is enabled CIS.M365.1.3.5Ensure that an anti-phishing policy has been created CIS.M365.2.1.7Ensure that SPF records are published for all Exchange Domains CIS.M365.2.1.8Ensure DMARC records for all Exchange Online domains are published CIS.M365.2.1.10Ensure mail transport rules do not whitelist specific domains CIS.M365.6.2.2Ensure email from external senders is identified CIS.M365.6.2.3Ensure Direct Send submissions are rejected CIS.M365.6.5.5A DMARC policy SHALL be published for every second-level domain. CISA.MS.EXO.4.1External sender warnings SHALL be implemented. CISA.MS.EXO.7.1User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. CISA.MS.EXO.11.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. CISA.MS.EXO.14.2Allowed domains SHALL NOT be added to inbound anti-spam protection policies. CISA.MS.EXO.14.3Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains MT.1043Mature DMARC policy SHALL be published for every Entra managed and verified domain. MT.1182Outbound spam filter policy settings configured. ORCA.103Senders are not being allow listed in an unsafe manner. ORCA.109Anti-phishing policy exists and EnableUnauthenticatedSender is true. ORCA.111Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy. ORCA.112Mailbox intelligence based impersonation protection is enabled in anti-phishing policies. ORCA.115Mailbox intelligence based impersonation protection action set to move message to junk mail folder. ORCA.116Zero Hour Autopurge Enabled for Phish. ORCA.120.1Zero Hour Autopurge Enabled for Spam. ORCA.120.3High Confidence Spam action set to Quarantine message. ORCA.140Phish action set to Quarantine message. ORCA.142Anti-phishing policy exists and EnableSpoofIntelligence is true. ORCA.180Advanced Phish filter Threshold level is adequate. ORCA.220Mailbox intelligence is enabled in anti-phishing policies. ORCA.221Domain Impersonation action is set to move to Quarantine. ORCA.222User impersonation action is set to move to Quarantine. ORCA.223No trusted senders in Anti-phishing policy. ORCA.228No trusted domains in Anti-phishing policy. ORCA.229SPF records is set up for all your custom domains. ORCA.235Outlook is configured to display external tags for external emails. ORCA.240Anti-phishing policy exists and EnableFirstContactSafetyTips is true. ORCA.241Policies are configured to honor sending domains DMARC. ORCA.244Bulk Complaint Level threshold is between 4 and 6. ORCA.100Bulk is marked as spam. ORCA.101Advanced Spam filter options are turned off. ORCA.102Spam action set to move message to junk mail folder or quarantine. ORCA.139Bulk action set to Move message to Junk Email Folder. ORCA.141Each domain has a Anti-phishing policy applied to it, or the default policy is being used. ORCA.230Each domain has a anti-spam policy applied to it, or the default policy is being used. ORCA.231Similar Domains Safety Tips is enabled. ORCA.119Unusual Characters Safety Tips is enabled. ORCA.123Safety Tips are enabled. ORCA.143Similar Users Safety Tips is enabled. ORCA.224Has a check
SI-10Information Input ValidationLimit variables that can be set at queue time. AZDO.1015Enable shell tasks arguments validation. AZDO.1025Has a check
SI-12Information Management and RetentionRetention policy is configured for the Microsoft Copilot location. MT.1176Has a check
Supply Chain Risk Management1 of 1
SR-3Supply Chain Controls and ProcessesAdditional protections when using public package registries. AZDO.1004Has a check