Microsoft 365

15 checks3 High11 Medium1 Low

Organization settings9Administrative accounts3Teams and groups2Configuration drift1

Run theseInvoke-Maester -Product microsoft-365Copy

15 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

CIS.M365.1.1.1Ensure Administrative accounts are cloud-onlyAdministrative accountsHighCIS.M365.1.1.3Ensure that between two and four global admins are designatedAdministrative accountsHighZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryZTAOrganization settingsHighCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Administrative accountsMediumCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existTeams and groupsMediumCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedTeams and groupsMediumCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Organization settingsMediumCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Organization settingsMediumCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableOrganization settingsMediumCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedOrganization settingsMediumCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledOrganization settingsMediumCIS.M365.1.3.6Ensure the customer lockbox feature is enabledOrganization settingsMediumCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Organization settingsMediumMT.1060Drift folders should match their baseline.New in 3.0Configuration driftMediumCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Organization settingsLow