All checks

890 checks built into Maester, and 364 from the Microsoft Zero Trust Assessment pack. Each is researched, written and refined by security experts from the Maester community: meet the contributors. Filter them in the menu, or start from the overview.

1,254 checks4 Critical382 High490 Medium132 Low246 Info

Run theseInvoke-MaesterCopy

1,254 checks

Group byProductAreaSeveritySuiteNone

IDCheckProductSeverity

AD-GPOREP-17No GPOs should contain a cpasswordActive DirectoryCriticalAD-GPOREP-18No GPOs should contain a cpasswordActive DirectoryCriticalAD-SPN-12No domain admin accounts should have SPNs configuredActive DirectoryCriticalAD-SPN-13No domain admin accounts should have SPNs configuredActive DirectoryCriticalAD-DC-02SMBv1 should be disabled on all domain controllersActive DirectoryHighAD-DC-04SMB signing should be enabled on all domain controllersActive DirectoryHighAD-DCOMP-02Non-DC computers should not have unconstrained delegationActive DirectoryHighAD-GPOREP-19No GPOs should contain a default passwordActive DirectoryHighAD-GPOREP-20No GPOs should contain a default passwordActive DirectoryHighAD-TRUST-04No trusts should lack SID filtering (quarantine)Active DirectoryHighAD-USER-29No users should be configured for unconstrained delegationActive DirectoryHighASD.ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.New in 3.0Entra IDHighASD.ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services.New in 3.0Entra IDHighASD.ISM-1649Just-in-time administration is used for the administration of systems and their resources.New in 3.0Entra IDHighASD.ISM-1667Microsoft Office is blocked from creating child processes.New in 3.0IntuneHighASD.ISM-1668Microsoft Office is blocked from creating executable content.New in 3.0IntuneHighASD.ISM-1669Microsoft Office is blocked from injecting code into other processes.New in 3.0IntuneHighASD.ISM-1673Microsoft Office macros are blocked from making Win32 API calls.New in 3.0IntuneHighASD.ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release.New in 3.0IntuneHighASD.ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant.New in 3.0Entra IDHighAZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0Azure DevOpsHighAZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0Azure DevOpsHighAZDO.1002Log Audit Events.New in 3.0Azure DevOpsHighAZDO.1003Restrict public projects.New in 3.0Azure DevOpsHighAZDO.1004Additional protections when using public package registries.New in 3.0Azure DevOpsHighAZDO.1005IP Conditional Access policy validation.New in 3.0Azure DevOpsHighAZDO.1010Audit streaming.New in 3.0Azure DevOpsHighAZDO.1013Organization Owner should not be an individual.New in 3.0Azure DevOpsHighAZDO.1015Limit variables that can be set at queue time.New in 3.0Azure DevOpsHighAZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0Azure DevOpsHighAZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0Azure DevOpsHighAZDO.1018Protect access to repositories in YAML pipelines.New in 3.0Azure DevOpsHighAZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0Azure DevOpsHighAZDO.1023Disable Marketplace tasks.New in 3.0Azure DevOpsHighAZDO.1025Enable shell tasks arguments validation.New in 3.0Azure DevOpsHighAZDO.1030Project Collection Administrators.New in 3.0Azure DevOpsHighAZDO.1031Validate SSH Key Expiration.New in 3.0Azure DevOpsHighAZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0Azure DevOpsHighAZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0Azure DevOpsHighAZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0Azure DevOpsHighAZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0Azure DevOpsHighAZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0Azure DevOpsHighAZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0Azure DevOpsHighAZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0Azure DevOpsHighCIS.GH.1.2.3Ensure repository deletion is limited to specific usersGitHubHighCIS.GH.1.3.8Ensure strict base permissions are set for repositoriesGitHubHighCIS.M365.1.1.1Ensure Administrative accounts are cloud-onlyMicrosoft 365HighCIS.M365.1.1.3Ensure that between two and four global admins are designatedMicrosoft 365HighCIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabledDefenderHighCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0DefenderHighCIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledPurviewHighCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedEntra IDHighCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledEntra IDHighCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Entra IDHighCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Entra IDHighCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Entra IDHighCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Entra IDHighCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Entra IDHighCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Entra IDHighCIS.M365.5.2.3.5Ensure weak authentication methods are disabledEntra IDHighCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Entra IDHighCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Exchange OnlineHighCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Exchange OnlineHighCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Exchange OnlineHighCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.Entra IDHighCISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDHighCISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDHighCISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDHighCISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDHighCISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDHighCISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDHighCISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDHighCISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDHighCISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDHighCISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDHighCISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDHighCISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDHighCISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineHighCISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineHighCISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineHighCISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineHighCISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineHighCISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineHighCISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineHighCISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineHighCISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineHighCISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineHighCISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineHighCISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineHighCISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineHighEIDSCA.AF01Authentication Method - FIDO2 security key - State.Entra IDHighEIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDHighEIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDHighEIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDHighEIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDHighEIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDHighEIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra IDHighEIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra IDHighEIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDHighEIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDHighEIDSCA.AV01Authentication Method - Voice call - State.Entra IDHighEIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDHighEIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDHighEIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDHighEIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDHighEIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra IDHighEIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDHighMT.1003At least one Conditional Access policy is configured with All Apps.Entra IDHighMT.1004At least one Conditional Access policy is configured with All Apps and All Users.Entra IDHighMT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.Entra IDHighMT.1006At least one Conditional Access policy is configured to require MFA for admins.Entra IDHighMT.1007At least one Conditional Access policy is configured to require MFA for all users.Entra IDHighMT.1008At least one Conditional Access policy is configured to require MFA for Azure management.Entra IDHighMT.1009At least one Conditional Access policy is configured to block other legacy authentication.Entra IDHighMT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.Entra IDHighMT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.Entra IDHighMT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.Entra IDHighMT.1016At least one Conditional Access policy is configured to require MFA for guest access.Entra IDHighMT.1021Security Defaults are enabled.Entra IDHighMT.1025No external user with permanent role assignment on Control Plane.Entra IDHighMT.1026No hybrid user with permanent role assignment on Control Plane.Entra IDHighMT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.Entra IDHighMT.1028No user with mailbox and permanent role assignment on Control Plane.Entra IDHighMT.1029Stale accounts are not assigned to privileged roles.Entra IDHighMT.1030Eligible role assignments on Control Plane are in use by administrators.Entra IDHighMT.1031Privileged role on Control Plane are managed by PIM only.Entra IDHighMT.1032Limited number of Global Admins are assigned.Entra IDHighMT.1033Users should be blocked from using legacy authentication.Entra IDHighMT.1034Emergency access users should not be blocked.Entra IDHighMT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.Entra IDHighMT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.Entra IDHighMT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreviewEntra IDHighMT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreviewEntra IDHighMT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.Entra IDHighMT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scopeAzureHighMT.1063All App registration owners should have MFA registeredEntra IDHighMT.1065Ensure all Recovery Services Vaults have soft delete enabledAzureHighMT.1072Conditional Access policies should not use the deprecated Approved Client App grant.Entra IDHighMT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.Entra IDHighMT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.DefenderHighMT.1092Intune APNS certificate should be valid for more than 30 daysIntuneHighMT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 daysIntuneHighMT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 daysIntuneHighMT.1095Android Enterprise account connection should be healthyIntuneHighMT.1097Ensure all Intune Certificate Connectors are healthy and running supported versionsIntuneHighMT.1098Mobile Threat Defense Connectors should be healthyIntuneHighMT.1100Intune Diagnostic Settings should include Audit LogsIntuneHighMT.1102Windows Feature Update Policy Settings should not reference end of support buildsIntuneHighMT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groupsIntuneHighMT.1113AI agents should not be shared with broad access control policies.Copilot StudioHighMT.1114AI agents should require user authentication.Copilot StudioHighMT.1116AI agents should not send email with AI-controlled inputs.Copilot StudioHighMT.1119AI agents should not have hard-coded credentials in topics.Copilot StudioHighMT.1123Ensure BitLocker full disk encryption is configuredIntuneHighMT.1147Do not sync krbtgt_AzureAD to Entra ID.Entra IDHighMT.1149Behavior Monitoring should be enabled.DefenderHighMT.1150Cloud Protection should be enabled.DefenderHighMT.1152Script Scanning should be enabled.DefenderHighMT.1153Real-time Monitoring should be enabled.DefenderHighMT.1165Network Protection should be enabled.DefenderHighMT.1172Unified audit log ingestion is enabled.PurviewHighMT.1178Ensure ASR Rules are configured correctly.IntuneHighMT.1179Ensure App Control for Business is enabled.IntuneHighMT.1181Conditional Access policy is present that blocks high agent risk sign-ins.Entra IDHighMT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreviewEntra IDHighMT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreviewEntra IDHighMT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreviewEntra IDHighMT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreviewEntra IDHighMT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreviewEntra IDHighMT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.IntuneHighMT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreviewEntra IDHighORCA.104High Confidence Phish action set to Quarantine message.DefenderHighORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderHighORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.DefenderHighORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderHighORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.DefenderHighORCA.124Safe attachments unknown malware response set to block messages.DefenderHighORCA.189.2Safe Links is not bypassed.DefenderHighORCA.239No exclusions for the built-in protection policies.DefenderHighORCA.242Important protection alerts responsible for AIR activities are enabled.DefenderHighZTA.21771Inactive applications don’t have highly privileged built-in rolesZTAEntra IDHighZTA.21772Applications don't have client secrets configuredZTAEntra IDHighZTA.21774Microsoft services applications don't have credentials configuredZTAEntra IDHighZTA.21776User consent settings are restrictedZTAEntra IDHighZTA.21777App instance property lock is configured for all multitenant applicationsZTAEntra IDHighZTA.21781Privileged users sign in with phishing-resistant methodsZTAEntra IDHighZTA.21782Privileged accounts have phishing-resistant methods registeredZTAEntra IDHighZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsZTAEntra IDHighZTA.21786User sign-in activity uses token protectionZTAEntra IDHighZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleZTAEntra IDHighZTA.21788Global Administrators don't have standing access to Azure subscriptionsZTAAzureHighZTA.21790Outbound cross-tenant access settings are configuredZTAEntra IDHighZTA.21793Tenant restrictions v2 policy is configuredZTAEntra IDHighZTA.21797Restrict access to high risk usersZTAEntra IDHighZTA.21798ID Protection notifications are enabledZTAEntra IDHighZTA.21799Restrict high risk sign-insZTAEntra IDHighZTA.21803Migrate from legacy MFA and SSPR policiesZTAEntra IDHighZTA.21804SMS and Voice Call authentication methods are disabledZTAEntra IDHighZTA.21806Secure the MFA registration (My Security Info) pageZTAEntra IDHighZTA.21808Restrict device code flowZTAEntra IDHighZTA.21809Admin consent workflow is enabledZTAEntra IDHighZTA.21814Privileged accounts are cloud native identitiesZTAEntra IDHighZTA.21815All privileged role assignments are activated just in time and not permanently activeZTAEntra IDHighZTA.21817Global Administrator role activation triggers an approval workflowZTAEntra IDHighZTA.21818Privileged role activations have monitoring and alerting configuredZTAEntra IDHighZTA.21828Secure the MFA registration (My Security Info) pageZTAEntra IDHighZTA.21829Use cloud authenticationZTAEntra IDHighZTA.21830Conditional Access policies for Privileged Access Workstations are configuredZTAEntra IDHighZTA.21836Workload Identities are not assigned privileged rolesZTAEntra IDHighZTA.21847Password protection for on-premises is enabledZTAEntra IDHighZTA.21860Diagnostic settings are configured for all Microsoft Entra logsZTAEntra IDHighZTA.21861All high-risk users are triagedZTAEntra IDHighZTA.21863All high-risk sign-ins are triagedZTAEntra IDHighZTA.21864All risk detections are triagedZTAEntra IDHighZTA.21872Require multifactor authentication for device join and device registration using user actionZTAEntra IDHighZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesZTAAzureHighZTA.21885App registrations use safe redirect URIsZTAEntra IDHighZTA.21888App registrations must not have dangling or abandoned domain redirect URIsZTAEntra IDHighZTA.21891Require password reset notifications for administrator rolesZTAEntra IDHighZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesZTAAzureHighZTA.21992Application certificates must be rotated on a regular basisZTAEntra IDHighZTA.22124High priority Microsoft Entra recommendations are addressedZTAEntra IDHighZTA.22128Guests are not assigned high privileged directory rolesZTAEntra IDHighZTA.22659All risky workload identity sign ins are triagedZTAEntra IDHighZTA.23183Service principals use safe redirect URIsZTAEntra IDHighZTA.24540Windows Firewall policy is created and assignedZTAIntuneHighZTA.24541A compliance policy for Windows devices existsZTAIntuneHighZTA.24542macOS Compliance policy is created and assignedZTAIntuneHighZTA.24543Compliance policy assignment for iOS/iPadOS devicesZTAIntuneHighZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedZTAIntuneHighZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsZTAIntuneHighZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedZTAIntuneHighZTA.24548App Protection Policy assigned on iOS/iPad devicesZTAIntuneHighZTA.24549An App protection policy for Android platform exists in IntuneZTAIntuneHighZTA.24550Windows - BitLocker Policy is created and assignedZTAIntuneHighZTA.24551Windows Hello for Business Policy is Configured and AssignedZTAIntuneHighZTA.24553Windows Update policy is assigned and enforced.ZTAIntuneHighZTA.24554iOS - Update policy is configured and assignedZTAIntuneHighZTA.24555Intune Scope Tags are Configured for Delegated AdministrationZTAIntuneHighZTA.24560Windows Cloud LAPS policy is created and assignedZTAIntuneHighZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSZTAIntuneHighZTA.24564Windows - Local Account Protection policy is configured and assignedZTAIntuneHighZTA.24568macOS - Platform SSO is configured and assignedZTAIntuneHighZTA.24569Intune macOS FileVault policy is created and AssignedZTAIntuneHighZTA.24570Entra Connect Sync is configured with Service Principal CredentialsZTAEntra IDHighZTA.24572Device enrollment notification is configured and assignedZTAIntuneHighZTA.24573Windows - A security baseline is configured and assignedZTAIntuneHighZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesZTAIntuneHighZTA.24575A Windows Defender Antivirus policy is created and assignedZTAIntuneHighZTA.24690macOS - Update policy is configured and assignedZTAIntuneHighZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSZTAIntuneHighZTA.24794Intune Terms and Conditions Policy is configured and assignedZTAIntuneHighZTA.24802Device Clean-up Rule is CreatedZTAIntuneHighZTA.24824Conditional Access policies block access from noncompliant devicesZTAEntra IDHighZTA.24827Conditional Access policies block access from unmanaged appsZTAEntra IDHighZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessZTAIntuneHighZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessZTAIntuneHighZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessZTAIntuneHighZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsZTAIntuneHighZTA.25371Network validation is configured through Universal Continuous Access EvaluationZTAEntra IDHighZTA.25372Global Secure Access client is deployed on all managed endpointsZTAEntra IDHighZTA.25375The tenant holds the licenses required to operate Global Secure AccessZTAEntra IDHighZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessZTAEntra IDHighZTA.25377Universal tenant restrictions block unauthorized external tenant accessZTAEntra IDHighZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementZTAEntra IDHighZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentZTAEntra IDHighZTA.25383Administrative privileges are tightly limited to prevent compromiseZTAEntra IDHighZTA.25384Application admin rights are constrained to specific Private Access appsZTAEntra IDHighZTA.25393Quick Access is enabled and bound to a connectorZTAEntra IDHighZTA.25394Quick Access is bound to a Conditional Access policyZTAEntra IDHighZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessZTAEntra IDHighZTA.25396Conditional Access policies enforce strong authentication for private appsZTAEntra IDHighZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessZTAEntra IDHighZTA.25401Application Proxy applications require preauthentication to block anonymous accessZTAEntra IDHighZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersZTAEntra IDHighZTA.25406Internet access forwarding profile is enabledZTAEntra IDHighZTA.25407Web content filtering integrates with Conditional AccessZTAEntra IDHighZTA.25411TLS inspection is enabled and correctly configured for outbound trafficZTAEntra IDHighZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringZTAEntra IDHighZTA.25413File transfer policies are configured to prevent data exfiltrationZTAEntra IDHighZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksZTAEntra IDHighZTA.25416Global Secure Access cloud firewall protects branch office internet trafficZTAEntra IDHighZTA.25420Network access logs are retained for security analysis and compliance requirementsZTAEntra IDHighZTA.25466At least two Private Access connectors are active and healthy per connector groupZTAEntra IDHighZTA.25481All Private Access apps have user or group assignmentsZTAEntra IDHighZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsZTAAzureHighZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallZTAAzureHighZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallZTAAzureHighZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallZTAAzureHighZTA.25541Application Gateway WAF is Enabled in Prevention modeZTAAzureHighZTA.25543Azure Front Door WAF is Enabled in Prevention ModeZTAAzureHighZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallZTAAzureHighZTA.26879Request Body Inspection is enabled in Application Gateway WAFZTAAzureHighZTA.26880Request Body Inspection is enabled in Azure Front Door WAFZTAAzureHighZTA.26881Default Ruleset is enabled in Application Gateway WAFZTAAzureHighZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFZTAAzureHighZTA.26883Default rule set is assigned in Azure Front Door WAFZTAAzureHighZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFZTAAzureHighZTA.26887Diagnostic logging is enabled in Azure FirewallZTAAzureHighZTA.26888Diagnostic logging is enabled in Application Gateway WAFZTAAzureHighZTA.26889Diagnostic logging is enabled in Azure Front Door WAFZTAAzureHighZTA.27000Web content filtering blocks high-risk categoriesZTAEntra IDHighZTA.27002TLS inspection certificates have a sufficient validity periodZTAEntra IDHighZTA.27003TLS inspection failure rate is below 1%ZTAEntra IDHighZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFZTAAzureHighZTA.27016Rate Limiting is Enabled in Application Gateway WAFZTAAzureHighZTA.27018Rate Limiting is Enabled in Azure Front Door WAFZTAAzureHighZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFZTAAzureHighZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileZTAEntra IDHighZTA.35001Conditional Access policies don't exclude Rights Management workloadsZTAEntra IDHighZTA.35003Sensitivity labels are configuredZTAPurviewHighZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAPurviewHighZTA.35013Sensitivity labels with encryption are configuredZTAPurviewHighZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAPurviewHighZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAPurviewHighZTA.35020Auto-labeling policies are in enforcement modeZTAPurviewHighZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAPurviewHighZTA.35024Azure Rights Management service is activatedZTAPurviewHighZTA.35025Internal Rights Management licensing is enabledZTAPurviewHighZTA.35030Data loss prevention policies are enabledZTAPurviewHighZTA.35033Custom sensitive information types are configuredZTAPurviewHighZTA.35034Exact Data Match is configured for sensitive information detectionZTAPurviewHighZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAPurviewHighZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAPurviewHighZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAPurviewHighZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAPurviewHighZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerZTADefenderHighZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversZTADefenderHighZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAActive DirectoryHighZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAActive DirectoryHighZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAActive DirectoryHighZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAActive DirectoryHighZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAActive DirectoryHighZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantZTADefenderHighZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedZTADefenderHighZTA.41029Anti-malware policies are configured according to recommended settingsZTADefenderHighZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockZTADefenderHighZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsZTADefenderHighZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionZTADefenderHighZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailZTADefenderHighZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessZTADefenderHighZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderHighZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointZTADefenderHighZTA.41050Attack surface reduction (ASR) rules are enabled in block modeZTAIntuneHighZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneZTAIntuneHighZTA.41053Network protection is enabled in block modeZTADefenderHighZTA.41054Controlled folder access is enabled in block modeZTADefenderHighZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusZTADefenderHighZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusZTADefenderHighZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusZTADefenderHighZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedZTADefenderHighZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderHighZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsZTAEntra IDHighZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsZTADefenderHighZTA.41083Step-up authentication is required upon risky in-session actionZTAEntra IDHighZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsZTADefenderHighZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedZTADefenderHighZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowZTADefenderHighZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceZTAAzureHighZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsZTAAzureHighZTA.50001Microsoft Defender for Cloud RecommendationsZTAAzureHighZTA.51001Windows Endpoint Privilege Management is configured and assignedZTAIntuneHighZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)ZTAIntuneHighZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesZTAIntuneHighZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesZTAIntuneHighZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsZTAEntra IDHighZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneZTAIntuneHighZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceZTAAzureHighZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsZTAAzureHighZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryZTAMicrosoft 365HighZTA.61006AI administrative roles have assigned principalsZTAEntra IDHighZTA.61009Conditional Access policies cover both agent identities and agent usersZTAEntra IDHighZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsZTAEntra IDHighZTA.61012Risk-based Conditional Access blocks risky agent identitiesZTAEntra IDHighZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryZTAEntra IDHighZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceZTAAzureHighZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathZTAAzureHighZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsZTAAzureHighZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceZTAAzureHighAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdActive DirectoryMediumAD-GPOL-05GPO blocked inheritance count should be compliantActive DirectoryMediumAD-GPOREP-01No GPOs should be missing permissionsActive DirectoryMediumAD-GPOREP-02No GPOs should be missing permissionsActive DirectoryMediumAD-GPOREP-03GPOs without authenticated users count should be retrievableActive DirectoryMediumAD-GPOREP-04GPOs without authenticated users details should be retrievableActive DirectoryMediumAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableActive DirectoryMediumAD-GPOREP-07GPOs with deny ACE count should be retrievableActive DirectoryMediumAD-GPOREP-08GPOs with deny ACE details should be retrievableActive DirectoryMediumAD-GPOREP-09GPO inherited permissions count should be retrievableActive DirectoryMediumAD-GPOREP-15No GPOs should have version mismatchesActive DirectoryMediumAD-GPOREP-16No GPOs should have version mismatchesActive DirectoryMediumAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumActive DirectoryMediumAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Active DirectoryMediumAD-PWDPOL-04Password complexity should be enabledActive DirectoryMediumAD-PWDPOL-05Password reversible encryption should be disabledActive DirectoryMediumAD-SCH-05LAPS should be installed in Active DirectoryActive DirectoryMediumASD.ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.New in 3.0Entra IDMediumASD.ISM-1488Microsoft Office macros in files originating from the internet are blocked.New in 3.0IntuneMediumASD.ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity.New in 3.0Entra IDMediumASD.ISM-1672Microsoft Office macro antivirus scanning is enabled.New in 3.0IntuneMediumAZDO.1006External Users access.New in 3.0Azure DevOpsMediumAZDO.1007Team and project administrator are allowed to invite new users.New in 3.0Azure DevOpsMediumAZDO.1014Anonymous access to pipeline badges.New in 3.0Azure DevOpsMediumAZDO.1019Stage chooser.New in 3.0Azure DevOpsMediumAZDO.1020Creation of classic build pipelines.New in 3.0Azure DevOpsMediumAZDO.1021Creation of classic release pipelines.New in 3.0Azure DevOpsMediumAZDO.1024Disable Node 6 tasks.New in 3.0Azure DevOpsMediumAZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0Azure DevOpsMediumAZDO.1028Disable creation of TFVC repositories.New in 3.0Azure DevOpsMediumAZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0Azure DevOpsMediumAZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0Azure DevOpsMediumAZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0Azure DevOpsMediumAZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0Azure DevOpsMediumAZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0Azure DevOpsMediumAZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0Azure DevOpsMediumCIS.GH.1.2.2Ensure repository creation is limited to specific membersGitHubMediumCIS.GH.1.2.4Ensure issue deletion is limited to specific usersGitHubMediumCIS.GH.1.3.2Ensure team creation is limited to specific membersGitHubMediumCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Microsoft 365MediumCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existMicrosoft 365MediumCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedMicrosoft 365MediumCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Microsoft 365MediumCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Microsoft 365MediumCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableMicrosoft 365MediumCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedMicrosoft 365MediumCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledMicrosoft 365MediumCIS.M365.1.3.6Ensure the customer lockbox feature is enabledMicrosoft 365MediumCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Microsoft 365MediumCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)DefenderMediumCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledDefenderMediumCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledDefenderMediumCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsDefenderMediumCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdDefenderMediumCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0DefenderMediumCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsDefenderMediumCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0DefenderMediumCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedDefenderMediumCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)DefenderMediumCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0DefenderMediumCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0DefenderMediumCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0DefenderMediumCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)DefenderMediumCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0PurviewMediumCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0PurviewMediumCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0PurviewMediumCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'IntuneMediumCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0IntuneMediumCIS.M365.5.1.2.2Ensure users cannot register applicationsEntra IDMediumCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'Entra IDMediumCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Entra IDMediumCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Entra IDMediumCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Entra IDMediumCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Entra IDMediumCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysEntra IDMediumCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0Entra IDMediumCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0Entra IDMediumCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0Entra IDMediumCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0Entra IDMediumCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0Entra IDMediumCIS.M365.5.1.6.2Ensure that guest user access is restrictedEntra IDMediumCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0Entra IDMediumCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Entra IDMediumCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Entra IDMediumCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Entra IDMediumCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Entra IDMediumCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Entra IDMediumCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Entra IDMediumCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Entra IDMediumCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Entra IDMediumCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Entra IDMediumCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Entra IDMediumCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Entra IDMediumCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Entra IDMediumCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Entra IDMediumCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Entra IDMediumCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Entra IDMediumCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Entra IDMediumCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Entra IDMediumCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Entra IDMediumCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Entra IDMediumCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Entra IDMediumCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Entra IDMediumCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Entra IDMediumCIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Exchange OnlineMediumCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Exchange OnlineMediumCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Exchange OnlineMediumCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0Exchange OnlineMediumCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0Exchange OnlineMediumCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webExchange OnlineMediumCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Exchange OnlineMediumCIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0SharePointMediumCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledSharePointMediumCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownSharePointMediumCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0SharePointMediumCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharePointMediumCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0SharePointMediumCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallySharePointMediumCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0SharePointMediumCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharePointMediumCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadSharePointMediumCIS.M365.8.1.1Ensure external file sharing in Teams is enabled for only approved cloud storage servicesTeamsMediumCIS.M365.8.1.2Ensure users can't send emails to a channel email addressNew in 3.0TeamsMediumCIS.M365.8.2.1Ensure external domains are restricted in the Teams admin centerNew in 3.0TeamsMediumCIS.M365.8.2.2Ensure communication with unmanaged Teams users is disabledTeamsMediumCIS.M365.8.2.3Ensure external Teams users cannot initiate conversationsTeamsMediumCIS.M365.8.2.4Ensure the organization cannot communicate with accounts in trial Teams tenantsNew in 3.0TeamsMediumCIS.M365.8.4.1Ensure app permission policies are configuredTeamsMediumCIS.M365.8.5.1Ensure anonymous users can't join a meetingNew in 3.0TeamsMediumCIS.M365.8.5.2Ensure anonymous users and dial-in callers can't start a meetingNew in 3.0TeamsMediumCIS.M365.8.5.3Ensure only people in my org can bypass the lobbyTeamsMediumCIS.M365.8.5.4Ensure users dialing in can't bypass the lobbyNew in 3.0TeamsMediumCIS.M365.8.5.5Ensure meeting chat does not allow anonymous usersNew in 3.0TeamsMediumCIS.M365.8.5.7Ensure external participants can't give or request controlNew in 3.0TeamsMediumCIS.M365.8.5.8Ensure external meeting chat is offNew in 3.0TeamsMediumCIS.M365.8.6.1Ensure users can report security concerns in TeamsTeamsMediumCIS.M365.9.1.1Restrict guest access to FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.2Restrict external guest invitations through FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.4Restrict public publishing of Fabric reportsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.5Disable R and Python visuals in FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.6Enable sensitivity labels for Fabric contentNew in 3.0Microsoft FabricMediumCIS.M365.9.1.8Restrict external sharing of semantic modelsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.9Block resource-key authentication for Fabric datasetsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.10Restrict service principal access to Fabric public APIsNew in 3.0Microsoft FabricMediumCIS.M365.9.1.11Restrict service principal profiles in FabricNew in 3.0Microsoft FabricMediumCIS.M365.9.1.12Restrict service principal access to Fabric global APIsNew in 3.0Microsoft FabricMediumCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDMediumCISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDMediumCISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDMediumCISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDMediumCISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDMediumCISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDMediumCISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDMediumCISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDMediumCISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDMediumCISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDMediumCISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDMediumCISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDMediumCISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineMediumCISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineMediumCISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineMediumCISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineMediumCISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineMediumCISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMediumCISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineMediumCISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineMediumCISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineMediumCISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineMediumCISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineMediumCISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineMediumCISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineMediumCISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineMediumCISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineMediumCISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineMediumCISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineMediumCISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineMediumCISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineMediumCISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineMediumCISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointMediumCISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointMediumCISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointMediumCISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointMediumCISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointMediumCISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointMediumEIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDMediumEIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDMediumEIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDMediumEIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDMediumEIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDMediumEIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDMediumEIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDMediumEIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDMediumEIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra IDMediumEIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDMediumEIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDMediumEIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDMediumEIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDMediumEIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDMediumEIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra IDMediumEIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDMediumEIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDMediumEIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDMediumEIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDMediumEIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDMediumEIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra IDMediumMT.1001At least one Conditional Access policy is configured with device compliance.Entra IDMediumMT.1002App management restrictions on applications and service principals is configured and enabled.Entra IDMediumMT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.Entra IDMediumMT.1013At least one Conditional Access policy is configured to require new password when user risk is high.Entra IDMediumMT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.Entra IDMediumMT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.Entra IDMediumMT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.Entra IDMediumMT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.Entra IDMediumMT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.Entra IDMediumMT.1024Entra recommendations should be completed.Entra IDMediumMT.1036All excluded objects should have a fallback include in another policy.Entra IDMediumMT.1038Conditional Access policies should not include or exclude deleted groups.Entra IDMediumMT.1041Ensure users installing Outlook add-ins is not allowedExchange OnlineMediumMT.1042Restrict dial-in users from bypassing a meeting lobbyTeamsMediumMT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsExchange OnlineMediumMT.1045Only invited users should be automatically admitted to Teams meetingsTeamsMediumMT.1046Restrict anonymous users from joining meetingsTeamsMediumMT.1047Restrict anonymous users from starting Teams meetingsTeamsMediumMT.1048Limit external participants from having control in a Teams meetingTeamsMediumMT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'IntuneMediumMT.1057App registrations should no longer use secrets.Entra IDMediumMT.1058Exchange application access policies must be configured.Entra IDMediumMT.1059Microsoft Defender for Identity health issues should be resolvedDefenderMediumMT.1060Drift folders should match their baseline.New in 3.0Microsoft 365MediumMT.1061Device registration MFA control conflicts with Conditional Access policies.Entra IDMediumMT.1062Ensure Direct Send is set to be rejectedExchange OnlineMediumMT.1064Ensure that write permissions are required to create new management groupsAzureMediumMT.1066Conditional Access policies should not reference non-existent users, groups, or roles.Entra IDMediumMT.1068Restrict non-admin users from creating tenants.Entra IDMediumMT.1070Restrict device join to selected users/groups or none.Entra IDMediumMT.1071At least one Conditional Access policy explicitly includes Azure DevOps.Entra IDMediumMT.1073Soft- and hard-matching of synchronized objects should be blocked.Entra IDMediumMT.1075Require explicit assignment of Third Party Entra Apps.Entra IDMediumMT.1077App registrations with privileged API permissions should not have owners.DefenderMediumMT.1078App registrations with highly privileged directory roles should not have owners.DefenderMediumMT.1079Privileged API permissions on service principals should not remain unused.DefenderMediumMT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.DefenderMediumMT.1081Hybrid users should not be assigned Entra ID role assignments.DefenderMediumMT.1088Devices with critical credentials should be protected by TPM.DefenderMediumMT.1089Devices with critical credentials should be protected by Credential Guard.DefenderMediumMT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra joinEntra IDMediumMT.1091Registering user should not be added as local administrator on the device during Microsoft Entra joinEntra IDMediumMT.1096Ensure at least one Intune Multi Admin Approval policy is configuredIntuneMediumMT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreviewDefenderMediumMT.1115AI agents should not have risky HTTP configurations.Copilot StudioMediumMT.1118AI agents should not use author (maker) authentication for connections.Copilot StudioMediumMT.1120AI agents should not use MCP server tools without review.Copilot StudioMediumMT.1121AI agents with generative orchestration should have custom instructions.Copilot StudioMediumMT.1122AI agents should not have orphaned ownership.Copilot StudioMediumMT.1148Archive Scanning should be enabled.DefenderMediumMT.1151Email Scanning should be enabled.DefenderMediumMT.1154Full Scan Removable Drives should be enabled.DefenderMediumMT.1156Scanning Network Files should be enabled.DefenderMediumMT.1161Cloud Block Level should be High or higher.DefenderMediumMT.1164PUA Protection should be enabled.DefenderMediumMT.1166Local Admin Merge should be disabled.DefenderMediumMT.1167Real-Time Scan Direction should cover both directions.DefenderMediumMT.1171Sample Submission should send safe samples automatically.DefenderMediumMT.1174Insider Risk Management policy for Risky AI usage is enabled.PurviewMediumMT.1175DLP policy is configured for the Microsoft 365 Copilot location.PurviewMediumMT.1176Retention policy is configured for the Microsoft Copilot location.PurviewMediumMT.1177Ensure LAPS Configuration Policy is properly set.IntuneMediumMT.1180Ensure Managed Installer Rules are configured correctly.IntuneMediumMT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.Entra IDMediumMT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.Entra IDMediumMT.1184Conditional Access policy without any target resources configured.Entra IDMediumMT.1185Block legacy MSOnline (MSOL) PowerShell module.Entra IDMediumMT.1186Require explicit assignment of high-privilege first-party Entra Apps.Entra IDMediumMT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreviewEntra IDMediumMT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreviewEntra IDMediumMT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreviewEntra IDMediumMT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreviewEntra IDMediumMT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreviewEntra IDMediumMT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreviewEntra IDMediumMT.1196Review who can change attributes used by dynamic group rules.Entra IDMediumMT.1197Remove memberOf rules.Entra IDMediumMT.1198App registration certificates should not have excessive validity periods.Entra IDMediumMT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreviewEntra IDMediumMT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreviewEntra IDMediumMT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreviewEntra IDMediumMT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreviewEntra IDMediumMT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreviewEntra IDMediumMT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreviewEntra IDMediumMT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreviewEntra IDMediumMT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreviewEntra IDMediumMT.1214Ensure macOS compliance policy requires System Integrity Protection.IntuneMediumMT.1215Ensure Gatekeeper restricts macOS app download locations.IntuneMediumMT.1216Ensure macOS compliance policy requires a Defender machine risk score level.IntuneMediumMT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreviewEntra IDMediumMT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreviewEntra IDMediumMT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0AzureMediumMT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0IntuneMediumMT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0IntuneMediumMT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0IntuneMediumMT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0IntuneMediumMT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0IntuneMediumMT.1233Ensure Android compliance policy requires a strong device password.New in 3.0IntuneMediumMT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0IntuneMediumMT.1235Ensure Android compliance policy requires device threat protection.New in 3.0IntuneMediumMT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0IntuneMediumMT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0IntuneMediumMT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0IntuneMediumMT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0IntuneMediumMT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0IntuneMediumMT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0IntuneMediumMT.1246Ensure Android app protection policy encrypts organization data.New in 3.0IntuneMediumMT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0IntuneMediumMT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0IntuneMediumMT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0Entra IDMediumMT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreviewEntra IDMediumORCA.103Outbound spam filter policy settings configured.DefenderMediumORCA.105Safe Links Synchronous URL detonation is enabled.DefenderMediumORCA.108DKIM signing is set up for all your custom domains.DefenderMediumORCA.108.1DNS Records have been set up to support DKIM.DefenderMediumORCA.109Senders are not being allow listed in an unsafe manner.DefenderMediumORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.DefenderMediumORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.DefenderMediumORCA.113AllowClickThrough is disabled in Safe Links policies.DefenderMediumORCA.114No IP Allow Lists have been configured.DefenderMediumORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.DefenderMediumORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.DefenderMediumORCA.120.1Zero Hour Autopurge Enabled for Phish.DefenderMediumORCA.120.2Zero Hour Autopurge Enabled for Malware.DefenderMediumORCA.120.3Zero Hour Autopurge Enabled for Spam.DefenderMediumORCA.121Supported filter policy action used.DefenderMediumORCA.140High Confidence Spam action set to Quarantine message.DefenderMediumORCA.142Phish action set to Quarantine message.DefenderMediumORCA.156Safe Links Policies are tracking when user clicks on safe links.DefenderMediumORCA.158Safe Attachments is enabled for SharePoint and Teams.DefenderMediumORCA.179Safe Links is enabled intra-organization.DefenderMediumORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.DefenderMediumORCA.189Safe Attachments is not bypassed.DefenderMediumORCA.205Common attachment type filter is enabled.DefenderMediumORCA.220Advanced Phish filter Threshold level is adequate.DefenderMediumORCA.221Mailbox intelligence is enabled in anti-phishing policies.DefenderMediumORCA.222Domain Impersonation action is set to move to Quarantine.DefenderMediumORCA.223User impersonation action is set to move to Quarantine.DefenderMediumORCA.225Safe Documents is enabled for Office clients.DefenderMediumORCA.226Each domain has a Safe Link policy applied to it.DefenderMediumORCA.227Each domain has a Safe Attachments policy applied to it.DefenderMediumORCA.228No trusted senders in Anti-phishing policy.DefenderMediumORCA.229No trusted domains in Anti-phishing policy.DefenderMediumORCA.233Domains are pointed directly at EOP or enhanced filtering is used.DefenderMediumORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.DefenderMediumORCA.234Click through is disabled for Safe Documents.DefenderMediumORCA.235SPF records is set up for all your custom domains.DefenderMediumORCA.236Safe Links is enabled for emails.DefenderMediumORCA.237Safe Links is enabled for teams messages.DefenderMediumORCA.238Safe Links is enabled for office documents.DefenderMediumORCA.240Outlook is configured to display external tags for external emails.DefenderMediumORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.DefenderMediumORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.DefenderMediumORCA.244Policies are configured to honor sending domains DMARC.DefenderMediumZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsZTAEntra IDMediumZTA.21773Applications don't have certificates with expiration longer than 180 daysZTAEntra IDMediumZTA.21778Line-of-business and partner apps use MSALZTAEntra IDMediumZTA.21779Use recent versions of Microsoft ApplicationsZTAEntra IDMediumZTA.21780No usage of ADAL in the tenantZTAEntra IDMediumZTA.21784All user sign in activity uses phishing-resistant authentication methodsZTAEntra IDMediumZTA.21789Tenant creation events are triagedZTAEntra IDMediumZTA.21791Guests can’t invite other guestsZTAEntra IDMediumZTA.21792Guests have restricted access to directory objectsZTAEntra IDMediumZTA.21795No legacy authentication sign-in activityZTAEntra IDMediumZTA.21796Block legacy authentication policy is configuredZTAEntra IDMediumZTA.21800All user sign-in activity uses strong authentication methodsZTAEntra IDMediumZTA.21801Users have strong authentication methods configuredZTAEntra IDMediumZTA.21802Authenticator app shows sign-in contextZTAEntra IDMediumZTA.21807Creating new applications and service principals is restricted to privileged usersZTAEntra IDMediumZTA.21810Resource-specific consent is restrictedZTAEntra IDMediumZTA.21811Password expiration is disabledZTAEntra IDMediumZTA.21819Activation alert for Global Administrator role assignmentsZTAEntra IDMediumZTA.21821Guest access is restrictedZTAEntra IDMediumZTA.21822Guest access is limited to approved tenantsZTAEntra IDMediumZTA.21823Guest self-service sign-up via user flow is disabledZTAEntra IDMediumZTA.21824Guests don't have long lived sign-in sessionsZTAEntra IDMediumZTA.21825Privileged user sessions don't have long lived sign-in sessionsZTAEntra IDMediumZTA.21831Conditional Access protected actions are enabledZTAEntra IDMediumZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitZTAEntra IDMediumZTA.21849Smart lockout duration is set to a minimum of 60ZTAEntra IDMediumZTA.21850Smart lockout threshold isn't greater than 10ZTAEntra IDMediumZTA.21851Guest access is protected by strong authentication methodsZTAEntra IDMediumZTA.21854Privileged roles aren't assigned to stale identitiesZTAEntra IDMediumZTA.21855Privileged roles have access reviewsZTAEntra IDMediumZTA.21857Guest identities are lifecycle managed with access reviewsZTAEntra IDMediumZTA.21858Inactive guest identities are disabled or removed from the tenantZTAEntra IDMediumZTA.21859GDAP admin least privilegeZTAEntra IDMediumZTA.21862All risky workload identities are triagedZTAEntra IDMediumZTA.21865Named locations are configuredZTAEntra IDMediumZTA.21866All Microsoft Entra recommendations are addressedZTAEntra IDMediumZTA.21868Guests do not own apps in the tenantZTAEntra IDMediumZTA.21869Enterprise applications must require explicit assignment or scoped provisioningZTAEntra IDMediumZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredZTAEntra IDMediumZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationZTAEntra IDMediumZTA.21876Use PIM for Microsoft Entra privileged rolesZTAEntra IDMediumZTA.21877All guests have a sponsorZTAEntra IDMediumZTA.21878All entitlement management policies have an expiration dateZTAEntra IDMediumZTA.21879All entitlement management policies that apply to External users require approvalZTAEntra IDMediumZTA.21882No nested groups in PIM for groupsZTAEntra IDMediumZTA.21883Workload Identities are configured with risk-based policiesZTAEntra IDMediumZTA.21884Workload identities based on known networks are configuredZTAEntra IDMediumZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredZTAEntra IDMediumZTA.21887All registered redirect URIs must have proper DNS records and ownershipsZTAEntra IDMediumZTA.21890Require password reset notifications for user rolesZTAEntra IDMediumZTA.21892All sign-in activity comes from managed devicesZTAEntra IDMediumZTA.21896Service principals don't have certificates or credentials associated with themZTAEntra IDMediumZTA.21897All app assignment and group membership is governedZTAEntra IDMediumZTA.21898All supported access lifecycle resources are managed with entitlement management packagesZTAEntra IDMediumZTA.21899All privileged role assignments have a recipient that can receive notificationsZTAEntra IDMediumZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesZTAEntra IDMediumZTA.21941Token protection policies are configuredZTAEntra IDMediumZTA.21983No Active Medium priority Entra recommendations foundZTAEntra IDMediumZTA.21985Turn off Seamless SSO if there is no usageZTAEntra IDMediumZTA.22072Self-Service Password Reset does not use Q & AZTAEntra IDMediumZTA.24518Enterprise applications have ownersZTAEntra IDMediumZTA.24552macOS - Firewall policy is created and assignedZTAIntuneMediumZTA.24823Company Portal branding and support settings enhance user experience and trustZTAIntuneMediumZTA.25370Source IP restoration is enabledZTAEntra IDMediumZTA.25379Conditional Access policies use compliant network controlsZTAEntra IDMediumZTA.25380Global Secure Access signaling for Conditional Access is enabledZTAEntra IDMediumZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesZTAEntra IDMediumZTA.25392Private network connectors are running the latest versionZTAEntra IDMediumZTA.25399Private DNS is configured for internal name resolutionZTAEntra IDMediumZTA.25405Intelligent Local Access is enabled and configuredZTAEntra IDMediumZTA.25408Web content filtering policies are configuredZTAEntra IDMediumZTA.25409Web content filtering uses category-based rulesZTAEntra IDMediumZTA.25410Web content filtering policies are linked to security profilesZTAEntra IDMediumZTA.25419Network access activity is visible to security operations for threat detection and responseZTAEntra IDMediumZTA.25422Global Secure Access deployment logs are populated and reviewedZTAEntra IDMediumZTA.25480Quick Access has user or group assignmentsZTAEntra IDMediumZTA.26885Metrics are enabled for DDoS-protected public IPsZTAAzureMediumZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsZTAAzureMediumZTA.27001TLS inspection bypass rules are regularly reviewedZTAEntra IDMediumZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFZTAAzureMediumZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFZTAAzureMediumZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFZTAAzureMediumZTA.35006PDF labeling is enabled in SharePointZTAPurviewMediumZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAPurviewMediumZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAPurviewMediumZTA.35012Container labels are configured for collaborative workspacesZTAPurviewMediumZTA.35014Email label policies inherit sensitivity from attachmentsZTAPurviewMediumZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAPurviewMediumZTA.35017A default sensitivity label is configured in label policiesZTAPurviewMediumZTA.35018Users must provide justification to downgrade sensitivity labelsZTAPurviewMediumZTA.35022On-demand scans are configured for sensitive information discoveryZTAPurviewMediumZTA.35023OCR is enabled for sensitive information detectionZTAPurviewMediumZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAPurviewMediumZTA.35028Email retention policies are configuredZTAPurviewMediumZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAExchange OnlineMediumZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAPurviewMediumZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAPurviewMediumZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAPurviewMediumZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageZTADefenderMediumZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedZTADefenderMediumZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsZTADefenderMediumZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxZTADefenderMediumZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsZTADefenderMediumZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersZTAIntuneMediumZTA.41051Removable storage and device control policies are enforced via IntuneZTAIntuneMediumZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalZTADefenderMediumZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeZTAAzureMediumZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceZTAAzureMediumZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesZTAAzureMediumZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelZTAAzureMediumZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelZTAAzureMediumZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelZTAAzureMediumZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksZTAAzureMediumZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseZTAAzureMediumZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseZTAAzureMediumZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantZTAAzureMediumZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementZTAAzureMediumZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)ZTAAzureMediumZTA.51019MAM app access timeout and re-authentication are enforced after idle periodZTAIntuneMediumZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)ZTAEntra IDMediumZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeZTAEntra IDMediumZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMediumAD-DFSR-01All domain controllers should have DFS-R subscriptionsActive DirectoryLowAD-GPO-04Unlinked GPO count should be compliantActive DirectoryLowAD-GPO-05GPO unlinked details should be compliantActive DirectoryLowAD-GPOL-03GPO unlinked target count should be compliantActive DirectoryLowAD-GPOREP-06GPOs without domain computers count should be retrievableActive DirectoryLowAD-REPL-01No replication connections should be disabledActive DirectoryLowAD-ROOTDSE-03Root DSE should be synchronizedActive DirectoryLowASD.ISM-1654Internet Explorer 11 is disabled or removed.New in 3.0IntuneLowAZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0Azure DevOpsLowAZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0Azure DevOpsLowCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Microsoft 365LowCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0PurviewLowCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0Entra IDLowCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0Entra IDLowCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Entra IDLowCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Entra IDLowCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Entra IDLowCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Entra IDLowCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0Exchange OnlineLowCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Exchange OnlineLowCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0Exchange OnlineLowCIS.M365.8.5.6Ensure only organizers and co-organizers can presentNew in 3.0TeamsLowCIS.M365.8.5.9Ensure meeting recording is off by defaultNew in 3.0TeamsLowCIS.M365.9.1.3Restrict guest browsing of Fabric contentNew in 3.0Microsoft FabricLowCIS.M365.9.1.7Restrict organization-wide Fabric linksNew in 3.0Microsoft FabricLowCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDLowEIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDLowEIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDLowEIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDLowEIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDLowEIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDLowEIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDLowEIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDLowEIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDLowMT.1022All users utilizing a P1 license should be licensed.Entra IDLowMT.1023All users utilizing a P2 license should be licensed.Entra IDLowMT.1037Only users with Presenter role are allowed to present in Teams meetingsTeamsLowMT.1039Ensure MailTips are enabled for end usersExchange OnlineLowMT.1044Ensure modern authentication for Exchange Online is enabledExchange OnlineLowMT.1053Ensure intune device clean-up rule is configuredIntuneLowMT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.Entra IDLowMT.1067Authentication method policies should not reference non-existent groups.Entra IDLowMT.1069Restrict non-admin users from creating security groups.Entra IDLowMT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainExchange OnlineLowMT.1076MOERA SHOULD NOT be used for sent mailExchange OnlineLowMT.1083Ensure Delicensing Resiliency is enabledExchange OnlineLowMT.1085Pending approvals for Critical Asset Management should not be present.DefenderLowMT.1086Devices should not share both critical and non-critical user credentials.DefenderLowMT.1099Windows Diagnostic Data Processing should be enabledIntuneLowMT.1101Default Branding Profile should be customizedIntuneLowMT.1105Ensure MDM Authority is set to IntuneIntuneLowMT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).Entra IDLowMT.1107Access packages and catalogs should not reference deleted groups.Entra IDLowMT.1108Access packages should not reference inactive or orphaned assignment policies.Entra IDLowMT.1109Access package approval workflows must have valid approvers.Entra IDLowMT.1110No catalog should contain resources without any associated access packages.Entra IDLowMT.1111High privileged user should be linked to an identity.-IncludePreviewDefenderLowMT.1117Published AI agents should not be dormant.Copilot StudioLowMT.1155Full Scan Mapped Drives should be disabled for performance.DefenderLowMT.1157CPU Load Factor should be optimized (20-30%).DefenderLowMT.1158Scan should be scheduled.DefenderLowMT.1160Signatures should be checked before scan.DefenderLowMT.1162Cloud Extended Timeout should be 30-50 seconds.DefenderLowMT.1163Signature Update Interval should be 1-4 hours.DefenderLowMT.1168Cleaned Malware should be retained for at least 30 days.DefenderLowMT.1169Catch-up Full Scan should be disabled.DefenderLowMT.1170Catch-up Quick Scan should be disabled.DefenderLowMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.PurviewLowMT.1190Entra Private Access applications should not use the Default connector group.-IncludePreviewEntra IDLowMT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreviewEntra IDLowMT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreviewEntra IDLowMT.1199App registration credentials should not be expired or expiring soon.Entra IDLowMT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0Entra IDLowMT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0IntuneLowMT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0IntuneLowMT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0IntuneLowMT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0IntuneLowMT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0IntuneLowMT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0IntuneLowMT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0IntuneLowORCA.100Bulk Complaint Level threshold is between 4 and 6.DefenderLowORCA.101Bulk is marked as spam.DefenderLowORCA.102Advanced Spam filter options are turned off.DefenderLowORCA.106Quarantine retention period is 30 days.DefenderLowORCA.107End-user spam notification is enabled.DefenderLowORCA.110Internal Sender notifications are disabled.DefenderLowORCA.139Spam action set to move message to junk mail folder or quarantine.DefenderLowORCA.141Bulk action set to Move message to Junk Email Folder.DefenderLowORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.DefenderLowORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.DefenderLowORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.DefenderLowZTA.21775Tenant app management policy is configuredZTAEntra IDLowZTA.21812Maximum number of Global Administrators doesn't exceed eight usersZTAEntra IDLowZTA.21813High Global Administrator to privileged user ratioZTAEntra IDLowZTA.21816All privileged role assignments are managed with PIMZTAEntra IDLowZTA.21820Activation alert for all privileged role assignmentsZTAEntra IDLowZTA.21833Directory Sync account credentials haven't been rotated recentlyZTAEntra IDLowZTA.21834Directory sync account is locked down to specific named locationZTAEntra IDLowZTA.21835Emergency account existsZTAEntra IDLowZTA.21837Limit the maximum number of devices per user to 10ZTAEntra IDLowZTA.21838Security key authentication method enabledZTAEntra IDLowZTA.21839Passkey authentication method enabledZTAEntra IDLowZTA.21840Security key attestation is enforcedZTAEntra IDLowZTA.21841Authenticator app report suspicious activity is enabledZTAEntra IDLowZTA.21842Block administrators from using SSPRZTAEntra IDLowZTA.21843Block legacy Microsoft Online PowerShell moduleZTAEntra IDLowZTA.21844Block legacy Azure AD PowerShell moduleZTAEntra IDLowZTA.21845Temporary access pass is enabledZTAEntra IDLowZTA.21846Temporary access pass restricted to one-time useZTAEntra IDLowZTA.21848Enable custom banned passwordsZTAEntra IDLowZTA.21867All enterprise applications have ownersZTAEntra IDLowZTA.21870Enable SSPRZTAEntra IDLowZTA.21889Reduce the user-visible password surface areaZTAEntra IDLowZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationZTAEntra IDLowZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityZTAEntra IDLowZTA.21895Application Certificate Credentials are managed using HSMZTAEntra IDLowZTA.21953Local Admin Password Solution is deployedZTAEntra IDLowZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesZTAEntra IDLowZTA.21955Manage the local administrators on Microsoft Entra joined devicesZTAEntra IDLowZTA.21964Enable protected actions to secure Conditional Access policy creation and changesZTAEntra IDLowZTA.21984No Active low priority Entra recommendations foundZTAEntra IDLowZTA.24576Intune Endpoint Analytics policy is created and AssignedZTAIntuneLowZTA.25400DNS traffic for internal domains is routed through Private AccessZTAEntra IDLowZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsZTAEntra IDLowZTA.35004Sensitivity label policies are published to usersZTAPurviewLowZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAPurviewLowZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAPurviewLowZTA.35010Double Key Encryption labels are configuredZTAPurviewLowZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAPurviewLowZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorZTAAzureLowZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingZTAAzureLowZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesZTAAzureLowAD-CFG-01Tombstone lifetime configuration should be retrievableActive DirectoryInfoAD-CFG-02dSHeuristics count should be retrievableActive DirectoryInfoAD-CFG-03SPN mappings should be retrievableActive DirectoryInfoAD-CFG-04Optional features count should be retrievableActive DirectoryInfoAD-CFG-05Recycle bin enabled paths should be retrievableActive DirectoryInfoAD-CFG-06LDAP query policy count should be retrievableActive DirectoryInfoAD-CFG-07Default query policy should be retrievableActive DirectoryInfoAD-CFG-08AuthN policy container count should be retrievableActive DirectoryInfoAD-CFG-09AD activation objects count should be retrievableActive DirectoryInfoAD-CFG-10Well-known security principals count should be retrievableActive DirectoryInfoAD-CFG-11Registered DHCP servers count should be retrievableActive DirectoryInfoAD-CFG-12Enterprise CA count should be retrievableActive DirectoryInfoAD-CFG-13Certificate templates count should be retrievableActive DirectoryInfoAD-CFG-14Enrollment templates count should be retrievableActive DirectoryInfoAD-CFG-15Enrollment CA certificate details should be retrievableActive DirectoryInfoAD-CFG-16Trusted root CA count should be retrievableActive DirectoryInfoAD-CFG-17Trusted root CA details should be retrievableActive DirectoryInfoAD-CFG-18Intermediate CA count should be retrievableActive DirectoryInfoAD-CFG-19Intermediate CA details should be retrievableActive DirectoryInfoAD-CFG-20CRL distribution points count should be retrievableActive DirectoryInfoAD-CFG-21NTAuth certificates count should be retrievableActive DirectoryInfoAD-CFG-22KDS root key count should be acceptableActive DirectoryInfoAD-CFG-23SMTP site links count should be retrievableActive DirectoryInfoAD-CFG-24IP site links count should be retrievableActive DirectoryInfoAD-COMP-01Computer disabled count should be retrievableActive DirectoryInfoAD-COMP-02Computer dormant count should be retrievableActive DirectoryInfoAD-COMP-03Computer CreatorSid count should be retrievableActive DirectoryInfoAD-COMP-04Computer non-standard primary group count should be retrievableActive DirectoryInfoAD-COMP-05Computer SID History count should be retrievableActive DirectoryInfoAD-COMP-06Computer default container count should be retrievableActive DirectoryInfoAD-COMP-07Computer OU count should be retrievableActive DirectoryInfoAD-COMP-08Computer per OU average should be retrievableActive DirectoryInfoAD-COMP-09Computer delegation count should be retrievableActive DirectoryInfoAD-COMP-10Computer delegation details should be retrievableActive DirectoryInfoAD-DACL-01Distinct DACL object count should be investigatedActive DirectoryInfoAD-DACL-02OU DACL entry count should be investigatedActive DirectoryInfoAD-DACL-03Conflict object count should be investigatedActive DirectoryInfoAD-DACL-04Conflict object details should be investigatedActive DirectoryInfoAD-DACL-05Deny ACE count should be investigatedActive DirectoryInfoAD-DACL-06Deny ACE details should be investigatedActive DirectoryInfoAD-DACL-07Distinct DACL identity count should be investigatedActive DirectoryInfoAD-DACL-08DACL ACE distribution per identity should be investigatedActive DirectoryInfoAD-DACL-09Privileged allow ACE count should be investigatedActive DirectoryInfoAD-DACL-10Privileged allow ACE details should be investigatedActive DirectoryInfoAD-DACL-11Privileged extended right count should be investigatedActive DirectoryInfoAD-DACL-12Privileged extended right details should be investigatedActive DirectoryInfoAD-DACL-13Privileged extended right identities should be investigatedActive DirectoryInfoAD-DACL-14Non-inherited ACE count should be investigatedActive DirectoryInfoAD-DACL-15Unresolved SID count should be investigatedActive DirectoryInfoAD-DACL-16Unresolved SID details should be investigatedActive DirectoryInfoAD-DACL-17Inherited object type count should be investigatedActive DirectoryInfoAD-DACL-18Inherited object type details should be investigatedActive DirectoryInfoAD-DC-01DC site coverage count should be retrievableActive DirectoryInfoAD-DC-03SMBv3.1.1 enabled count should be retrievableActive DirectoryInfoAD-DC-05DCs with all FSMO roles count should be retrievableActive DirectoryInfoAD-DC-06FSMO role holder details should be retrievableActive DirectoryInfoAD-DC-07DC operating system count should be retrievableActive DirectoryInfoAD-DC-08DC operating system details should be retrievableActive DirectoryInfoAD-DCD-01DC non-standard LDAP port count should be retrievableActive DirectoryInfoAD-DCD-02DC non-standard LDAPS port count should be retrievableActive DirectoryInfoAD-DCD-03Read-only domain controller count should be retrievableActive DirectoryInfoAD-DCD-04Non-Global Catalog DC count should be retrievableActive DirectoryInfoAD-DCOMP-01Computers with unconstrained delegation count should be investigatedActive DirectoryInfoAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedActive DirectoryInfoAD-DCOMP-04Computer operating system count should be investigatedActive DirectoryInfoAD-DCOMP-05Computer operating system details should be investigatedActive DirectoryInfoAD-DCOMP-07Computer DNS host name count should be investigatedActive DirectoryInfoAD-DCOMP-08Computer DNS zone count should be investigatedActive DirectoryInfoAD-DCOMP-09Computer DNS zone details should be investigatedActive DirectoryInfoAD-DNS-01DNS zone count should be retrievableActive DirectoryInfoAD-DNS-02Zones with only SOA/NS records should be retrievableActive DirectoryInfoAD-DNS-03Root servers with incorrect IPs should be retrievableActive DirectoryInfoAD-DNS-04Root server incorrect IP details should be retrievableActive DirectoryInfoAD-DNS-05Dynamic DNS record count should be retrievableActive DirectoryInfoAD-DNS-06Zones with non-default records should be retrievableActive DirectoryInfoAD-DNS-07Zone record count details should be retrievableActive DirectoryInfoAD-DNS-08Zone delegation count should be retrievableActive DirectoryInfoAD-DNS-09Zone delegation details should be retrievableActive DirectoryInfoAD-DNS-10SOA record details should be retrievableActive DirectoryInfoAD-DNS-11AD DS SRV record count should be retrievableActive DirectoryInfoAD-DNS-12AD DS SRV record details should be retrievableActive DirectoryInfoAD-DNS-13DNSSEC record count should be retrievableActive DirectoryInfoAD-DNS-14Empty zone count should be retrievableActive DirectoryInfoAD-DNS-15Duplicate zone count should be retrievableActive DirectoryInfoAD-DNS-16Reverse lookup zone count should be retrievableActive DirectoryInfoAD-DNS-17Non-standard zone count should be retrievableActive DirectoryInfoAD-DNS-18Reverse zone network count should be retrievableActive DirectoryInfoAD-DNS-19Reverse zone network details should be retrievableActive DirectoryInfoAD-DOM-01Domain functional level should be retrievableActive DirectoryInfoAD-DOM-02Machine account quota should be retrievableActive DirectoryInfoAD-DOM-03Domain controller count should be retrievableActive DirectoryInfoAD-DOM-04RIDs remaining should be retrievableActive DirectoryInfoAD-DOM-05Domain name standard compliance should be retrievableActive DirectoryInfoAD-DOM-06Domain name non-standard details should be retrievableActive DirectoryInfoAD-DOM-07NetBIOS name standard compliance should be retrievableActive DirectoryInfoAD-DOM-08NetBIOS name non-standard details should be retrievableActive DirectoryInfoAD-DOMS-01Allowed DNS suffixes count should be retrievableActive DirectoryInfoAD-FEAT-01Optional feature count should be investigatedActive DirectoryInfoAD-FEAT-02Optional feature enabled details should be investigatedActive DirectoryInfoAD-FGPP-01Fine-grained password policy count should be retrievableActive DirectoryInfoAD-FGPP-02Fine-grained password policy value count should be retrievableActive DirectoryInfoAD-FGPP-03Fine-grained password policy setting counts should be retrievableActive DirectoryInfoAD-FGPP-04Fine-grained password policy application targets should be retrievableActive DirectoryInfoAD-FOR-01Forest functional level should be retrievableActive DirectoryInfoAD-FOR-02Forest domain count should be retrievableActive DirectoryInfoAD-FOR-03Tombstone lifetime should be retrievableActive DirectoryInfoAD-FOR-04Recycle Bin status should be retrievableActive DirectoryInfoAD-FORS-01UPN suffixes count should be retrievableActive DirectoryInfoAD-FORS-02UPN suffixes details should be retrievableActive DirectoryInfoAD-FORS-03SPN suffixes count should be retrievableActive DirectoryInfoAD-FORS-04Cross-forest references count should be retrievableActive DirectoryInfoAD-GCHG-01Average group membership changes per year should be investigatedActive DirectoryInfoAD-GMC-01Distinct groups with members count should be retrievableActive DirectoryInfoAD-GMC-02Distinct account types of members count should be retrievableActive DirectoryInfoAD-GMC-03Member account types breakdown should be retrievableActive DirectoryInfoAD-GMC-04Trust members count should be investigatedActive DirectoryInfoAD-GMC-05Trust members details by group should be investigatedActive DirectoryInfoAD-GMC-06Foreign SID principals count should be investigatedActive DirectoryInfoAD-GMC-07Foreign SID details by domain should be investigatedActive DirectoryInfoAD-GMC-08Empty non-privileged group count should be investigatedActive DirectoryInfoAD-GMC-09Empty non-privileged group details should be investigatedActive DirectoryInfoAD-GMC-10Privileged groups with members count should be investigatedActive DirectoryInfoAD-GMC-11Privileged groups with members details should be investigatedActive DirectoryInfoAD-GPO-01GPO total count should be retrievableActive DirectoryInfoAD-GPO-02GPO created before 2020 count should be retrievableActive DirectoryInfoAD-GPO-03GPO stale-before-2020 count should be investigatedActive DirectoryInfoAD-GPOL-01GPO linked count should be investigatedActive DirectoryInfoAD-GPOL-02Disabled GPO link count should be retrievableActive DirectoryInfoAD-GPOL-04Enforced GPO link count should be retrievableActive DirectoryInfoAD-GPOL-06GPO linked OU count should be retrievableActive DirectoryInfoAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedActive DirectoryInfoAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedActive DirectoryInfoAD-GPOREP-12GPO disabled link count should be retrievableActive DirectoryInfoAD-GPOREP-13GPO disabled link details should be investigatedActive DirectoryInfoAD-GPOREP-14GPO enforcement count should be investigatedActive DirectoryInfoAD-GPOS-01GPO state total count should be investigatedActive DirectoryInfoAD-GPOS-02WMI filter count should be investigatedActive DirectoryInfoAD-GPOS-03WMI filter details should be investigatedActive DirectoryInfoAD-GPOS-04Disabled GPO settings count should be investigatedActive DirectoryInfoAD-GPOS-05Computer disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-06User disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-07All disabled GPO settings details should be investigatedActive DirectoryInfoAD-GPOS-08GPO owner distinct count should be investigatedActive DirectoryInfoAD-GPOS-09GPO owner details should be investigatedActive DirectoryInfoAD-GRP-01Group AdminCount should be retrievableActive DirectoryInfoAD-GRP-02Groups in container objects count should be retrievableActive DirectoryInfoAD-GRP-03Stale groups count should be retrievableActive DirectoryInfoAD-GRP-04Groups with manager count should be retrievableActive DirectoryInfoAD-GRP-05Group SID History count should be retrievableActive DirectoryInfoAD-GRP-06Distribution group count should be retrievableActive DirectoryInfoAD-GRP-07Security group count should be retrievableActive DirectoryInfoAD-GRP-08Domain local group count should be retrievableActive DirectoryInfoAD-GRP-09Global group count should be retrievableActive DirectoryInfoAD-GRP-10Universal group count should be retrievableActive DirectoryInfoAD-KRBTGT-02KRBTGT last logon should be investigatedActive DirectoryInfoAD-MSA-01Managed service account count should be investigatedActive DirectoryInfoAD-OU-01OU overlapping name count should be retrievableActive DirectoryInfoAD-OU-02OU at domain root count should be retrievableActive DirectoryInfoAD-OU-03OU stale count should be retrievableActive DirectoryInfoAD-OU-04OU empty count should be retrievableActive DirectoryInfoAD-OU-05OU empty details should be retrievableActive DirectoryInfoAD-PRINT-01Printer total count should be retrievableActive DirectoryInfoAD-PWDPOL-01Password history count should be retrievableActive DirectoryInfoAD-PWDPOL-02Password maximum age should be retrievableActive DirectoryInfoAD-PWDPOL-03Password minimum length should be retrievableActive DirectoryInfoAD-PWDPOL-06Account lockout duration should be retrievableActive DirectoryInfoAD-PWDPOL-07Account lockout threshold should be retrievableActive DirectoryInfoAD-REPL-02Non-auto replication connection count should be investigatedActive DirectoryInfoAD-ROOTDSE-01Supported SASL mechanism count should be investigatedActive DirectoryInfoAD-ROOTDSE-02Supported SASL mechanism details should be investigatedActive DirectoryInfoAD-SCH-01Schema modification year count should be retrievableActive DirectoryInfoAD-SCH-02Schema modification year details should be retrievableActive DirectoryInfoAD-SCH-03Schema version entry count should be retrievableActive DirectoryInfoAD-SCH-04Schema version details should be retrievableActive DirectoryInfoAD-SITE-01Site total count should be retrievableActive DirectoryInfoAD-SITE-02Sites without domain controllers count should be retrievableActive DirectoryInfoAD-SITE-03Sites without domain controllers details should be retrievableActive DirectoryInfoAD-SITE-04Sites without subnet associations count should be retrievableActive DirectoryInfoAD-SITE-05Sites without subnet associations details should be retrievableActive DirectoryInfoAD-SPN-01Computer SPN service class count should be retrievableActive DirectoryInfoAD-SPN-02Computer SPN service class usage should be retrievableActive DirectoryInfoAD-SPN-03Computer SPN unknown service class count should be retrievableActive DirectoryInfoAD-SPN-04Computer SPN unknown service class details should be investigatedActive DirectoryInfoAD-SPN-05Computer SPN non-FQDN hosts should be investigatedActive DirectoryInfoAD-SPN-06User SPN total count should be investigatedActive DirectoryInfoAD-SPN-07User SPN service class count should be investigatedActive DirectoryInfoAD-SPN-08User SPN service class usage should be investigatedActive DirectoryInfoAD-SPN-09User SPN unknown service class count should be investigatedActive DirectoryInfoAD-SPN-10User SPN unknown service class details should be investigatedActive DirectoryInfoAD-SPN-11User SPN non-FQDN hosts should be investigatedActive DirectoryInfoAD-SUB-01Subnet total count should be retrievableActive DirectoryInfoAD-SUB-02Sites with subnet associations count should be retrievableActive DirectoryInfoAD-SUB-03Catch-all subnets count should be retrievableActive DirectoryInfoAD-SUB-04IPv6 subnets count should be retrievableActive DirectoryInfoAD-SUB-05IPv6 catch-all subnets count should be retrievableActive DirectoryInfoAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableActive DirectoryInfoAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableActive DirectoryInfoAD-SUB-08Distinct first octets count should be retrievableActive DirectoryInfoAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableActive DirectoryInfoAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableActive DirectoryInfoAD-SUB-11Subnets without site associations count should be retrievableActive DirectoryInfoAD-TRUST-01Trust total count should be investigatedActive DirectoryInfoAD-TRUST-02Trust inter-forest count should be investigatedActive DirectoryInfoAD-TRUST-03Trust quarantined count should be investigatedActive DirectoryInfoAD-TRUST-05Trust configuration details should be investigatedActive DirectoryInfoAD-TRUST-06Trust stale count should be investigatedActive DirectoryInfoAD-TRUST-07Trust stale details should be investigatedActive DirectoryInfoAD-USER-01Disabled user count should be retrievableActive DirectoryInfoAD-USER-02Dormant enabled user count should be retrievableActive DirectoryInfoAD-USER-03Non-expiring password user count should be retrievableActive DirectoryInfoAD-USER-04Reversible encryption user count should be retrievableActive DirectoryInfoAD-USER-05Delegation-enabled user count should be retrievableActive DirectoryInfoAD-USER-06DES-only Kerberos user count should be retrievableActive DirectoryInfoAD-USER-07No pre-authentication user count should be retrievableActive DirectoryInfoAD-USER-08Never-logged-in enabled user count should be retrievableActive DirectoryInfoAD-USER-09Password-not-required user count should be retrievableActive DirectoryInfoAD-USER-10Workstation-restricted user count should be retrievableActive DirectoryInfoAD-USER-11User AdminCount count should be retrievableActive DirectoryInfoAD-USER-12User non-standard primary group count should be retrievableActive DirectoryInfoAD-USER-13User SID History count should be retrievableActive DirectoryInfoAD-USER-14User SPN count should be retrievableActive DirectoryInfoAD-USER-15User manager count should be retrievableActive DirectoryInfoAD-USER-16User home directory count should be retrievableActive DirectoryInfoAD-USER-17User profile path count should be retrievableActive DirectoryInfoAD-USER-18User script path count should be retrievableActive DirectoryInfoAD-USER-19User in container count should be retrievableActive DirectoryInfoAD-USER-20Known service account count should be retrievableActive DirectoryInfoAD-USER-21Known service account details should be investigatedActive DirectoryInfoAD-USER-22Built-in administrator account count should be investigatedActive DirectoryInfoAD-USER-23Enabled built-in administrator details should be investigatedActive DirectoryInfoAD-USER-24Built-in administrator last logon details should be investigatedActive DirectoryInfoAD-USER-25Built-in administrator password age details should be investigatedActive DirectoryInfoAD-USER-26Honey pot user count should be investigatedActive DirectoryInfoAD-USER-27Honey pot user details should be investigatedActive DirectoryInfoAD-USER-28User delegation configured count should be investigatedActive DirectoryInfoAZDO.1009Feedback Collection.New in 3.0Azure DevOpsInfoAZDO.1011Project Resource Limits.New in 3.0Azure DevOpsInfoAZDO.1012Work Items Tags Limits.New in 3.0Azure DevOpsInfoAZDO.1029Storage Usage Limit.New in 3.0Azure DevOpsInfoAZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreviewAzure DevOpsInfoEIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDInfoMT.1159Quick Scan Time configuration is not required.DefenderInfoORCA.119Similar Domains Safety Tips is enabled.DefenderInfoORCA.123Unusual Characters Safety Tips is enabled.DefenderInfoORCA.143Safety Tips are enabled.DefenderInfoORCA.224Similar Users Safety Tips is enabled.DefenderInfo