Purview

46 checks18 High21 Medium7 Low

Information protection25Data loss prevention6Data classification6Insider risk management5Audit2Data lifecycle management2

Run theseInvoke-Maester -Product purviewCopy

46 checks

Group byFeatureAreaSeveritySuiteNone

Columns

FeatureAreaSeverityUser impactEffortATT&CKControlsSourceReset to default

ID↕Check↕Feature↕Area↕Severity↕User impact↕Effort↕ATT&CK↕Controls↕Source↕

CIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledAuditLogging and detectionHighLowLowT1685.002cis-m365:3.1.1, nist-800-53-r5:AU-12CISMT.1172Unified audit log ingestion is enabled.AuditLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12MaesterZTA.35003Sensitivity labels are configuredZTAInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35013Sensitivity labels with encryption are configuredZTAInformation protectionData protectionHighHighMediumT1213.002, T1530—Microsoft Zero Trust AssessmentZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAInformation protectionData protectionHighHighMedium——Microsoft Zero Trust AssessmentZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35020Auto-labeling policies are in enforcement modeZTAInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35024Azure Rights Management service is activatedZTAInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35025Internal Rights Management licensing is enabledZTAInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35030Data loss prevention policies are enabledZTAData loss preventionData protectionHighMediumMediumT1213, T1530 +1—Microsoft Zero Trust AssessmentZTA.35033Custom sensitive information types are configuredZTAData classificationData protectionHighMediumHigh——Microsoft Zero Trust AssessmentZTA.35034Exact Data Match is configured for sensitive information detectionZTAData classificationData protectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAData classificationData protectionHighMediumLow——Microsoft Zero Trust AssessmentZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAInsider risk managementLogging and detectionHighMediumMediumT1213—Microsoft Zero Trust AssessmentZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0Data loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.1, nist-800-53-r5:AC-4CISCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0Data loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.2, nist-800-53-r5:AC-4CISCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0Data loss preventionData protectionMediumLowMediumT1213.002, T1530cis-m365:3.2.3, nist-800-53-r5:AC-4CISMT.1174Insider Risk Management policy for Risky AI usage is enabled.Insider risk managementLogging and detectionMediumLowMediumT1213nist-800-53-r5:SI-4MaesterMT.1175DLP policy is configured for the Microsoft 365 Copilot location.Data loss preventionData protectionMediumLowMediumT1213.002, T1530nist-800-53-r5:SC-7(10)MaesterMT.1176Retention policy is configured for the Microsoft Copilot location.Data lifecycle managementData protectionMediumLowLow—nist-800-53-r5:SI-12MaesterZTA.35006PDF labeling is enabled in SharePointZTAInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAInformation protectionData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35012Container labels are configured for collaborative workspacesZTAInformation protectionData protectionMediumHighMediumT1213.002—Microsoft Zero Trust AssessmentZTA.35014Email label policies inherit sensitivity from attachmentsZTAInformation protectionData protectionMediumHighLow——Microsoft Zero Trust AssessmentZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAInformation protectionData protectionMediumHighMedium——Microsoft Zero Trust AssessmentZTA.35017A default sensitivity label is configured in label policiesZTAInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35018Users must provide justification to downgrade sensitivity labelsZTAInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35022On-demand scans are configured for sensitive information discoveryZTAData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35023OCR is enabled for sensitive information detectionZTAData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35028Email retention policies are configuredZTAData lifecycle managementData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAInsider risk managementData protectionMediumMediumLowT1567—Microsoft Zero Trust AssessmentZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAData classificationData protectionMediumMediumHigh——Microsoft Zero Trust AssessmentZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAData loss preventionData protectionMediumMediumHighT1567—Microsoft Zero Trust AssessmentCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0Information protectionData protectionLowMediumMedium—cis-m365:3.3.1, nist-800-53-r5:AC-4CISMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.Information protectionData protectionLowMediumMedium—nist-800-53-r5:AC-16MaesterZTA.35004Sensitivity label policies are published to usersZTAInformation protectionData protectionLowMediumLow——Microsoft Zero Trust AssessmentZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAInformation protectionData protectionLowLowLow——Microsoft Zero Trust AssessmentZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAInformation protectionData protectionLowHighLow——Microsoft Zero Trust AssessmentZTA.35010Double Key Encryption labels are configuredZTAInformation protectionData protectionLowHighMedium——Microsoft Zero Trust AssessmentZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAInformation protectionData protectionLowLowLow——Microsoft Zero Trust Assessment