Microsoft Zero Trust Assessment

Runs Microsoft’s Zero Trust Assessment and shows each of its results in the Maester report.

Ships with Maester. The checks are Microsoft's, from the ZeroTrustAssessment module 3.1.0: Maester runs it and shows each result in its report, beside Maester's own checks. If a check's result, text or fix looks wrong, report it to Microsoft.

About the pack →

364 checks201 High122 Medium41 Low

Identity135Network71Security operations58AI49Devices43Data38Infrastructure1

Run theseInvoke-Maester -Pack ZTA -SkipBuiltInCopy

364 checks

Group byPillarCategoryProductSeverityNone

IDCheckProductSeverity

ZTA.21771Inactive applications don’t have highly privileged built-in rolesEntra IDHighZTA.21772Applications don't have client secrets configuredEntra IDHighZTA.21774Microsoft services applications don't have credentials configuredEntra IDHighZTA.21776User consent settings are restrictedEntra IDHighZTA.21777App instance property lock is configured for all multitenant applicationsEntra IDHighZTA.21781Privileged users sign in with phishing-resistant methodsEntra IDHighZTA.21782Privileged accounts have phishing-resistant methods registeredEntra IDHighZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsEntra IDHighZTA.21786User sign-in activity uses token protectionEntra IDHighZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleEntra IDHighZTA.21788Global Administrators don't have standing access to Azure subscriptionsAzureHighZTA.21790Outbound cross-tenant access settings are configuredEntra IDHighZTA.21793Tenant restrictions v2 policy is configuredEntra IDHighZTA.21797Restrict access to high risk usersEntra IDHighZTA.21798ID Protection notifications are enabledEntra IDHighZTA.21799Restrict high risk sign-insEntra IDHighZTA.21803Migrate from legacy MFA and SSPR policiesEntra IDHighZTA.21804SMS and Voice Call authentication methods are disabledEntra IDHighZTA.21806Secure the MFA registration (My Security Info) pageEntra IDHighZTA.21808Restrict device code flowEntra IDHighZTA.21809Admin consent workflow is enabledEntra IDHighZTA.21814Privileged accounts are cloud native identitiesEntra IDHighZTA.21815All privileged role assignments are activated just in time and not permanently activeEntra IDHighZTA.21817Global Administrator role activation triggers an approval workflowEntra IDHighZTA.21818Privileged role activations have monitoring and alerting configuredEntra IDHighZTA.21828Secure the MFA registration (My Security Info) pageEntra IDHighZTA.21829Use cloud authenticationEntra IDHighZTA.21830Conditional Access policies for Privileged Access Workstations are configuredEntra IDHighZTA.21836Workload Identities are not assigned privileged rolesEntra IDHighZTA.21847Password protection for on-premises is enabledEntra IDHighZTA.21860Diagnostic settings are configured for all Microsoft Entra logsEntra IDHighZTA.21861All high-risk users are triagedEntra IDHighZTA.21863All high-risk sign-ins are triagedEntra IDHighZTA.21864All risk detections are triagedEntra IDHighZTA.21872Require multifactor authentication for device join and device registration using user actionEntra IDHighZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesAzureHighZTA.21885App registrations use safe redirect URIsEntra IDHighZTA.21888App registrations must not have dangling or abandoned domain redirect URIsEntra IDHighZTA.21891Require password reset notifications for administrator rolesEntra IDHighZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesAzureHighZTA.21992Application certificates must be rotated on a regular basisEntra IDHighZTA.22124High priority Microsoft Entra recommendations are addressedEntra IDHighZTA.22128Guests are not assigned high privileged directory rolesEntra IDHighZTA.22659All risky workload identity sign ins are triagedEntra IDHighZTA.23183Service principals use safe redirect URIsEntra IDHighZTA.24540Windows Firewall policy is created and assignedIntuneHighZTA.24541A compliance policy for Windows devices existsIntuneHighZTA.24542macOS Compliance policy is created and assignedIntuneHighZTA.24543Compliance policy assignment for iOS/iPadOS devicesIntuneHighZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedIntuneHighZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsIntuneHighZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedIntuneHighZTA.24548App Protection Policy assigned on iOS/iPad devicesIntuneHighZTA.24549An App protection policy for Android platform exists in IntuneIntuneHighZTA.24550Windows - BitLocker Policy is created and assignedIntuneHighZTA.24551Windows Hello for Business Policy is Configured and AssignedIntuneHighZTA.24553Windows Update policy is assigned and enforced.IntuneHighZTA.24554iOS - Update policy is configured and assignedIntuneHighZTA.24555Intune Scope Tags are Configured for Delegated AdministrationIntuneHighZTA.24560Windows Cloud LAPS policy is created and assignedIntuneHighZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSIntuneHighZTA.24564Windows - Local Account Protection policy is configured and assignedIntuneHighZTA.24568macOS - Platform SSO is configured and assignedIntuneHighZTA.24569Intune macOS FileVault policy is created and AssignedIntuneHighZTA.24570Entra Connect Sync is configured with Service Principal CredentialsEntra IDHighZTA.24572Device enrollment notification is configured and assignedIntuneHighZTA.24573Windows - A security baseline is configured and assignedIntuneHighZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesIntuneHighZTA.24575A Windows Defender Antivirus policy is created and assignedIntuneHighZTA.24690macOS - Update policy is configured and assignedIntuneHighZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSIntuneHighZTA.24794Intune Terms and Conditions Policy is configured and assignedIntuneHighZTA.24802Device Clean-up Rule is CreatedIntuneHighZTA.24824Conditional Access policies block access from noncompliant devicesEntra IDHighZTA.24827Conditional Access policies block access from unmanaged appsEntra IDHighZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessIntuneHighZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessIntuneHighZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessIntuneHighZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsIntuneHighZTA.25371Network validation is configured through Universal Continuous Access EvaluationEntra IDHighZTA.25372Global Secure Access client is deployed on all managed endpointsEntra IDHighZTA.25375The tenant holds the licenses required to operate Global Secure AccessEntra IDHighZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessEntra IDHighZTA.25377Universal tenant restrictions block unauthorized external tenant accessEntra IDHighZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementEntra IDHighZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentEntra IDHighZTA.25383Administrative privileges are tightly limited to prevent compromiseEntra IDHighZTA.25384Application admin rights are constrained to specific Private Access appsEntra IDHighZTA.25393Quick Access is enabled and bound to a connectorEntra IDHighZTA.25394Quick Access is bound to a Conditional Access policyEntra IDHighZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessEntra IDHighZTA.25396Conditional Access policies enforce strong authentication for private appsEntra IDHighZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessEntra IDHighZTA.25401Application Proxy applications require preauthentication to block anonymous accessEntra IDHighZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersEntra IDHighZTA.25406Internet access forwarding profile is enabledEntra IDHighZTA.25407Web content filtering integrates with Conditional AccessEntra IDHighZTA.25411TLS inspection is enabled and correctly configured for outbound trafficEntra IDHighZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringEntra IDHighZTA.25413File transfer policies are configured to prevent data exfiltrationEntra IDHighZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksEntra IDHighZTA.25416Global Secure Access cloud firewall protects branch office internet trafficEntra IDHighZTA.25420Network access logs are retained for security analysis and compliance requirementsEntra IDHighZTA.25466At least two Private Access connectors are active and healthy per connector groupEntra IDHighZTA.25481All Private Access apps have user or group assignmentsEntra IDHighZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsAzureHighZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallAzureHighZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallAzureHighZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallAzureHighZTA.25541Application Gateway WAF is Enabled in Prevention modeAzureHighZTA.25543Azure Front Door WAF is Enabled in Prevention ModeAzureHighZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallAzureHighZTA.26879Request Body Inspection is enabled in Application Gateway WAFAzureHighZTA.26880Request Body Inspection is enabled in Azure Front Door WAFAzureHighZTA.26881Default Ruleset is enabled in Application Gateway WAFAzureHighZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFAzureHighZTA.26883Default rule set is assigned in Azure Front Door WAFAzureHighZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFAzureHighZTA.26887Diagnostic logging is enabled in Azure FirewallAzureHighZTA.26888Diagnostic logging is enabled in Application Gateway WAFAzureHighZTA.26889Diagnostic logging is enabled in Azure Front Door WAFAzureHighZTA.27000Web content filtering blocks high-risk categoriesEntra IDHighZTA.27002TLS inspection certificates have a sufficient validity periodEntra IDHighZTA.27003TLS inspection failure rate is below 1%Entra IDHighZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFAzureHighZTA.27016Rate Limiting is Enabled in Application Gateway WAFAzureHighZTA.27018Rate Limiting is Enabled in Azure Front Door WAFAzureHighZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFAzureHighZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileEntra IDHighZTA.35001Conditional Access policies don't exclude Rights Management workloadsEntra IDHighZTA.35003Sensitivity labels are configuredPurviewHighZTA.35005Sensitivity labels are enabled for SharePoint and OneDrivePurviewHighZTA.35013Sensitivity labels with encryption are configuredPurviewHighZTA.35016Mandatory labeling is enabled in sensitivity label policiesPurviewHighZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsPurviewHighZTA.35020Auto-labeling policies are in enforcement modePurviewHighZTA.35021Auto-labeling policies are enabled for SharePoint and OneDrivePurviewHighZTA.35024Azure Rights Management service is activatedPurviewHighZTA.35025Internal Rights Management licensing is enabledPurviewHighZTA.35030Data loss prevention policies are enabledPurviewHighZTA.35033Custom sensitive information types are configuredPurviewHighZTA.35034Exact Data Match is configured for sensitive information detectionPurviewHighZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesPurviewHighZTA.35038Insider Risk Management policies are enabled for risky AI usagePurviewHighZTA.35039Communication compliance monitoring is configured for Microsoft CopilotPurviewHighZTA.35040Communication compliance monitoring is configured for enterprise AI toolsPurviewHighZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerDefenderHighZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversDefenderHighZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setActive DirectoryHighZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSActive DirectoryHighZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsActive DirectoryHighZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsActive DirectoryHighZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsActive DirectoryHighZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantDefenderHighZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedDefenderHighZTA.41029Anti-malware policies are configured according to recommended settingsDefenderHighZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockDefenderHighZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsDefenderHighZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionDefenderHighZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailDefenderHighZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessDefenderHighZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedDefenderHighZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointDefenderHighZTA.41050Attack surface reduction (ASR) rules are enabled in block modeIntuneHighZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneIntuneHighZTA.41053Network protection is enabled in block modeDefenderHighZTA.41054Controlled folder access is enabled in block modeDefenderHighZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusDefenderHighZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusDefenderHighZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusDefenderHighZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedDefenderHighZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedDefenderHighZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsEntra IDHighZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsDefenderHighZTA.41083Step-up authentication is required upon risky in-session actionEntra IDHighZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsDefenderHighZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedDefenderHighZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowDefenderHighZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceAzureHighZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsAzureHighZTA.50001Microsoft Defender for Cloud RecommendationsAzureHighZTA.51001Windows Endpoint Privilege Management is configured and assignedIntuneHighZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)IntuneHighZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesIntuneHighZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesIntuneHighZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsEntra IDHighZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneIntuneHighZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceAzureHighZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsAzureHighZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryMicrosoft 365HighZTA.61006AI administrative roles have assigned principalsEntra IDHighZTA.61009Conditional Access policies cover both agent identities and agent usersEntra IDHighZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsEntra IDHighZTA.61012Risk-based Conditional Access blocks risky agent identitiesEntra IDHighZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryEntra IDHighZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceAzureHighZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathAzureHighZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceAzureHighZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsAzureHighZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceAzureHighZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceAzureHighZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsEntra IDMediumZTA.21773Applications don't have certificates with expiration longer than 180 daysEntra IDMediumZTA.21778Line-of-business and partner apps use MSALEntra IDMediumZTA.21779Use recent versions of Microsoft ApplicationsEntra IDMediumZTA.21780No usage of ADAL in the tenantEntra IDMediumZTA.21784All user sign in activity uses phishing-resistant authentication methodsEntra IDMediumZTA.21789Tenant creation events are triagedEntra IDMediumZTA.21791Guests can’t invite other guestsEntra IDMediumZTA.21792Guests have restricted access to directory objectsEntra IDMediumZTA.21795No legacy authentication sign-in activityEntra IDMediumZTA.21796Block legacy authentication policy is configuredEntra IDMediumZTA.21800All user sign-in activity uses strong authentication methodsEntra IDMediumZTA.21801Users have strong authentication methods configuredEntra IDMediumZTA.21802Authenticator app shows sign-in contextEntra IDMediumZTA.21807Creating new applications and service principals is restricted to privileged usersEntra IDMediumZTA.21810Resource-specific consent is restrictedEntra IDMediumZTA.21811Password expiration is disabledEntra IDMediumZTA.21819Activation alert for Global Administrator role assignmentsEntra IDMediumZTA.21821Guest access is restrictedEntra IDMediumZTA.21822Guest access is limited to approved tenantsEntra IDMediumZTA.21823Guest self-service sign-up via user flow is disabledEntra IDMediumZTA.21824Guests don't have long lived sign-in sessionsEntra IDMediumZTA.21825Privileged user sessions don't have long lived sign-in sessionsEntra IDMediumZTA.21831Conditional Access protected actions are enabledEntra IDMediumZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitEntra IDMediumZTA.21849Smart lockout duration is set to a minimum of 60Entra IDMediumZTA.21850Smart lockout threshold isn't greater than 10Entra IDMediumZTA.21851Guest access is protected by strong authentication methodsEntra IDMediumZTA.21854Privileged roles aren't assigned to stale identitiesEntra IDMediumZTA.21855Privileged roles have access reviewsEntra IDMediumZTA.21857Guest identities are lifecycle managed with access reviewsEntra IDMediumZTA.21858Inactive guest identities are disabled or removed from the tenantEntra IDMediumZTA.21859GDAP admin least privilegeEntra IDMediumZTA.21862All risky workload identities are triagedEntra IDMediumZTA.21865Named locations are configuredEntra IDMediumZTA.21866All Microsoft Entra recommendations are addressedEntra IDMediumZTA.21868Guests do not own apps in the tenantEntra IDMediumZTA.21869Enterprise applications must require explicit assignment or scoped provisioningEntra IDMediumZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredEntra IDMediumZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationEntra IDMediumZTA.21876Use PIM for Microsoft Entra privileged rolesEntra IDMediumZTA.21877All guests have a sponsorEntra IDMediumZTA.21878All entitlement management policies have an expiration dateEntra IDMediumZTA.21879All entitlement management policies that apply to External users require approvalEntra IDMediumZTA.21882No nested groups in PIM for groupsEntra IDMediumZTA.21883Workload Identities are configured with risk-based policiesEntra IDMediumZTA.21884Workload identities based on known networks are configuredEntra IDMediumZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredEntra IDMediumZTA.21887All registered redirect URIs must have proper DNS records and ownershipsEntra IDMediumZTA.21890Require password reset notifications for user rolesEntra IDMediumZTA.21892All sign-in activity comes from managed devicesEntra IDMediumZTA.21896Service principals don't have certificates or credentials associated with themEntra IDMediumZTA.21897All app assignment and group membership is governedEntra IDMediumZTA.21898All supported access lifecycle resources are managed with entitlement management packagesEntra IDMediumZTA.21899All privileged role assignments have a recipient that can receive notificationsEntra IDMediumZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesEntra IDMediumZTA.21941Token protection policies are configuredEntra IDMediumZTA.21983No Active Medium priority Entra recommendations foundEntra IDMediumZTA.21985Turn off Seamless SSO if there is no usageEntra IDMediumZTA.22072Self-Service Password Reset does not use Q & AEntra IDMediumZTA.24518Enterprise applications have ownersEntra IDMediumZTA.24552macOS - Firewall policy is created and assignedIntuneMediumZTA.24823Company Portal branding and support settings enhance user experience and trustIntuneMediumZTA.25370Source IP restoration is enabledEntra IDMediumZTA.25379Conditional Access policies use compliant network controlsEntra IDMediumZTA.25380Global Secure Access signaling for Conditional Access is enabledEntra IDMediumZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesEntra IDMediumZTA.25392Private network connectors are running the latest versionEntra IDMediumZTA.25399Private DNS is configured for internal name resolutionEntra IDMediumZTA.25405Intelligent Local Access is enabled and configuredEntra IDMediumZTA.25408Web content filtering policies are configuredEntra IDMediumZTA.25409Web content filtering uses category-based rulesEntra IDMediumZTA.25410Web content filtering policies are linked to security profilesEntra IDMediumZTA.25419Network access activity is visible to security operations for threat detection and responseEntra IDMediumZTA.25422Global Secure Access deployment logs are populated and reviewedEntra IDMediumZTA.25480Quick Access has user or group assignmentsEntra IDMediumZTA.26885Metrics are enabled for DDoS-protected public IPsAzureMediumZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsAzureMediumZTA.27001TLS inspection bypass rules are regularly reviewedEntra IDMediumZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFAzureMediumZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFAzureMediumZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFAzureMediumZTA.35006PDF labeling is enabled in SharePointPurviewMediumZTA.35008Default sensitivity labels are configured for SharePoint document librariesPurviewMediumZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionPurviewMediumZTA.35012Container labels are configured for collaborative workspacesPurviewMediumZTA.35014Email label policies inherit sensitivity from attachmentsPurviewMediumZTA.35015Globally published sensitivity labels don't exceed the recommended maximumPurviewMediumZTA.35017A default sensitivity label is configured in label policiesPurviewMediumZTA.35018Users must provide justification to downgrade sensitivity labelsPurviewMediumZTA.35022On-demand scans are configured for sensitive information discoveryPurviewMediumZTA.35023OCR is enabled for sensitive information detectionPurviewMediumZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessPurviewMediumZTA.35028Email retention policies are configuredPurviewMediumZTA.35029Mail flow rules apply rights protection to sensitive messagesExchange OnlineMediumZTA.35032Adaptive Protection is enabled in data loss prevention policiesPurviewMediumZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesPurviewMediumZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessPurviewMediumZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageDefenderMediumZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedDefenderMediumZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsDefenderMediumZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxDefenderMediumZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsDefenderMediumZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersIntuneMediumZTA.41051Removable storage and device control policies are enforced via IntuneIntuneMediumZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalDefenderMediumZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeAzureMediumZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceAzureMediumZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesAzureMediumZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelAzureMediumZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelAzureMediumZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelAzureMediumZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksAzureMediumZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseAzureMediumZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseAzureMediumZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantAzureMediumZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementAzureMediumZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)AzureMediumZTA.51019MAM app access timeout and re-authentication are enforced after idle periodIntuneMediumZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)Entra IDMediumZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeEntra IDMediumZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceAzureMediumZTA.21775Tenant app management policy is configuredEntra IDLowZTA.21812Maximum number of Global Administrators doesn't exceed eight usersEntra IDLowZTA.21813High Global Administrator to privileged user ratioEntra IDLowZTA.21816All privileged role assignments are managed with PIMEntra IDLowZTA.21820Activation alert for all privileged role assignmentsEntra IDLowZTA.21833Directory Sync account credentials haven't been rotated recentlyEntra IDLowZTA.21834Directory sync account is locked down to specific named locationEntra IDLowZTA.21835Emergency account existsEntra IDLowZTA.21837Limit the maximum number of devices per user to 10Entra IDLowZTA.21838Security key authentication method enabledEntra IDLowZTA.21839Passkey authentication method enabledEntra IDLowZTA.21840Security key attestation is enforcedEntra IDLowZTA.21841Authenticator app report suspicious activity is enabledEntra IDLowZTA.21842Block administrators from using SSPREntra IDLowZTA.21843Block legacy Microsoft Online PowerShell moduleEntra IDLowZTA.21844Block legacy Azure AD PowerShell moduleEntra IDLowZTA.21845Temporary access pass is enabledEntra IDLowZTA.21846Temporary access pass restricted to one-time useEntra IDLowZTA.21848Enable custom banned passwordsEntra IDLowZTA.21867All enterprise applications have ownersEntra IDLowZTA.21870Enable SSPREntra IDLowZTA.21889Reduce the user-visible password surface areaEntra IDLowZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationEntra IDLowZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityEntra IDLowZTA.21895Application Certificate Credentials are managed using HSMEntra IDLowZTA.21953Local Admin Password Solution is deployedEntra IDLowZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesEntra IDLowZTA.21955Manage the local administrators on Microsoft Entra joined devicesEntra IDLowZTA.21964Enable protected actions to secure Conditional Access policy creation and changesEntra IDLowZTA.21984No Active low priority Entra recommendations foundEntra IDLowZTA.24576Intune Endpoint Analytics policy is created and AssignedIntuneLowZTA.25400DNS traffic for internal domains is routed through Private AccessEntra IDLowZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsEntra IDLowZTA.35004Sensitivity label policies are published to usersPurviewLowZTA.35007Information Rights Management is enabled in SharePoint OnlinePurviewLowZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsPurviewLowZTA.35010Double Key Encryption labels are configuredPurviewLowZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionPurviewLowZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorAzureLowZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingAzureLowZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesAzureLow

Licence

The overview and remediation on the pages of these checks are from ZeroTrustAssessment 3.1.0, under this licence:

MIT License

MIT License

Copyright (c) Microsoft Corporation.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE