Entra ID
429 checks168 High198 Medium62 Low1 Info
Run these
Invoke-Maester -Product entraASD.ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.New in 3.0Roles and administratorsHighASD.ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services.New in 3.0Conditional AccessHighASD.ISM-1649Just-in-time administration is used for the administration of systems and their resources.New in 3.0Privileged Identity ManagementHighASD.ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant.New in 3.0Conditional AccessHighCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedApp consent and permissionsHighCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledApp consent and permissionsHighCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Conditional AccessHighCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Conditional AccessHighCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Conditional AccessHighCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Conditional AccessHighCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Conditional AccessHighCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Authentication methodsHighCIS.M365.5.2.3.5Ensure weak authentication methods are disabledAuthentication methodsHighCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Privileged Identity ManagementHighCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.Conditional AccessHighCISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Conditional AccessHighCISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Conditional AccessHighCISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Conditional AccessHighCISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Conditional AccessHighCISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Authentication methodsHighCISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Conditional AccessHighCISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Logs and monitoringHighCISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.App consent and permissionsHighCISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.App consent and permissionsHighCISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Roles and administratorsHighCISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Roles and administratorsHighCISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Roles and administratorsHighCISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Privileged Identity ManagementHighCISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Privileged Identity ManagementHighEIDSCA.AF01Authentication Method - FIDO2 security key - State.Authentication methodsHighEIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Authentication methodsHighEIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Authentication methodsHighEIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Authentication methodsHighEIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Authentication methodsHighEIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Authentication methodsHighEIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.User and directory settingsHighEIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.App consent and permissionsHighEIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.App consent and permissionsHighEIDSCA.AS04Authentication Method - SMS - Use for sign-in.Authentication methodsHighEIDSCA.AV01Authentication Method - Voice call - State.Authentication methodsHighEIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.App consent and permissionsHighEIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.App consent and permissionsHighEIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.App consent and permissionsHighEIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.App consent and permissionsHighEIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Password protectionHighEIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Password protectionHighMT.1003At least one Conditional Access policy is configured with All Apps.Conditional AccessHighMT.1004At least one Conditional Access policy is configured with All Apps and All Users.Conditional AccessHighMT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.Conditional AccessHighMT.1006At least one Conditional Access policy is configured to require MFA for admins.Conditional AccessHighMT.1007At least one Conditional Access policy is configured to require MFA for all users.Conditional AccessHighMT.1008At least one Conditional Access policy is configured to require MFA for Azure management.Conditional AccessHighMT.1009At least one Conditional Access policy is configured to block other legacy authentication.Conditional AccessHighMT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.Conditional AccessHighMT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.Conditional AccessHighMT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.Conditional AccessHighMT.1016At least one Conditional Access policy is configured to require MFA for guest access.Conditional AccessHighMT.1021Security Defaults are enabled.User and directory settingsHighMT.1025No external user with permanent role assignment on Control Plane.Roles and administratorsHighMT.1026No hybrid user with permanent role assignment on Control Plane.Roles and administratorsHighMT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.Roles and administratorsHighMT.1028No user with mailbox and permanent role assignment on Control Plane.Roles and administratorsHighMT.1029Stale accounts are not assigned to privileged roles.Privileged Identity ManagementHighMT.1030Eligible role assignments on Control Plane are in use by administrators.Privileged Identity ManagementHighMT.1031Privileged role on Control Plane are managed by PIM only.Privileged Identity ManagementHighMT.1032Limited number of Global Admins are assigned.Privileged Identity ManagementHighMT.1033Users should be blocked from using legacy authentication.Conditional AccessHighMT.1034Emergency access users should not be blocked.Conditional AccessHighMT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.Conditional AccessHighMT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.Conditional AccessHighMT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreviewApp consent and permissionsHighMT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreviewApp consent and permissionsHighMT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.Conditional AccessHighMT.1063All App registration owners should have MFA registeredAuthentication methodsHighMT.1072Conditional Access policies should not use the deprecated Approved Client App grant.Conditional AccessHighMT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.Hybrid identityHighMT.1147Do not sync krbtgt_AzureAD to Entra ID.Hybrid identityHighMT.1181Conditional Access policy is present that blocks high agent risk sign-ins.Conditional AccessHighMT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreviewAgent identitiesHighMT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreviewAgent identitiesHighMT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreviewAgent identitiesHighMT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreviewAgent identitiesHighMT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreviewAgent identitiesHighMT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreviewAgent identitiesHighZTA.21771Inactive applications don’t have highly privileged built-in rolesZTARoles and administratorsHighZTA.21772Applications don't have client secrets configuredZTAApplicationsHighZTA.21774Microsoft services applications don't have credentials configuredZTAApplicationsHighZTA.21776User consent settings are restrictedZTAApp consent and permissionsHighZTA.21777App instance property lock is configured for all multitenant applicationsZTAApplicationsHighZTA.21781Privileged users sign in with phishing-resistant methodsZTAConditional AccessHighZTA.21782Privileged accounts have phishing-resistant methods registeredZTAAuthentication methodsHighZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsZTAConditional AccessHighZTA.21786User sign-in activity uses token protectionZTAConditional AccessHighZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleZTAUser and directory settingsHighZTA.21790Outbound cross-tenant access settings are configuredZTAExternal identitiesHighZTA.21793Tenant restrictions v2 policy is configuredZTAExternal identitiesHighZTA.21797Restrict access to high risk usersZTAConditional AccessHighZTA.21798ID Protection notifications are enabledZTAIdentity ProtectionHighZTA.21799Restrict high risk sign-insZTAConditional AccessHighZTA.21803Migrate from legacy MFA and SSPR policiesZTAAuthentication methodsHighZTA.21804SMS and Voice Call authentication methods are disabledZTAAuthentication methodsHighZTA.21806Secure the MFA registration (My Security Info) pageZTAConditional AccessHighZTA.21808Restrict device code flowZTAConditional AccessHighZTA.21809Admin consent workflow is enabledZTAApp consent and permissionsHighZTA.21814Privileged accounts are cloud native identitiesZTARoles and administratorsHighZTA.21815All privileged role assignments are activated just in time and not permanently activeZTAPrivileged Identity ManagementHighZTA.21817Global Administrator role activation triggers an approval workflowZTAPrivileged Identity ManagementHighZTA.21818Privileged role activations have monitoring and alerting configuredZTAPrivileged Identity ManagementHighZTA.21828Secure the MFA registration (My Security Info) pageZTAConditional AccessHighZTA.21829Use cloud authenticationZTAHybrid identityHighZTA.21830Conditional Access policies for Privileged Access Workstations are configuredZTAConditional AccessHighZTA.21836Workload Identities are not assigned privileged rolesZTARoles and administratorsHighZTA.21847Password protection for on-premises is enabledZTAPassword protectionHighZTA.21860Diagnostic settings are configured for all Microsoft Entra logsZTALogs and monitoringHighZTA.21861All high-risk users are triagedZTAIdentity ProtectionHighZTA.21863All high-risk sign-ins are triagedZTAIdentity ProtectionHighZTA.21864All risk detections are triagedZTAIdentity ProtectionHighZTA.21872Require multifactor authentication for device join and device registration using user actionZTAConditional AccessHighZTA.21885App registrations use safe redirect URIsZTAApplicationsHighZTA.21888App registrations must not have dangling or abandoned domain redirect URIsZTAApplicationsHighZTA.21891Require password reset notifications for administrator rolesZTAAuthentication methodsHighZTA.21992Application certificates must be rotated on a regular basisZTAApplicationsHighZTA.22124High priority Microsoft Entra recommendations are addressedZTAEntra recommendationsHighZTA.22128Guests are not assigned high privileged directory rolesZTARoles and administratorsHighZTA.22659All risky workload identity sign ins are triagedZTAIdentity ProtectionHighZTA.23183Service principals use safe redirect URIsZTAApplicationsHighZTA.24570Entra Connect Sync is configured with Service Principal CredentialsZTAHybrid identityHighZTA.24824Conditional Access policies block access from noncompliant devicesZTAConditional AccessHighZTA.24827Conditional Access policies block access from unmanaged appsZTAConditional AccessHighZTA.25371Network validation is configured through Universal Continuous Access EvaluationZTAGlobal Secure AccessHighZTA.25372Global Secure Access client is deployed on all managed endpointsZTAGlobal Secure AccessHighZTA.25375The tenant holds the licenses required to operate Global Secure AccessZTAGlobal Secure AccessHighZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessZTAGlobal Secure AccessHighZTA.25377Universal tenant restrictions block unauthorized external tenant accessZTAGlobal Secure AccessHighZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementZTAGlobal Secure AccessHighZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentZTAGlobal Secure AccessHighZTA.25383Administrative privileges are tightly limited to prevent compromiseZTARoles and administratorsHighZTA.25384Application admin rights are constrained to specific Private Access appsZTARoles and administratorsHighZTA.25393Quick Access is enabled and bound to a connectorZTAGlobal Secure AccessHighZTA.25394Quick Access is bound to a Conditional Access policyZTAGlobal Secure AccessHighZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessZTAGlobal Secure AccessHighZTA.25396Conditional Access policies enforce strong authentication for private appsZTAConditional AccessHighZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessZTAConditional AccessHighZTA.25401Application Proxy applications require preauthentication to block anonymous accessZTAApplicationsHighZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersZTAGlobal Secure AccessHighZTA.25406Internet access forwarding profile is enabledZTAGlobal Secure AccessHighZTA.25407Web content filtering integrates with Conditional AccessZTAGlobal Secure AccessHighZTA.25411TLS inspection is enabled and correctly configured for outbound trafficZTAGlobal Secure AccessHighZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringZTAGlobal Secure AccessHighZTA.25413File transfer policies are configured to prevent data exfiltrationZTAGlobal Secure AccessHighZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksZTAGlobal Secure AccessHighZTA.25416Global Secure Access cloud firewall protects branch office internet trafficZTAGlobal Secure AccessHighZTA.25420Network access logs are retained for security analysis and compliance requirementsZTALogs and monitoringHighZTA.25466At least two Private Access connectors are active and healthy per connector groupZTAGlobal Secure AccessHighZTA.25481All Private Access apps have user or group assignmentsZTAGlobal Secure AccessHighZTA.27000Web content filtering blocks high-risk categoriesZTAGlobal Secure AccessHighZTA.27002TLS inspection certificates have a sufficient validity periodZTAGlobal Secure AccessHighZTA.27003TLS inspection failure rate is below 1%ZTAGlobal Secure AccessHighZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileZTAGlobal Secure AccessHighZTA.35001Conditional Access policies don't exclude Rights Management workloadsZTAConditional AccessHighZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsZTAConditional AccessHighZTA.41083Step-up authentication is required upon risky in-session actionZTAConditional AccessHighZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsZTAPrivileged Identity ManagementHighZTA.61006AI administrative roles have assigned principalsZTARoles and administratorsHighZTA.61009Conditional Access policies cover both agent identities and agent usersZTAConditional AccessHighZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsZTAAgent identitiesHighZTA.61012Risk-based Conditional Access blocks risky agent identitiesZTAConditional AccessHighZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryZTAAgent identitiesHighASD.ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.New in 3.0Password protectionMediumASD.ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity.New in 3.0Roles and administratorsMediumCIS.M365.5.1.2.2Ensure users cannot register applicationsUser and directory settingsMediumCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'User and directory settingsMediumCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Device identityMediumCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Device identityMediumCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Device identityMediumCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Device identityMediumCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysDevice identityMediumCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0ApplicationsMediumCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0ApplicationsMediumCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0ApplicationsMediumCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0ApplicationsMediumCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0External identitiesMediumCIS.M365.5.1.6.2Ensure that guest user access is restrictedExternal identitiesMediumCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0External identitiesMediumCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Hybrid identityMediumCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Conditional AccessMediumCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Conditional AccessMediumCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Conditional AccessMediumCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Authentication methodsMediumCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Password protectionMediumCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Password protectionMediumCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Authentication methodsMediumCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Password protectionMediumCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Password protectionMediumCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Identity GovernanceMediumCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Identity GovernanceMediumCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Privileged Identity ManagementMediumCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Privileged Identity ManagementMediumCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Identity ProtectionMediumCISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Authentication methodsMediumCISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Conditional AccessMediumCISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Conditional AccessMediumCISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.User and directory settingsMediumCISA.MS.AAD.6.1User passwords SHALL NOT expire.Password protectionMediumCISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Privileged Identity ManagementMediumCISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Privileged Identity ManagementMediumCISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Privileged Identity ManagementMediumCISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Privileged Identity ManagementMediumCISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.External identitiesMediumCISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.External identitiesMediumCISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.External identitiesMediumEIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Authentication methodsMediumEIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Authentication methodsMediumEIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Authentication methodsMediumEIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Authentication methodsMediumEIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Authentication methodsMediumEIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Authentication methodsMediumEIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Authentication methodsMediumEIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Authentication methodsMediumEIDSCA.AP04Default Authorization Settings - Guest invite restrictions.External identitiesMediumEIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.User and directory settingsMediumEIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.User and directory settingsMediumEIDSCA.AP07Default Authorization Settings - Guest user access.External identitiesMediumEIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.User and directory settingsMediumEIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0User and directory settingsMediumEIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Agent identitiesMediumEIDSCA.AT01Authentication Method - Temporary Access Pass - State.Authentication methodsMediumEIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Authentication methodsMediumEIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Password protectionMediumEIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Password protectionMediumEIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Password protectionMediumEIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.GroupsMediumMT.1001At least one Conditional Access policy is configured with device compliance.Conditional AccessMediumMT.1002App management restrictions on applications and service principals is configured and enabled.ApplicationsMediumMT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.Conditional AccessMediumMT.1013At least one Conditional Access policy is configured to require new password when user risk is high.Conditional AccessMediumMT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.Conditional AccessMediumMT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.Conditional AccessMediumMT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.Conditional AccessMediumMT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.Conditional AccessMediumMT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.Conditional AccessMediumMT.1024Entra recommendations should be completed.Entra recommendationsMediumMT.1036All excluded objects should have a fallback include in another policy.Conditional AccessMediumMT.1038Conditional Access policies should not include or exclude deleted groups.Conditional AccessMediumMT.1057App registrations should no longer use secrets.ApplicationsMediumMT.1058Exchange application access policies must be configured.App consent and permissionsMediumMT.1061Device registration MFA control conflicts with Conditional Access policies.Conditional AccessMediumMT.1066Conditional Access policies should not reference non-existent users, groups, or roles.Conditional AccessMediumMT.1068Restrict non-admin users from creating tenants.User and directory settingsMediumMT.1070Restrict device join to selected users/groups or none.Device identityMediumMT.1071At least one Conditional Access policy explicitly includes Azure DevOps.Conditional AccessMediumMT.1073Soft- and hard-matching of synchronized objects should be blocked.Hybrid identityMediumMT.1075Require explicit assignment of Third Party Entra Apps.ApplicationsMediumMT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra joinDevice identityMediumMT.1091Registering user should not be added as local administrator on the device during Microsoft Entra joinDevice identityMediumMT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.User and directory settingsMediumMT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.Hybrid identityMediumMT.1184Conditional Access policy without any target resources configured.Conditional AccessMediumMT.1185Block legacy MSOnline (MSOL) PowerShell module.User and directory settingsMediumMT.1186Require explicit assignment of high-privilege first-party Entra Apps.ApplicationsMediumMT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreviewGlobal Secure AccessMediumMT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreviewGlobal Secure AccessMediumMT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreviewGlobal Secure AccessMediumMT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreviewGlobal Secure AccessMediumMT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreviewGlobal Secure AccessMediumMT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreviewGlobal Secure AccessMediumMT.1196Review who can change attributes used by dynamic group rules.GroupsMediumMT.1197Remove memberOf rules.GroupsMediumMT.1198App registration certificates should not have excessive validity periods.ApplicationsMediumMT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreviewAgent identitiesMediumMT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreviewAgent identitiesMediumMT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreviewAgent identitiesMediumMT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreviewAgent identitiesMediumMT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreviewAgent identitiesMediumMT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreviewAgent identitiesMediumMT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreviewAgent identitiesMediumMT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreviewAgent identitiesMediumMT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreviewAgent identitiesMediumMT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreviewApplicationsMediumMT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0App consent and permissionsMediumMT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreviewIdentity ProtectionMediumZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsZTAApp consent and permissionsMediumZTA.21773Applications don't have certificates with expiration longer than 180 daysZTAApplicationsMediumZTA.21778Line-of-business and partner apps use MSALZTAApplicationsMediumZTA.21779Use recent versions of Microsoft ApplicationsZTAApplicationsMediumZTA.21780No usage of ADAL in the tenantZTAApplicationsMediumZTA.21784All user sign in activity uses phishing-resistant authentication methodsZTAConditional AccessMediumZTA.21789Tenant creation events are triagedZTALogs and monitoringMediumZTA.21791Guests can’t invite other guestsZTAExternal identitiesMediumZTA.21792Guests have restricted access to directory objectsZTAExternal identitiesMediumZTA.21795No legacy authentication sign-in activityZTAConditional AccessMediumZTA.21796Block legacy authentication policy is configuredZTAConditional AccessMediumZTA.21800All user sign-in activity uses strong authentication methodsZTAConditional AccessMediumZTA.21801Users have strong authentication methods configuredZTAAuthentication methodsMediumZTA.21802Authenticator app shows sign-in contextZTAAuthentication methodsMediumZTA.21807Creating new applications and service principals is restricted to privileged usersZTAUser and directory settingsMediumZTA.21810Resource-specific consent is restrictedZTAApp consent and permissionsMediumZTA.21811Password expiration is disabledZTAPassword protectionMediumZTA.21819Activation alert for Global Administrator role assignmentsZTAPrivileged Identity ManagementMediumZTA.21821Guest access is restrictedZTAExternal identitiesMediumZTA.21822Guest access is limited to approved tenantsZTAExternal identitiesMediumZTA.21823Guest self-service sign-up via user flow is disabledZTAExternal identitiesMediumZTA.21824Guests don't have long lived sign-in sessionsZTAConditional AccessMediumZTA.21825Privileged user sessions don't have long lived sign-in sessionsZTAConditional AccessMediumZTA.21831Conditional Access protected actions are enabledZTARoles and administratorsMediumZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitZTAConditional AccessMediumZTA.21849Smart lockout duration is set to a minimum of 60ZTAPassword protectionMediumZTA.21850Smart lockout threshold isn't greater than 10ZTAPassword protectionMediumZTA.21851Guest access is protected by strong authentication methodsZTAConditional AccessMediumZTA.21854Privileged roles aren't assigned to stale identitiesZTAPrivileged Identity ManagementMediumZTA.21855Privileged roles have access reviewsZTAIdentity GovernanceMediumZTA.21857Guest identities are lifecycle managed with access reviewsZTAIdentity GovernanceMediumZTA.21858Inactive guest identities are disabled or removed from the tenantZTAExternal identitiesMediumZTA.21859GDAP admin least privilegeZTARoles and administratorsMediumZTA.21862All risky workload identities are triagedZTAIdentity ProtectionMediumZTA.21865Named locations are configuredZTAConditional AccessMediumZTA.21866All Microsoft Entra recommendations are addressedZTAEntra recommendationsMediumZTA.21868Guests do not own apps in the tenantZTAApplicationsMediumZTA.21869Enterprise applications must require explicit assignment or scoped provisioningZTAApplicationsMediumZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredZTAExternal identitiesMediumZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationZTAIdentity GovernanceMediumZTA.21876Use PIM for Microsoft Entra privileged rolesZTAPrivileged Identity ManagementMediumZTA.21877All guests have a sponsorZTAExternal identitiesMediumZTA.21878All entitlement management policies have an expiration dateZTAIdentity GovernanceMediumZTA.21879All entitlement management policies that apply to External users require approvalZTAIdentity GovernanceMediumZTA.21882No nested groups in PIM for groupsZTAPrivileged Identity ManagementMediumZTA.21883Workload Identities are configured with risk-based policiesZTAConditional AccessMediumZTA.21884Workload identities based on known networks are configuredZTAConditional AccessMediumZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredZTAApplicationsMediumZTA.21887All registered redirect URIs must have proper DNS records and ownershipsZTAApplicationsMediumZTA.21890Require password reset notifications for user rolesZTAAuthentication methodsMediumZTA.21892All sign-in activity comes from managed devicesZTAConditional AccessMediumZTA.21896Service principals don't have certificates or credentials associated with themZTAApplicationsMediumZTA.21897All app assignment and group membership is governedZTAIdentity GovernanceMediumZTA.21898All supported access lifecycle resources are managed with entitlement management packagesZTAIdentity GovernanceMediumZTA.21899All privileged role assignments have a recipient that can receive notificationsZTAPrivileged Identity ManagementMediumZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesZTAIdentity GovernanceMediumZTA.21941Token protection policies are configuredZTAConditional AccessMediumZTA.21983No Active Medium priority Entra recommendations foundZTAEntra recommendationsMediumZTA.21985Turn off Seamless SSO if there is no usageZTAHybrid identityMediumZTA.22072Self-Service Password Reset does not use Q & AZTAAuthentication methodsMediumZTA.24518Enterprise applications have ownersZTAApplicationsMediumZTA.25370Source IP restoration is enabledZTAGlobal Secure AccessMediumZTA.25379Conditional Access policies use compliant network controlsZTAGlobal Secure AccessMediumZTA.25380Global Secure Access signaling for Conditional Access is enabledZTAGlobal Secure AccessMediumZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesZTAGlobal Secure AccessMediumZTA.25392Private network connectors are running the latest versionZTAGlobal Secure AccessMediumZTA.25399Private DNS is configured for internal name resolutionZTAGlobal Secure AccessMediumZTA.25405Intelligent Local Access is enabled and configuredZTAGlobal Secure AccessMediumZTA.25408Web content filtering policies are configuredZTAGlobal Secure AccessMediumZTA.25409Web content filtering uses category-based rulesZTAGlobal Secure AccessMediumZTA.25410Web content filtering policies are linked to security profilesZTAGlobal Secure AccessMediumZTA.25419Network access activity is visible to security operations for threat detection and responseZTALogs and monitoringMediumZTA.25422Global Secure Access deployment logs are populated and reviewedZTAGlobal Secure AccessMediumZTA.25480Quick Access has user or group assignmentsZTAGlobal Secure AccessMediumZTA.27001TLS inspection bypass rules are regularly reviewedZTAGlobal Secure AccessMediumZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)ZTAAgent identitiesMediumZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeZTAAgent identitiesMediumCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0GroupsLowCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0GroupsLowCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Device identityLowCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Conditional AccessLowCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Authentication methodsLowCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Authentication methodsLowCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Authentication methodsLowEIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Authentication methodsLowEIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Authentication methodsLowEIDSCA.AG01Authentication Method - General Settings - Manage migration.Authentication methodsLowEIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.App consent and permissionsLowEIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.App consent and permissionsLowEIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).App consent and permissionsLowEIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0App consent and permissionsLowEIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.GroupsLowMT.1022All users utilizing a P1 license should be licensed.Conditional AccessLowMT.1023All users utilizing a P2 license should be licensed.Conditional AccessLowMT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.GroupsLowMT.1067Authentication method policies should not reference non-existent groups.Authentication methodsLowMT.1069Restrict non-admin users from creating security groups.User and directory settingsLowMT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).Identity GovernanceLowMT.1107Access packages and catalogs should not reference deleted groups.Identity GovernanceLowMT.1108Access packages should not reference inactive or orphaned assignment policies.Identity GovernanceLowMT.1109Access package approval workflows must have valid approvers.Identity GovernanceLowMT.1110No catalog should contain resources without any associated access packages.Identity GovernanceLowMT.1190Entra Private Access applications should not use the Default connector group.-IncludePreviewGlobal Secure AccessLowMT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreviewGlobal Secure AccessLowMT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreviewGlobal Secure AccessLowMT.1199App registration credentials should not be expired or expiring soon.ApplicationsLowMT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0Conditional AccessLowZTA.21775Tenant app management policy is configuredZTAApplicationsLowZTA.21812Maximum number of Global Administrators doesn't exceed eight usersZTARoles and administratorsLowZTA.21813High Global Administrator to privileged user ratioZTARoles and administratorsLowZTA.21816All privileged role assignments are managed with PIMZTAPrivileged Identity ManagementLowZTA.21820Activation alert for all privileged role assignmentsZTAPrivileged Identity ManagementLowZTA.21833Directory Sync account credentials haven't been rotated recentlyZTAHybrid identityLowZTA.21834Directory sync account is locked down to specific named locationZTAConditional AccessLowZTA.21835Emergency account existsZTARoles and administratorsLowZTA.21837Limit the maximum number of devices per user to 10ZTADevice identityLowZTA.21838Security key authentication method enabledZTAAuthentication methodsLowZTA.21839Passkey authentication method enabledZTAAuthentication methodsLowZTA.21840Security key attestation is enforcedZTAAuthentication methodsLowZTA.21841Authenticator app report suspicious activity is enabledZTAAuthentication methodsLowZTA.21842Block administrators from using SSPRZTAUser and directory settingsLowZTA.21843Block legacy Microsoft Online PowerShell moduleZTAUser and directory settingsLowZTA.21844Block legacy Azure AD PowerShell moduleZTAApplicationsLowZTA.21845Temporary access pass is enabledZTAAuthentication methodsLowZTA.21846Temporary access pass restricted to one-time useZTAAuthentication methodsLowZTA.21848Enable custom banned passwordsZTAPassword protectionLowZTA.21867All enterprise applications have ownersZTAApplicationsLowZTA.21870Enable SSPRZTAAuthentication methodsLowZTA.21889Reduce the user-visible password surface areaZTAAuthentication methodsLowZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationZTAIdentity ProtectionLowZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityZTAApplicationsLowZTA.21895Application Certificate Credentials are managed using HSMZTAApplicationsLowZTA.21953Local Admin Password Solution is deployedZTADevice identityLowZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesZTADevice identityLowZTA.21955Manage the local administrators on Microsoft Entra joined devicesZTADevice identityLowZTA.21964Enable protected actions to secure Conditional Access policy creation and changesZTARoles and administratorsLowZTA.21984No Active low priority Entra recommendations foundZTAEntra recommendationsLowZTA.25400DNS traffic for internal domains is routed through Private AccessZTAGlobal Secure AccessLowZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsZTAGlobal Secure AccessLowEIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.User and directory settingsInfo
No checks match.