Purview

46 checks18 High21 Medium7 Low

Information protection25Data loss prevention6Data classification6Insider risk management5Audit2Data lifecycle management2

Run theseInvoke-Maester -Product purviewCopy

46 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

CIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledAuditHighMT.1172Unified audit log ingestion is enabled.AuditHighZTA.35003Sensitivity labels are configuredZTAInformation protectionHighZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAInformation protectionHighZTA.35013Sensitivity labels with encryption are configuredZTAInformation protectionHighZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAInformation protectionHighZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAInformation protectionHighZTA.35020Auto-labeling policies are in enforcement modeZTAInformation protectionHighZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAInformation protectionHighZTA.35024Azure Rights Management service is activatedZTAInformation protectionHighZTA.35025Internal Rights Management licensing is enabledZTAInformation protectionHighZTA.35030Data loss prevention policies are enabledZTAData loss preventionHighZTA.35033Custom sensitive information types are configuredZTAData classificationHighZTA.35034Exact Data Match is configured for sensitive information detectionZTAData classificationHighZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAData classificationHighZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAInsider risk managementHighZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAInsider risk managementHighZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAInsider risk managementHighCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0Data loss preventionMediumCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0Data loss preventionMediumCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0Data loss preventionMediumMT.1174Insider Risk Management policy for Risky AI usage is enabled.Insider risk managementMediumMT.1175DLP policy is configured for the Microsoft 365 Copilot location.Data loss preventionMediumMT.1176Retention policy is configured for the Microsoft Copilot location.Data lifecycle managementMediumZTA.35006PDF labeling is enabled in SharePointZTAInformation protectionMediumZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAInformation protectionMediumZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAInformation protectionMediumZTA.35012Container labels are configured for collaborative workspacesZTAInformation protectionMediumZTA.35014Email label policies inherit sensitivity from attachmentsZTAInformation protectionMediumZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAInformation protectionMediumZTA.35017A default sensitivity label is configured in label policiesZTAInformation protectionMediumZTA.35018Users must provide justification to downgrade sensitivity labelsZTAInformation protectionMediumZTA.35022On-demand scans are configured for sensitive information discoveryZTAData classificationMediumZTA.35023OCR is enabled for sensitive information detectionZTAData classificationMediumZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAInformation protectionMediumZTA.35028Email retention policies are configuredZTAData lifecycle managementMediumZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAInsider risk managementMediumZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAData classificationMediumZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAData loss preventionMediumCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0Information protectionLowMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.Information protectionLowZTA.35004Sensitivity label policies are published to usersZTAInformation protectionLowZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAInformation protectionLowZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAInformation protectionLowZTA.35010Double Key Encryption labels are configuredZTAInformation protectionLowZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAInformation protectionLow