All checks
2,195 checks4 Critical556 High1186 Medium180 Low269 Info
Run these
Invoke-MaesterAD-GPOREP-17No GPOs should contain a cpassword
Active Directory
Group PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-18No GPOs should contain a cpasswordActive DirectoryGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-SPN-12No domain admin accounts should have SPNs configuredActive Directory
Service principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-SPN-13No domain admin accounts should have SPNs configuredActive DirectoryService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-DC-02SMBv1 should be disabled on all domain controllersActive Directory
Domain controllersInfrastructure hardeningHighLowMediumT1210nist-800-53-r5:CM-7Active DirectoryAD-DC-04SMB signing should be enabled on all domain controllersActive DirectoryDomain controllersInfrastructure hardeningHighLowLowT1557nist-800-53-r5:SC-8Active DirectoryAD-DCOMP-02Non-DC computers should not have unconstrained delegationActive Directory
ComputersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryAD-GPOREP-19No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-20No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-TRUST-04No trusts should lack SID filtering (quarantine)Active Directory
TrustsExternal access and sharingHighMediumMediumT1134.005nist-800-53-r5:AC-4, nist-800-53-r5:SC-7Active DirectoryAD-USER-29No users should be configured for unconstrained delegationActive Directory
UsersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryASD.ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.New in 3.0
Entra ID
Roles and administratorsPrivileged accessHighLowMediumT1078.004, T1566essential-eight:ISM-1175, essential-eight:ISM-0445 +4ASD Essential EightASD.ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services.New in 3.0Entra ID
Conditional AccessAuthenticationHighMediumMediumT1078.004, T1110essential-eight:ISM-1504, nist-800-53-r5:IA-2(2) +1ASD Essential EightASD.ISM-1649Just-in-time administration is used for the administration of systems and their resources.New in 3.0Entra ID
Privileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003essential-eight:ISM-1649, nist-800-53-r5:AC-2(7) +2ASD Essential EightASD.ISM-1667Microsoft Office is blocked from creating child processes.New in 3.0
Intune
Endpoint securityDevices and endpointsHighLowLowT1204.002, T1566.001essential-eight:ISM-1667, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1668Microsoft Office is blocked from creating executable content.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1566.001essential-eight:ISM-1668, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1669Microsoft Office is blocked from injecting code into other processes.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1055, T1204.002essential-eight:ISM-1669, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1673Microsoft Office macros are blocked from making Win32 API calls.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1106essential-eight:ISM-1673, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release.New in 3.0Intune
Device configurationDevices and endpointsHighMediumLowT1203, T1068essential-eight:ISM-1695, nist-800-53-r5:SI-2(3) +1ASD Essential EightASD.ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant.New in 3.0Entra IDConditional AccessAuthenticationHighHighHighT1566.002essential-eight:ISM-1872, ism:ISM-1872ASD Essential EightAZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0
Azure DevOps
Security policiesAuthenticationHighMediumLowT1528, T1671—MaesterAZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumMediumT1552.004, T1098.001—MaesterAZDO.1002Log Audit Events.New in 3.0Azure DevOps
AuditingLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12, nist-800-53-r5:AU-2MaesterAZDO.1003Restrict public projects.New in 3.0Azure DevOpsSecurity policiesExternal access and sharingHighLowLowT1213.003, T1593.003nist-800-53-r5:AC-22, nist-800-53-r5:AC-3MaesterAZDO.1004Additional protections when using public package registries.New in 3.0Azure DevOpsSecurity policiesEngineering systemsHighLowLowT1195.001, T1204.005nist-800-53-r5:SR-3MaesterAZDO.1005IP Conditional Access policy validation.New in 3.0Azure DevOpsSecurity policiesAccess controlHighMediumLowT1078.004, T1550.001nist-800-53-r5:AC-17MaesterAZDO.1010Audit streaming.New in 3.0Azure DevOpsAuditingLogging and detectionHighLowMediumT1685.002, T1070nist-800-53-r5:AU-6, nist-800-53-r5:SI-4MaesterAZDO.1013Organization Owner should not be an individual.New in 3.0Azure DevOps
Users and accessPrivileged accessHighLowLowT1078.004—MaesterAZDO.1015Limit variables that can be set at queue time.New in 3.0Azure DevOps
PipelinesEngineering systemsHighLowLowT1677nist-800-53-r5:SI-10MaesterAZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6MaesterAZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6MaesterAZDO.1018Protect access to repositories in YAML pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterAZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0Azure DevOpsPipelinesEngineering systemsHighLowLowT1677—MaesterAZDO.1023Disable Marketplace tasks.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumHighT1195.001nist-800-53-r5:CM-7, nist-800-53-r5:CM-11MaesterAZDO.1025Enable shell tasks arguments validation.New in 3.0Azure DevOpsPipelinesEngineering systemsHighLowLowT1059, T1677nist-800-53-r5:SI-10MaesterAZDO.1030Project Collection Administrators.New in 3.0Azure DevOpsUsers and accessPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterAZDO.1031Validate SSH Key Expiration.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumLowT1552.004nist-800-53-r5:IA-5MaesterAZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1552.001, T1593.003 +1nist-800-53-r5:IA-5MaesterAZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumLowT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:AC-6MaesterAZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumMediumT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0Azure DevOps
RepositoriesEngineering systemsHighLowMediumT1552.001nist-800-53-r5:IA-5(7)MaesterAZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0Azure DevOpsRepositoriesEngineering systemsHighLowLowT1552.001nist-800-53-r5:IA-5(7)MaesterCIS.GH.1.2.3Ensure repository deletion is limited to specific users
GitHub
Organization settingsAccess controlHighLowLowT1485, T1070cis-github:1.2.3, nist-800-53-r5:AC-6CISCIS.GH.1.3.8Ensure strict base permissions are set for repositoriesGitHubOrganization settingsAccess controlHighMediumMediumT1677, T1195.002cis-github:1.3.8, nist-800-53-r5:AC-6 +1CISCIS.M365.1.1.1Ensure Administrative accounts are cloud-only
Microsoft 365Administrative accountsPrivileged accessHighLowMediumT1078.002, T1078.004 +1cis-m365:1.1.1, nist-800-53-r5:AC-6(5)CISCIS.M365.1.1.3Ensure that between two and four global admins are designatedMicrosoft 365Administrative accountsPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:1.1.3, nist-800-53-r5:AC-6(5)CISCIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabled
Defender
Safe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002cis-m365:2.1.4, nist-800-53-r5:SI-3CISCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0Defender
Anti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002cis-m365:2.1.14, nist-800-53-r5:SI-8CISCIS.M365.3.1.1Ensure Microsoft 365 audit log search is Enabled
PurviewAuditLogging and detectionHighLowLowT1685.002cis-m365:3.1.1, nist-800-53-r5:AU-12CISCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedEntra ID
App consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002cis-m365:5.1.5.1, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledEntra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528cis-m365:5.1.5.2, nist-800-53-r5:CM-4CISCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110.003cis-m365:5.2.2.1, nist-800-53-r5:IA-2(1)CISCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110cis-m365:5.2.2.2, nist-800-53-r5:IA-2(2)CISCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.2.3, nist-800-53-r5:CM-7CISCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1111cis-m365:5.2.2.5, nist-800-53-r5:IA-2(1) +1CISCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Entra IDConditional AccessAuthenticationHighLowMediumT1078.004, T1528 +1cis-m365:5.2.2.12, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Entra ID
Authentication methodsAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.3.4, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.5Ensure weak authentication methods are disabledEntra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cis-m365:5.2.3.5, nist-800-53-r5:CM-7 +1CISCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:5.3.1, nist-800-53-r5:AC-6(5)CISCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0
Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1685.002cis-m365:6.1.1, nist-800-53-r5:AU-12CISCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Exchange Online
Mail flowExternal access and sharingHighMediumLowT1114.003cis-m365:6.2.1, nist-800-53-r5:AC-4CISCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Exchange Online
Client accessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:6.5.4, nist-800-53-r5:CM-7CISCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.1, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.3, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighHighHighT1566.002cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1) +4CISA SCuBACISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.3.2, nist-800-53-r5:IA-2(1) +1CISA SCuBACISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cisa-scuba:MS.AAD.3.5, nist-800-53-r5:CM-7b +1CISA SCuBACISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1566.002cisa-scuba:MS.AAD.3.6, nist-800-53-r5:IA-2(1) +3CISA SCuBACISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra ID
Logs and monitoringLogging and detectionHighLowMediumT1685.002cisa-scuba:MS.AAD.4.1, nist-800-53-r5:AU-4CISA SCuBACISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1098.001, T1098.003 +2cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.3, nist-800-53-r5:CM-4CISA SCuBACISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1078.004cisa-scuba:MS.AAD.7.1, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.2, nist-800-53-r5:AC-5CISA SCuBACISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1cisa-scuba:MS.AAD.7.3, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.4, nist-800-53-r5:AC-2CISA SCuBACISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.5, nist-800-53-r5:AC-2CISA SCuBACISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineMail flowEmail and collaboration protectionHighMediumLowT1114.003, T1048 +1cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange Online
Email authenticationEmail and collaboration protectionHighMediumHighT1566, T1598 +1cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineClient accessAuthenticationHighMediumMedium—cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange Online
Data loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.1, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.4, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange Online
Anti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.10.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange Online
Anti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1070.008, T1098.002 +3cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12cCISA SCuBACISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionHighLowLowT1566cisa-scuba:MS.EXO.14.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange Online
Safe LinksEmail and collaboration protectionHighLowLowT1204.001, T1566.002cisa-scuba:MS.EXO.15.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange Online
Alert policiesLogging and detectionHighLowLowT1114.003, T1204.001cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineAudit loggingLogging and detectionHighLowLowT1685.002cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12CISA SCuBADISA.V-267334Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0Intune
Tenant administrationLogging and detectionHighLowMediumT1685.002disa-stig-intune-desktop:V-267334, nist-800-53-r5:AU-4(1) +1DISA STIGsDISA.V-267341Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts.New in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110disa-stig-intune-desktop:V-267341, nist-800-53-r5:IA-2(1) +1DISA STIGsDISA.V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.New in 3.0Entra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002disa-stig-entra-id:V-270227, nist-800-53-r5:AU-4(1) +1DISA STIGsDISA.V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA).New in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110disa-stig-entra-id:V-270233, nist-800-53-r5:IA-2(1) +1DISA STIGsDISA.V-270335Microsoft Entra ID must use Privileged Identity Management (PIM).New in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003disa-stig-entra-id:V-270335, nist-800-53-r5:AC-2(2)DISA STIGsDISA.V-273868Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneTenant administrationLogging and detectionHighLowMediumT1685.002disa-stig-intune-mdm:V-273868, nist-800-53-r5:AU-4(1) +1DISA STIGsEIDSCA.AF01Authentication Method - FIDO2 security key - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDAuthentication methodsAuthenticationHighLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra ID
User and directory settingsPrivileged accessHighLowLowT1098nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDAuthentication methodsAuthenticationHighLowLowT1111, T1566.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AV01Authentication Method - Voice call - State.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1621nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra ID
Password protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)MT.1003At least one Conditional Access policy is configured with All Apps.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004—MaesterMT.1004At least one Conditional Access policy is configured with All Apps and All Users.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004—MaesterMT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.Entra IDConditional AccessPrivileged accessHighLowLow——MaesterMT.1006At least one Conditional Access policy is configured to require MFA for admins.Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1)MaesterMT.1007At least one Conditional Access policy is configured to require MFA for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1008At least one Conditional Access policy is configured to require MFA for Azure management.Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1009At least one Conditional Access policy is configured to block other legacy authentication.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1098.005nist-800-53-r5:AC-17, nist-800-53-r5:IA-5MaesterMT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1539 +1nist-800-53-r5:IA-3, nist-800-53-r5:AC-2(11)MaesterMT.1016At least one Conditional Access policy is configured to require MFA for guest access.Entra IDConditional AccessAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20MaesterMT.1021Security Defaults are enabled.Entra IDUser and directory settingsAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1025No external user with permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)MaesterMT.1026No hybrid user with permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1556.007 +1nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)MaesterMT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1552nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5MaesterMT.1028No user with mailbox and permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1566nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-6(2)MaesterMT.1029Stale accounts are not assigned to privileged roles.Entra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-2(3), nist-800-53-r5:AC-6(5)MaesterMT.1030Eligible role assignments on Control Plane are in use by administrators.Entra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-6, nist-800-53-r5:AC-2(3)MaesterMT.1031Privileged role on Control Plane are managed by PIM only.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-2(7), nist-800-53-r5:AC-6(5)MaesterMT.1032Limited number of Global Admins are assigned.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1033Users should be blocked from using legacy authentication.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1034Emergency access users should not be blocked.Entra IDConditional AccessPrivileged accessHighLowLow——MaesterMT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.Entra IDConditional AccessPrivileged accessHighLowMediumT1098, T1556.009nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.Entra IDConditional AccessAccess controlHighLowLowT1078.004nist-800-53-r5:AC-2(12)MaesterMT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreviewEntra IDApp consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreviewEntra IDApp consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.Entra IDConditional AccessAuthenticationHighLowLowT1078.004, T1528 +1nist-800-53-r5:CM-7, nist-800-53-r5:IA-2MaesterMT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scope
AzureAccess managementPrivileged accessHighLowLowT1078.004, T1098.003nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2MaesterMT.1063All App registration owners should have MFA registeredEntra IDAuthentication methodsAuthenticationHighLowLowT1078.004, T1098.001 +1nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-6MaesterMT.1065Ensure all Recovery Services Vaults have soft delete enabledAzure
BackupData protectionHighLowLowT1490, T1485nist-800-53-r5:CP-9MaesterMT.1072Conditional Access policies should not use the deprecated Approved Client App grant.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3MaesterMT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.Entra ID
Hybrid identityAuthenticationHighMediumMediumT1110, T1558.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-2MaesterMT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.Defender
Exposure ManagementDevices and endpointsHighLowMediumT1190—Exposure management (XSPM)MT.1092Intune APNS certificate should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1095Android Enterprise account connection should be healthyIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1097Ensure all Intune Certificate Connectors are healthy and running supported versionsIntuneTenant administrationDevices and endpointsHighLowMedium——MaesterMT.1098Mobile Threat Defense Connectors should be healthyIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1100Intune Diagnostic Settings should include Audit LogsIntuneTenant administrationLogging and detectionHighLowMediumT1685.002nist-800-53-r5:AU-12MaesterMT.1102Windows Feature Update Policy Settings should not reference end of support buildsIntuneDevice configurationDevices and endpointsHighMediumMedium—nist-800-53-r5:SI-2MaesterMT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groupsIntuneTenant administrationPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1113AI agents should not be shared with broad access control policies.
Copilot Studio
AgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:AC-3MaesterMT.1114AI agents should require user authentication.Copilot StudioAgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:IA-2MaesterMT.1116AI agents should not send email with AI-controlled inputs.Copilot StudioAgentsAI and agentsHighLowMediumT1048nist-800-53-r5:AC-4MaesterMT.1119AI agents should not have hard-coded credentials in topics.Copilot StudioAgentsAI and agentsHighLowMediumT1552nist-800-53-r5:IA-5(7)MaesterMT.1123Ensure BitLocker full disk encryption is configuredIntuneEndpoint securityDevices and endpointsHighLowMediumT1005nist-800-53-r5:SC-28(1)MaesterMT.1147Do not sync krbtgt_AzureAD to Entra ID.Entra IDHybrid identityInfrastructure hardeningHighLowLowT1558nist-800-53-r5:IA-5, nist-800-53-r5:AC-6MaesterMT.1149Behavior Monitoring should be enabled.Defender
Endpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1150Cloud Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1152Script Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1059nist-800-53-r5:SI-3MaesterMT.1153Real-time Monitoring should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1165Network Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.001, T1189 +1nist-800-53-r5:SI-3MaesterMT.1172Unified audit log ingestion is enabled.PurviewAuditLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12MaesterMT.1178Ensure ASR Rules are configured correctly.IntuneEndpoint securityDevices and endpointsHighLowLowT1003.001, T1546.003 +1nist-800-53-r5:CM-7, nist-800-53-r5:SI-3MaesterMT.1179Ensure App Control for Business is enabled.IntuneEndpoint securityDevices and endpointsHighHighHighT1204.002nist-800-53-r5:CM-7(5)MaesterMT.1181Conditional Access policy is present that blocks high agent risk sign-ins.Entra IDConditional AccessAI and agentsHighLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13)MaesterMT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6, nist-800-53-r5:AC-20MaesterMT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowMediumT1078.004nist-800-53-r5:AC-6MaesterMT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowLowT1557nist-800-53-r5:SC-23, nist-800-53-r5:SC-8MaesterMT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.Intune
Device enrollmentPrivileged accessHighLowLowT1078.003, T1021 +1nist-800-53-r5:IA-5MaesterMT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1259Baseline scope sign-ins should be subject to Conditional Access.New in 3.0-IncludePreviewEntra IDConditional AccessAccess controlHighMediumMediumT1078.004, T1087.004nist-800-53-r5:AC-3MaesterORCA.104High Confidence Phish action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566nist-800-53-r5:SI-8ORCAORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderAnti-spamEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.124Safe attachments unknown malware response set to block messages.DefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.189.2Safe Links is not bypassed.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.239No exclusions for the built-in protection policies.DefenderSafe LinksEmail and collaboration protectionHighLowLowT1566.001, T1566.002nist-800-53-r5:SI-3ORCAORCA.242Important protection alerts responsible for AIR activities are enabled.Defender
Tenant settingsLogging and detectionHighLowLowT1566nist-800-53-r5:SI-4(5)ORCAZTA.21771Inactive applications don’t have highly privileged built-in rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21772Applications don't have client secrets configuredZTAEntra ID
ApplicationsApplications and workload identitiesHighLowMediumT1552, T1078.004—Microsoft Zero Trust AssessmentZTA.21774Microsoft services applications don't have credentials configuredZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21776User consent settings are restrictedZTAEntra IDApp consent and permissionsApplications and workload identitiesHighHighMediumT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21777App instance property lock is configured for all multitenant applicationsZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1098.001—Microsoft Zero Trust AssessmentZTA.21781Privileged users sign in with phishing-resistant methodsZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21782Privileged accounts have phishing-resistant methods registeredZTAEntra IDAuthentication methodsPrivileged accessHighLowMediumT1566.002, T1557—Microsoft Zero Trust AssessmentZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21786User sign-in activity uses token protectionZTAEntra IDConditional AccessAuthenticationHighLowLowT1550.001, T1550.004—Microsoft Zero Trust AssessmentZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleZTAEntra IDUser and directory settingsAccess controlHighMediumMedium——Microsoft Zero Trust AssessmentZTA.21788Global Administrators don't have standing access to Azure subscriptionsZTAAzureAccess managementPrivileged accessHighLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21790Outbound cross-tenant access settings are configuredZTAEntra ID
External identitiesExternal access and sharingHighMediumHighT1537, T1199—Microsoft Zero Trust AssessmentZTA.21793Tenant restrictions v2 policy is configuredZTAEntra IDExternal identitiesExternal access and sharingHighLowMediumT1567, T1537—Microsoft Zero Trust AssessmentZTA.21797Restrict access to high risk usersZTAEntra IDConditional AccessAuthenticationHighHighMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21798ID Protection notifications are enabledZTAEntra ID
Identity ProtectionLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21799Restrict high risk sign-insZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110—Microsoft Zero Trust AssessmentZTA.21803Migrate from legacy MFA and SSPR policiesZTAEntra IDAuthentication methodsAuthenticationHighMediumMedium——Microsoft Zero Trust AssessmentZTA.21804SMS and Voice Call authentication methods are disabledZTAEntra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1—Microsoft Zero Trust AssessmentZTA.21806Secure the MFA registration (My Security Info) pageZTAEntra IDConditional AccessAuthenticationHighLowMediumT1556.006, T1078.004—Microsoft Zero Trust AssessmentZTA.21808Restrict device code flowZTAEntra IDConditional AccessAuthenticationHighMediumLowT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21809Admin consent workflow is enabledZTAEntra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528—Microsoft Zero Trust AssessmentZTA.21814Privileged accounts are cloud native identitiesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1—Microsoft Zero Trust AssessmentZTA.21815All privileged role assignments are activated just in time and not permanently activeZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowHighT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21817Global Administrator role activation triggers an approval workflowZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1548.005—Microsoft Zero Trust AssessmentZTA.21818Privileged role activations have monitoring and alerting configuredZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21828Secure the MFA registration (My Security Info) pageZTAEntra IDConditional AccessAuthenticationHighLowLowT1550.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21829Use cloud authenticationZTAEntra IDHybrid identityAuthenticationHighHighHighT1606.002, T1484.002—Microsoft Zero Trust AssessmentZTA.21830Conditional Access policies for Privileged Access Workstations are configuredZTAEntra IDConditional AccessPrivileged accessHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21836Workload Identities are not assigned privileged rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21847Password protection for on-premises is enabledZTAEntra IDPassword protectionAuthenticationHighLowMediumT1110.003—Microsoft Zero Trust AssessmentZTA.21860Diagnostic settings are configured for all Microsoft Entra logsZTAEntra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002—Microsoft Zero Trust AssessmentZTA.21861All high-risk users are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21863All high-risk sign-ins are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21864All risk detections are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21872Require multifactor authentication for device join and device registration using user actionZTAEntra IDConditional AccessAuthenticationHighMediumLowT1098.005—Microsoft Zero Trust AssessmentZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesZTAAzureAccess managementPrivileged accessHighLowMediumT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21885App registrations use safe redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21888App registrations must not have dangling or abandoned domain redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1528, T1584.001—Microsoft Zero Trust AssessmentZTA.21891Require password reset notifications for administrator rolesZTAEntra IDAuthentication methodsPrivileged accessHighLowLowT1098, T1078.004—Microsoft Zero Trust AssessmentZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesZTAAzureAccess managementPrivileged accessHighLowLowT1078.004, T1685.002—Microsoft Zero Trust AssessmentZTA.21992Application certificates must be rotated on a regular basisZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1552.004, T1078.004—Microsoft Zero Trust AssessmentZTA.22124High priority Microsoft Entra recommendations are addressedZTAEntra ID
Entra recommendationsInfrastructure hardeningHighMediumMedium——Microsoft Zero Trust AssessmentZTA.22128Guests are not assigned high privileged directory rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.22659All risky workload identity sign ins are triagedZTAEntra IDIdentity ProtectionApplications and workload identitiesHighLowHighT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.23183Service principals use safe redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1528, T1557—Microsoft Zero Trust AssessmentZTA.24540Windows Firewall policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1021, T1210 +1—Microsoft Zero Trust AssessmentZTA.24541A compliance policy for Windows devices existsZTAIntune
Device complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24542macOS Compliance policy is created and assignedZTAIntuneDevice complianceDevices and endpointsHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24543Compliance policy assignment for iOS/iPadOS devicesZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsZTAIntuneDevice enrollmentDevices and endpointsHighLowLow——Microsoft Zero Trust AssessmentZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24548App Protection Policy assigned on iOS/iPad devicesZTAIntune
App protectionData protectionHighLowLowT1567.002, T1115—Microsoft Zero Trust AssessmentZTA.24549An App protection policy for Android platform exists in IntuneZTAIntuneApp protectionData protectionHighMediumLowT1567.002, T1115—Microsoft Zero Trust AssessmentZTA.24550Windows - BitLocker Policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowHighT1005, T1006—Microsoft Zero Trust AssessmentZTA.24551Windows Hello for Business Policy is Configured and AssignedZTAIntuneDevice enrollmentAuthenticationHighMediumMediumT1110, T1078—Microsoft Zero Trust AssessmentZTA.24553Windows Update policy is assigned and enforced.ZTAIntuneDevice configurationDevices and endpointsHighMediumMediumT1203, T1068 +1—Microsoft Zero Trust AssessmentZTA.24554iOS - Update policy is configured and assignedZTAIntuneDevice configurationDevices and endpointsHighLowHighT1203, T1068—Microsoft Zero Trust AssessmentZTA.24555Intune Scope Tags are Configured for Delegated AdministrationZTAIntuneTenant administrationPrivileged accessHighLowHighT1072—Microsoft Zero Trust AssessmentZTA.24560Windows Cloud LAPS policy is created and assignedZTAIntuneEndpoint securityPrivileged accessHighLowLowT1078.003, T1021—Microsoft Zero Trust AssessmentZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSZTAIntuneDevice enrollmentPrivileged accessHighLowLowT1078.003, T1021 +1—Microsoft Zero Trust AssessmentZTA.24564Windows - Local Account Protection policy is configured and assignedZTAIntuneEndpoint securityPrivileged accessHighLowHighT1078.003, T1136.001—Microsoft Zero Trust AssessmentZTA.24568macOS - Platform SSO is configured and assignedZTAIntuneDevice configurationAuthenticationHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.24569Intune macOS FileVault policy is created and AssignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1005, T1006—Microsoft Zero Trust AssessmentZTA.24570Entra Connect Sync is configured with Service Principal CredentialsZTAEntra IDHybrid identityAuthenticationHighLowMediumT1078.004, T1110—Microsoft Zero Trust AssessmentZTA.24572Device enrollment notification is configured and assignedZTAIntuneDevice enrollmentDevices and endpointsHighLowHighT1098.005—Microsoft Zero Trust AssessmentZTA.24573Windows - A security baseline is configured and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowHighT1003, T1068—Microsoft Zero Trust AssessmentZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1027, T1106 +1—Microsoft Zero Trust AssessmentZTA.24575A Windows Defender Antivirus policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1685—Microsoft Zero Trust AssessmentZTA.24690macOS - Update policy is configured and assignedZTAIntuneDevice configurationDevices and endpointsHighLowHighT1203, T1068—Microsoft Zero Trust AssessmentZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1685—Microsoft Zero Trust AssessmentZTA.24794Intune Terms and Conditions Policy is configured and assignedZTAIntuneTenant administrationAccess controlHighLowHigh——Microsoft Zero Trust AssessmentZTA.24802Device Clean-up Rule is CreatedZTAIntuneTenant administrationDevices and endpointsHighLowHigh——Microsoft Zero Trust AssessmentZTA.24824Conditional Access policies block access from noncompliant devicesZTAEntra IDConditional AccessAccess controlHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24827Conditional Access policies block access from unmanaged appsZTAEntra IDConditional AccessAccess controlHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowMediumT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowLowT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowLowT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsZTAIntuneTenant administrationDevices and endpointsHighLowLowT1566—Microsoft Zero Trust AssessmentZTA.25371Network validation is configured through Universal Continuous Access EvaluationZTAEntra ID
Global Secure AccessAuthenticationHighLowLowT1550.001—Microsoft Zero Trust AssessmentZTA.25372Global Secure Access client is deployed on all managed endpointsZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25375The tenant holds the licenses required to operate Global Secure AccessZTAEntra IDGlobal Secure AccessInfrastructure hardeningHighLowLow——Microsoft Zero Trust AssessmentZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25377Universal tenant restrictions block unauthorized external tenant accessZTAEntra IDGlobal Secure AccessExternal access and sharingHighLowMediumT1567.002, T1078.004—Microsoft Zero Trust AssessmentZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentZTAEntra IDGlobal Secure AccessAccess controlHighLowLow——Microsoft Zero Trust AssessmentZTA.25383Administrative privileges are tightly limited to prevent compromiseZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.25384Application admin rights are constrained to specific Private Access appsZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.25393Quick Access is enabled and bound to a connectorZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1078.004, T1133—Microsoft Zero Trust AssessmentZTA.25394Quick Access is bound to a Conditional Access policyZTAEntra IDGlobal Secure AccessAccess controlHighMediumLowT1078.004, T1133—Microsoft Zero Trust AssessmentZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessZTAEntra IDGlobal Secure AccessAccess controlHighMediumHighT1046, T1021—Microsoft Zero Trust AssessmentZTA.25396Conditional Access policies enforce strong authentication for private appsZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1110.003, T1110.004 +1—Microsoft Zero Trust AssessmentZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1021.001, T1557 +1—Microsoft Zero Trust AssessmentZTA.25401Application Proxy applications require preauthentication to block anonymous accessZTAEntra IDApplicationsApplications and workload identitiesHighMediumMediumT1190—Microsoft Zero Trust AssessmentZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersZTAEntra IDGlobal Secure AccessAuthenticationHighMediumMediumT1558, T1078.002—Microsoft Zero Trust AssessmentZTA.25406Internet access forwarding profile is enabledZTAEntra IDGlobal Secure AccessAccess controlHighMediumLowT1071.001, T1567 +1—Microsoft Zero Trust AssessmentZTA.25407Web content filtering integrates with Conditional AccessZTAEntra IDGlobal Secure AccessAccess controlHighLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.25411TLS inspection is enabled and correctly configured for outbound trafficZTAEntra IDGlobal Secure AccessAccess controlHighMediumHighT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1204.001, T1566.002 +1—Microsoft Zero Trust AssessmentZTA.25413File transfer policies are configured to prevent data exfiltrationZTAEntra IDGlobal Secure AccessData protectionHighMediumHighT1567—Microsoft Zero Trust AssessmentZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksZTAEntra IDGlobal Secure AccessAI and agentsHighLowMedium——Microsoft Zero Trust AssessmentZTA.25416Global Secure Access cloud firewall protects branch office internet trafficZTAEntra IDGlobal Secure AccessAccess controlHighLowMediumT1071, T1041 +1—Microsoft Zero Trust AssessmentZTA.25420Network access logs are retained for security analysis and compliance requirementsZTAEntra IDLogs and monitoringLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.25466At least two Private Access connectors are active and healthy per connector groupZTAEntra IDGlobal Secure AccessInfrastructure hardeningHighMediumLow——Microsoft Zero Trust AssessmentZTA.25481All Private Access apps have user or group assignmentsZTAEntra IDGlobal Secure AccessAccess controlHighMediumLow——Microsoft Zero Trust AssessmentZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1498, T1499—Microsoft Zero Trust AssessmentZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1071, T1041—Microsoft Zero Trust AssessmentZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1071, T1041—Microsoft Zero Trust AssessmentZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190, T1210 +1—Microsoft Zero Trust AssessmentZTA.25541Application Gateway WAF is Enabled in Prevention modeZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.25543Azure Front Door WAF is Enabled in Prevention ModeZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.26879Request Body Inspection is enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26880Request Body Inspection is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26881Default Ruleset is enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.26883Default rule set is assigned in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.26887Diagnostic logging is enabled in Azure FirewallZTAAzureNetwork securityLogging and detectionHighLowLowT1021, T1071—Microsoft Zero Trust AssessmentZTA.26888Diagnostic logging is enabled in Application Gateway WAFZTAAzureNetwork securityLogging and detectionHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26889Diagnostic logging is enabled in Azure Front Door WAFZTAAzureNetwork securityLogging and detectionHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.27000Web content filtering blocks high-risk categoriesZTAEntra IDGlobal Secure AccessAccess controlHighLowLowT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.27002TLS inspection certificates have a sufficient validity periodZTAEntra IDGlobal Secure AccessAccess controlHighHighLowT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.27003TLS inspection failure rate is below 1%ZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1573—Microsoft Zero Trust AssessmentZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1499.002, T1499.003—Microsoft Zero Trust AssessmentZTA.27016Rate Limiting is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1110, T1499.003—Microsoft Zero Trust AssessmentZTA.27018Rate Limiting is Enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1110, T1499.003—Microsoft Zero Trust AssessmentZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1499.002, T1499.003—Microsoft Zero Trust AssessmentZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileZTAEntra IDGlobal Secure AccessAI and agentsHighMediumMediumT1567, T1071.001—Microsoft Zero Trust AssessmentZTA.35001Conditional Access policies don't exclude Rights Management workloadsZTAEntra IDConditional AccessAccess controlHighLowLow——Microsoft Zero Trust AssessmentZTA.35003Sensitivity labels are configuredZTAPurview
Information protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAPurviewInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35013Sensitivity labels with encryption are configuredZTAPurviewInformation protectionData protectionHighHighMediumT1213.002, T1530—Microsoft Zero Trust AssessmentZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAPurviewInformation protectionData protectionHighHighMedium——Microsoft Zero Trust AssessmentZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAPurviewInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35020Auto-labeling policies are in enforcement modeZTAPurviewInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAPurviewInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35024Azure Rights Management service is activatedZTAPurviewInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35025Internal Rights Management licensing is enabledZTAPurviewInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35030Data loss prevention policies are enabledZTAPurviewData loss preventionData protectionHighMediumMediumT1213, T1530 +1—Microsoft Zero Trust AssessmentZTA.35033Custom sensitive information types are configuredZTAPurviewData classificationData protectionHighMediumHigh——Microsoft Zero Trust AssessmentZTA.35034Exact Data Match is configured for sensitive information detectionZTAPurviewData classificationData protectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAPurviewData classificationData protectionHighMediumLow——Microsoft Zero Trust AssessmentZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAPurview
Insider risk managementLogging and detectionHighMediumMediumT1213—Microsoft Zero Trust AssessmentZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAPurviewInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAPurviewInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerZTADefenderDefender for IdentityLogging and detectionHighLowMediumT1558.003, T1550.002 +2—Microsoft Zero Trust AssessmentZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversZTADefenderDefender for IdentityLogging and detectionHighLowMediumT1606.002, T1649 +1—Microsoft Zero Trust AssessmentZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAActive DirectoryUsersPrivileged accessHighLowLowT1558, T1550.003—Microsoft Zero Trust AssessmentZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAActive DirectoryComputersPrivileged accessHighLowMediumT1078.003, T1550.002—Microsoft Zero Trust AssessmentZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAActive Directory
GroupsPrivileged accessHighLowLowT1078.002—Microsoft Zero Trust AssessmentZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAActive DirectoryPermissions and delegationPrivileged accessHighLowLowT1003.006—Microsoft Zero Trust AssessmentZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAActive DirectoryPermissions and delegationPrivileged accessHighLowMediumT1003.006—Microsoft Zero Trust AssessmentZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantZTADefenderDefender for IdentityLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedZTADefenderDefender for IdentityLogging and detectionHighMediumLowT1078.002, T1550.002 +1—Microsoft Zero Trust AssessmentZTA.41029Anti-malware policies are configured according to recommended settingsZTADefenderAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002—Microsoft Zero Trust AssessmentZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockZTADefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002—Microsoft Zero Trust AssessmentZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsZTADefenderSafe LinksEmail and collaboration protectionHighLowLowT1566.002, T1204.001—Microsoft Zero Trust AssessmentZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionZTADefenderAnti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001 +1—Microsoft Zero Trust AssessmentZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailZTADefender
Zero-hour auto purgeEmail and collaboration protectionHighLowLowT1566—Microsoft Zero Trust AssessmentZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessZTADefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002—Microsoft Zero Trust AssessmentZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderTenant settingsLogging and detectionHighLowMediumT1566—Microsoft Zero Trust AssessmentZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointZTADefenderEndpoint antivirusDevices and endpointsHighLowMediumT1685, T1003 +1—Microsoft Zero Trust AssessmentZTA.41050Attack surface reduction (ASR) rules are enabled in block modeZTAIntuneEndpoint securityDevices and endpointsHighMediumMediumT1204.002, T1059 +1—Microsoft Zero Trust AssessmentZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneZTAIntuneEndpoint securityDevices and endpointsHighMediumHighT1204.002—Microsoft Zero Trust AssessmentZTA.41053Network protection is enabled in block modeZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.001, T1189 +1—Microsoft Zero Trust AssessmentZTA.41054Controlled folder access is enabled in block modeZTADefenderEndpoint antivirusDevices and endpointsHighMediumLowT1486, T1485—Microsoft Zero Trust AssessmentZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002, T1059—Microsoft Zero Trust AssessmentZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002—Microsoft Zero Trust AssessmentZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002—Microsoft Zero Trust AssessmentZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedZTADefenderTenant settingsLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderTenant settingsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsZTAEntra IDConditional AccessAccess controlHighMediumMediumT1550.004, T1530—Microsoft Zero Trust AssessmentZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsZTADefenderTenant settingsLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.41083Step-up authentication is required upon risky in-session actionZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1557, T1550.004 +1—Microsoft Zero Trust AssessmentZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsZTADefenderSafe LinksEmail and collaboration protectionHighLowLowT1566, T1204.001 +1—Microsoft Zero Trust AssessmentZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1685, T1564.012—Microsoft Zero Trust AssessmentZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowZTADefenderTenant settingsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsZTAAzureMicrosoft SentinelLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.50001Microsoft Defender for Cloud RecommendationsZTAAzure
SubscriptionsInfrastructure hardeningHighMediumMedium——Microsoft Zero Trust AssessmentZTA.51001Windows Endpoint Privilege Management is configured and assignedZTAIntuneEndpoint securityPrivileged accessHighMediumMediumT1078.003, T1548.002 +2—Microsoft Zero Trust AssessmentZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)ZTAIntuneApp protectionAccess controlHighLowLowT1078.004, T1550.001—Microsoft Zero Trust AssessmentZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesZTAIntuneApp protectionDevices and endpointsHighLowLowT1068, T1553.006—Microsoft Zero Trust AssessmentZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesZTAIntuneTenant administrationPrivileged accessHighLowMediumT1072, T1078.004—Microsoft Zero Trust AssessmentZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1098.003, T1078.004—Microsoft Zero Trust AssessmentZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneZTAIntuneEndpoint securityDevices and endpointsHighMediumMediumT1204.002—Microsoft Zero Trust AssessmentZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsZTAAzureSubscriptionsLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryZTAMicrosoft 365Organization settingsAI and agentsHighLowLow——Microsoft Zero Trust AssessmentZTA.61006AI administrative roles have assigned principalsZTAEntra IDRoles and administratorsPrivileged accessHighLowLow——Microsoft Zero Trust AssessmentZTA.61009Conditional Access policies cover both agent identities and agent usersZTAEntra IDConditional AccessAI and agentsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsZTAEntra IDAgent identitiesAI and agentsHighMediumMediumT1213—Microsoft Zero Trust AssessmentZTA.61012Risk-based Conditional Access blocks risky agent identitiesZTAEntra IDConditional AccessAI and agentsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryZTAEntra IDAgent identitiesAI and agentsHighMediumMedium——Microsoft Zero Trust AssessmentZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsZTAAzureSubscriptionsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdActive DirectoryComputersIdentity lifecycle and hygieneMediumLowMediumT1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-GPOL-05GPO blocked inheritance count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-01No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-02No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-03GPOs without authenticated users count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-04GPOs without authenticated users details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-07GPOs with deny ACE count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-08GPOs with deny ACE details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-09GPO inherited permissions count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-15No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-16No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumActive DirectoryAccount securityAuthenticationMediumLowLowT1558.001nist-800-53-r5:IA-5Active DirectoryAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Active DirectoryAccount securityAuthenticationMediumLowLowT1098nist-800-53-r5:CM-6Active DirectoryAD-PWDPOL-04Password complexity should be enabledActive DirectoryPassword policyAuthenticationMediumMediumLowT1110—Active DirectoryAD-PWDPOL-05Password reversible encryption should be disabledActive DirectoryPassword policyAuthenticationMediumMediumMediumT1556.005—Active DirectoryAD-SCH-05LAPS should be installed in Active DirectoryActive Directory
SchemaPrivileged accessMediumLowMediumT1078.003, T1550.002nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2)Active DirectoryASD.ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003ism:ISM-1403, nist-800-53-r5:AC-7ASD Essential EightASD.ISM-1488Microsoft Office macros in files originating from the internet are blocked.New in 3.0IntuneDevice configurationDevices and endpointsMediumMediumLowT1204.002, T1566.001essential-eight:ISM-1488, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity.New in 3.0Entra IDRoles and administratorsPrivileged accessMediumLowMediumT1078.004essential-eight:ISM-1648, nist-800-53-r5:AC-2(3) +1ASD Essential EightASD.ISM-1672Microsoft Office macro antivirus scanning is enabled.New in 3.0IntuneDevice configurationDevices and endpointsMediumLowLowT1204.002essential-eight:ISM-1672, nist-800-53-r5:SI-3 +1ASD Essential EightAZDO.1006External Users access.New in 3.0Azure DevOpsUsers and accessExternal access and sharingMediumMediumLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-21MaesterAZDO.1007Team and project administrator are allowed to invite new users.New in 3.0Azure DevOpsUsers and accessAccess controlMediumLowLowT1136.003—MaesterAZDO.1014Anonymous access to pipeline badges.New in 3.0Azure DevOpsPipelinesExternal access and sharingMediumLowLowT1593.003—MaesterAZDO.1019Stage chooser.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1020Creation of classic build pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1021Creation of classic release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1024Disable Node 6 tasks.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumLowLow—nist-800-53-r5:SI-2MaesterAZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1552.001, T1195.001 +1nist-800-53-r5:SA-11, nist-800-53-r5:IA-5(7)MaesterAZDO.1028Disable creation of TFVC repositories.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowLow——MaesterAZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0Azure DevOpsOrganization policiesAccess controlMediumLowLow——MaesterAZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0Azure DevOpsSecurity policiesApplications and workload identitiesMediumLowLowT1190—MaesterAZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1552.001nist-800-53-r5:IA-5(7)MaesterAZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11MaesterAZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11MaesterAZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowLowT1195.001, T1190nist-800-53-r5:SA-11, nist-800-53-r5:SI-2MaesterCIS.GH.1.2.2Ensure repository creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLowT1567.001cis-github:1.2.2, nist-800-53-r5:AC-6CISCIS.GH.1.2.4Ensure issue deletion is limited to specific usersGitHubOrganization settingsAccess controlMediumLowLowT1070, T1485cis-github:1.2.4, nist-800-53-r5:AC-6CISCIS.GH.1.3.2Ensure team creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLow—cis-github:1.3.2, nist-800-53-r5:AC-6CISCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Microsoft 365Administrative accountsPrivileged accessMediumLowMediumT1566cis-m365:1.1.4, nist-800-53-r5:AC-6(5)CISCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existMicrosoft 365Teams and groupsAccess controlMediumLowMediumT1213.002cis-m365:1.2.1, nist-800-53-r5:AC-3CISCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedMicrosoft 365Teams and groupsAccess controlMediumLowLowT1078.004cis-m365:1.2.2, nist-800-53-r5:AC-2CISCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Microsoft 365Organization settingsAuthenticationMediumLowLow—cis-m365:1.3.1, nist-800-53-r5:IA-5(1)CISCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Microsoft 365Organization settingsAuthenticationMediumMediumMediumT1550.004cis-m365:1.3.2, nist-800-53-r5:AC-12CISCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableMicrosoft 365Organization settingsExternal access and sharingMediumLowLowT1591cis-m365:1.3.3, nist-800-53-r5:AC-3 +1CISCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedMicrosoft 365Organization settingsApplications and workload identitiesMediumMediumLowT1137.006cis-m365:1.3.4, nist-800-53-r5:CM-7 +1CISCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledMicrosoft 365Organization settingsEmail and collaboration protectionMediumLowLowT1534, T1598cis-m365:1.3.5, nist-800-53-r5:SI-8CISCIS.M365.1.3.6Ensure the customer lockbox feature is enabledMicrosoft 365Organization settingsAccess controlMediumLowLowT1199cis-m365:1.3.6CISCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Microsoft 365Organization settingsExternal access and sharingMediumLowLowT1567.002cis-m365:1.3.7, nist-800-53-r5:AC-20 +1CISCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cis-m365:2.1.1, nist-800-53-r5:SI-3CISCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)DefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cis-m365:2.1.2, nist-800-53-r5:SI-3CISCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledDefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.3, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledDefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:2.1.5, nist-800-53-r5:SI-3CISCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsDefenderAnti-spamEmail and collaboration protectionMediumLowLowT1078.004cis-m365:2.1.6, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdDefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001 +1cis-m365:2.1.7, nist-800-53-r5:SI-8CISCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.8, nist-800-53-r5:SI-8CISCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsDefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.9, nist-800-53-r5:SC-8CISCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.10, nist-800-53-r5:SI-8CISCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedDefenderAnti-malwareEmail and collaboration protectionMediumMediumMediumT1566.001, T1204.002cis-m365:2.1.11, nist-800-53-r5:SI-3CISCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.12, nist-800-53-r5:AC-4CISCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:2.1.13, nist-800-53-r5:AC-4CISCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.15, nist-800-53-r5:AC-4CISCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowMediumT1566cis-m365:2.4.1, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.2, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.4, nist-800-53-r5:SI-3CISCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.1, nist-800-53-r5:AC-4CISCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.2, nist-800-53-r5:AC-4CISCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0PurviewData loss preventionData protectionMediumLowMediumT1213.002, T1530cis-m365:3.2.3, nist-800-53-r5:AC-4CISCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'IntuneDevice complianceDevices and endpointsMediumMediumMediumT1078.004cis-m365:4.1, nist-800-53-r5:AC-19 +1CISCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0IntuneDevice enrollmentDevices and endpointsMediumMediumLowT1098.005cis-m365:4.2, nist-800-53-r5:AC-19CISCIS.M365.5.1.2.2Ensure users cannot register applicationsEntra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528cis-m365:5.1.2.2, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'Entra IDUser and directory settingsAccess controlMediumLowLow—cis-m365:5.1.2.3, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Entra ID
Device identityDevices and endpointsMediumLowLowT1098.005cis-m365:5.1.4.1, nist-800-53-r5:IA-3CISCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.004cis-m365:5.1.4.3, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumMediumLowT1685, T1003cis-m365:5.1.4.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.003cis-m365:5.1.4.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysEntra IDDevice identityAccess controlMediumLowLowT1552cis-m365:5.1.4.6, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.3, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.4, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1110.001, T1110.003cis-m365:5.1.5.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.6, nist-800-53-r5:IA-5CISCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1136.003cis-m365:5.1.6.1, nist-800-53-r5:AC-20CISCIS.M365.5.1.6.2Ensure that guest user access is restrictedEntra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003cis-m365:5.1.6.2, nist-800-53-r5:AC-6CISCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003cis-m365:5.1.6.3, nist-800-53-r5:AC-2CISCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Entra IDHybrid identityAuthenticationMediumLowLowT1078.004cis-m365:5.1.8.1, nist-800-53-r5:IA-5CISCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Entra IDConditional AccessPrivileged accessMediumLowMediumT1550.004cis-m365:5.2.2.4, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.6, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.7, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.8, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Entra IDConditional AccessAccess controlMediumHighHighT1078.004cis-m365:5.2.2.9, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cis-m365:5.2.2.10, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1098.005cis-m365:5.2.2.11, nist-800-53-r5:IA-11CISCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.13, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.15, nist-800-53-r5:AC-3CISCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.16, nist-800-53-r5:SC-23CISCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Entra IDConditional AccessAuthenticationMediumLowMediumT1078.004cis-m365:5.2.2.17, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Entra IDAuthentication methodsAuthenticationMediumLowLowT1621cis-m365:5.2.3.1, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.003cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Entra IDPassword protectionAuthenticationMediumLowMediumT1110.003cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationMediumMediumLowT1078.004, T1111cis-m365:5.2.3.7, nist-800-53-r5:CM-7 +1CISCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003cis-m365:5.2.3.8, nist-800-53-r5:AC-7CISCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001cis-m365:5.2.3.9, nist-800-53-r5:AC-7CISCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Entra ID
Identity GovernanceExternal access and sharingMediumMediumMediumT1078.004cis-m365:5.3.2, nist-800-53-r5:AC-2CISCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Entra IDIdentity GovernancePrivileged accessMediumLowMediumT1078.004cis-m365:5.3.3, nist-800-53-r5:AC-6(7)CISCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1548.005cis-m365:5.3.4, nist-800-53-r5:AC-5CISCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1098.003cis-m365:5.3.5, nist-800-53-r5:AC-5CISCIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.2, nist-800-53-r5:AU-12CISCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.3, nist-800-53-r5:AU-12CISCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:6.2.2, nist-800-53-r5:SI-8CISCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0Exchange Online
OutlookEmail and collaboration protectionMediumLowLowT1566cis-m365:6.2.3, nist-800-53-r5:SI-8CISCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0Exchange OnlineOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002cis-m365:6.3.1, nist-800-53-r5:CM-7CISCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webExchange OnlineOutlookExternal access and sharingMediumLowLowT1567.002, T1204.002cis-m365:6.5.3, nist-800-53-r5:AC-20 +1CISCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002cis-m365:6.5.5, nist-800-53-r5:SI-8CISCIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0
SharePointAccess controlAuthenticationMediumMediumLowT1110cis-m365:7.2.1, nist-800-53-r5:IA-2CISCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledSharePoint
External sharingExternal access and sharingMediumLowLowT1078.004, T1213.002cis-m365:7.2.2CISCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.3, nist-800-53-r5:AC-21CISCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.4, nist-800-53-r5:AC-21CISCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownSharePointExternal sharingExternal access and sharingMediumLowLowT1213.002, T1530cis-m365:7.2.5, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530 +1cis-m365:7.2.6, nist-800-53-r5:AC-21CISCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharePoint
Sharing linksAccess controlMediumLowLowT1213.002cis-m365:7.2.7, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530cis-m365:7.2.8, nist-800-53-r5:AC-21CISCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallySharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.9, nist-800-53-r5:AC-2(2)CISCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0SharePointExternal sharingAuthenticationMediumLowLowT1078.004cis-m365:7.2.10, nist-800-53-r5:IA-5CISCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cis-m365:7.2.11, nist-800-53-r5:AC-6CISCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadSharePointAccess controlEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:7.3.1, nist-800-53-r5:SI-3CISCIS.M365.8.1.1Ensure external file sharing in Teams is enabled for only approved cloud storage services
Teams
File sharingExternal access and sharingMediumLowLowT1567.002cis-m365:8.1.1, nist-800-53-r5:AC-20 +1CISCIS.M365.8.1.2Ensure users can't send emails to a channel email addressNew in 3.0Teams
MessagingExternal access and sharingMediumMediumLowT1566cis-m365:8.1.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.1Ensure external domains are restricted in the Teams admin centerNew in 3.0Teams
External accessExternal access and sharingMediumMediumLowT1566cis-m365:8.2.1, nist-800-53-r5:AC-20CISCIS.M365.8.2.2Ensure communication with unmanaged Teams users is disabledTeamsExternal accessExternal access and sharingMediumMediumLowT1566, T1204.001 +1cis-m365:8.2.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.3Ensure external Teams users cannot initiate conversationsTeamsExternal accessExternal access and sharingMediumLowLowT1566, T1204.001 +1cis-m365:8.2.3, nist-800-53-r5:AC-20CISCIS.M365.8.2.4Ensure the organization cannot communicate with accounts in trial Teams tenantsNew in 3.0TeamsExternal accessExternal access and sharingMediumLowLowT1566cis-m365:8.2.4, nist-800-53-r5:AC-20CISCIS.M365.8.4.1Ensure app permission policies are configuredTeams
AppsApplications and workload identitiesMediumMediumMediumT1195, T1671cis-m365:8.4.1, nist-800-53-r5:CM-7CISCIS.M365.8.5.1Ensure anonymous users can't join a meetingNew in 3.0Teams
MeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.1, nist-800-53-r5:AC-3CISCIS.M365.8.5.2Ensure anonymous users and dial-in callers can't start a meetingNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.2, nist-800-53-r5:AC-3CISCIS.M365.8.5.3Ensure only people in my org can bypass the lobbyTeamsMeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.3, nist-800-53-r5:AC-3CISCIS.M365.8.5.4Ensure users dialing in can't bypass the lobbyNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.4, nist-800-53-r5:AC-3CISCIS.M365.8.5.5Ensure meeting chat does not allow anonymous usersNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1566cis-m365:8.5.5, nist-800-53-r5:AC-3CISCIS.M365.8.5.7Ensure external participants can't give or request controlNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1219cis-m365:8.5.7, nist-800-53-r5:AC-3CISCIS.M365.8.5.8Ensure external meeting chat is offNew in 3.0TeamsMeetingsExternal access and sharingMediumMediumLowT1566cis-m365:8.5.8, nist-800-53-r5:AC-3CISCIS.M365.8.6.1Ensure users can report security concerns in TeamsTeamsMessagingEmail and collaboration protectionMediumLowLowT1566cis-m365:8.6.1CISCIS.M365.9.1.1Restrict guest access to FabricNew in 3.0
Microsoft Fabric
Export and sharing settingsExternal access and sharingMediumMediumLowT1078.004cis-m365:9.1.1, nist-800-53-r5:AC-3CISCIS.M365.9.1.2Restrict external guest invitations through FabricNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1136.003cis-m365:9.1.2, nist-800-53-r5:AC-2CISCIS.M365.9.1.4Restrict public publishing of Fabric reportsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.4, nist-800-53-r5:AC-22CISCIS.M365.9.1.5Disable R and Python visuals in FabricNew in 3.0Microsoft FabricTenant settingsInfrastructure hardeningMediumMediumMediumT1059cis-m365:9.1.5, nist-800-53-r5:CM-7CISCIS.M365.9.1.6Enable sensitivity labels for Fabric contentNew in 3.0Microsoft FabricInformation protectionData protectionMediumLowMedium—cis-m365:9.1.6, nist-800-53-r5:AC-16CISCIS.M365.9.1.8Restrict external sharing of semantic modelsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.8, nist-800-53-r5:AC-21CISCIS.M365.9.1.9Block resource-key authentication for Fabric datasetsNew in 3.0Microsoft Fabric
Developer settingsAuthenticationMediumMediumMedium—cis-m365:9.1.9, nist-800-53-r5:IA-5CISCIS.M365.9.1.10Restrict service principal access to Fabric public APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.10, nist-800-53-r5:AC-3CISCIS.M365.9.1.11Restrict service principal profiles in FabricNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.11, nist-800-53-r5:AC-3CISCIS.M365.9.1.12Restrict service principal access to Fabric global APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.12, nist-800-53-r5:AC-3CISCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDIdentity ProtectionLogging and detectionMediumLowLowT1078.004cisa-scuba:MS.AAD.2.2, nist-800-53-r5:AC-2(12)CISA SCuBACISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1110, T1621cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1) +5CISA SCuBACISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDConditional AccessAccess controlMediumHighHighT1078.004cisa-scuba:MS.AAD.3.7, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cisa-scuba:MS.AAD.3.8, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDPassword protectionAuthenticationMediumLowLow—cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)CISA SCuBACISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1)CISA SCuBACISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1)CISA SCuBACISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.8, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.9, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.003, T1087.004 +2cisa-scuba:MS.AAD.8.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1098.003, T1136.003cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)CISA SCuBACISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004cisa-scuba:MS.AAD.8.3, nist-800-53-r5:AC-3CISA SCuBACISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.2.2, nist-800-53-r5:AC-2dCISA SCuBACISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1598 +1cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8CISA SCuBACISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1566, T1598 +1cisa-scuba:MS.EXO.4.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1684.002cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange Online
Calendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567 +1cisa-scuba:MS.EXO.6.2, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.2, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.3CISA SCuBACISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1036.008, T1204.002 +1cisa-scuba:MS.EXO.9.2CISA SCuBACISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.4CISA SCuBACISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.2, nist-800-53-r5:AT-2b +1CISA SCuBACISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.11.3CISA SCuBACISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cisa-scuba:MS.EXO.12.2, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.14.3, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.4CISA SCuBACISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3 +1CISA SCuBACISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineAlert policiesLogging and detectionMediumLowMedium—cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineAudit loggingLogging and detectionMediumLowLowT1070cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11CISA SCuBACISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointExternal sharingExternal access and sharingMediumMediumMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointSharing linksAccess controlMediumLowLowT1048, T1213.002cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointSharing linksExternal access and sharingMediumLowLowT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointSharing linksExternal access and sharingMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointExternal sharingAuthenticationMediumLowLowT1213.002, T1530cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11CISA SCuBADISA.V-267303Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-intune-desktop:V-267303, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-267309Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumLowMediumT1078.004disa-stig-intune-desktop:V-267309, nist-800-53-r5:AC-2(3)DISA STIGsDISA.V-267314Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003disa-stig-intune-desktop:V-267314, nist-800-53-r5:AC-7DISA STIGsDISA.V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-entra-id:V-270200, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumLowMediumT1078.004disa-stig-entra-id:V-270204, nist-800-53-r5:AC-2(3)DISA STIGsDISA.V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003disa-stig-entra-id:V-270208, nist-800-53-r5:AC-7DISA STIGsDISA.V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.New in 3.0-IncludePreviewEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005disa-stig-entra-id:V-270255, nist-800-53-r5:AC-2(1)DISA STIGsDISA.V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.003disa-stig-entra-id:V-270475, nist-800-53-r5:IA-5(1)DISA STIGsDISA.V-273867Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-intune-mdm:V-273867, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-285327The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.New in 3.0IntuneTenant administrationPrivileged accessMediumLowLowT1072, T1078.004disa-stig-intune-mdm:V-285327, nist-800-53-r5:CM-6DISA STIGsEIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDAuthentication methodsAuthenticationMediumLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004nist-800-53-r5:SI-4(5)Entra ID SCA (EIDSCA)EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004—Entra ID SCA (EIDSCA)EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003nist-800-53-r5:AC-6(10)Entra ID SCA (EIDSCA)EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDUser and directory settingsAccess controlMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDUser and directory settingsAccess controlMediumLowLowT1136.003nist-800-53-r5:AC-2Entra ID SCA (EIDSCA)EIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra IDAgent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDAuthentication methodsAuthenticationMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDAuthentication methodsAuthenticationMediumLowLowT1078.004nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra IDGroupsExternal access and sharingMediumLowLowT1098nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)MT.1001At least one Conditional Access policy is configured with device compliance.Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3MaesterMT.1002App management restrictions on applications and service principals is configured and enabled.Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1078.004, T1098.001 +1—MaesterMT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.Entra IDConditional AccessAuthenticationMediumLowLowT1078.004, T1110nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-2(1)MaesterMT.1013At least one Conditional Access policy is configured to require new password when user risk is high.Entra IDConditional AccessAuthenticationMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-5MaesterMT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.Entra IDConditional AccessAccess controlMediumMediumLowT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:CM-7MaesterMT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.Entra IDConditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:AC-19, nist-800-53-r5:AC-12MaesterMT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.Entra IDConditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:IA-11, nist-800-53-r5:AC-12MaesterMT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.Entra IDConditional AccessAccess controlMediumMediumMediumT1213.002, T1530—MaesterMT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.Entra IDConditional AccessAccess controlMediumLowLow——MaesterMT.1024Entra recommendations should be completed.Entra IDEntra recommendationsInfrastructure hardeningMediumLowMedium——MaesterMT.1036All excluded objects should have a fallback include in another policy.Entra IDConditional AccessAccess controlMediumLowMediumT1078.004—MaesterMT.1038Conditional Access policies should not include or exclude deleted groups.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1041Ensure users installing Outlook add-ins is not allowedExchange OnlineOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002nist-800-53-r5:CM-7, nist-800-53-r5:CM-11MaesterMT.1042Restrict dial-in users from bypassing a meeting lobbyTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3MaesterMT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsExchange OnlineMail flowEmail and collaboration protectionMediumLowMediumT1566nist-800-53-r5:SI-8MaesterMT.1045Only invited users should be automatically admitted to Teams meetingsTeamsMeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3MaesterMT.1046Restrict anonymous users from joining meetingsTeamsMeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3MaesterMT.1047Restrict anonymous users from starting Teams meetingsTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3MaesterMT.1048Limit external participants from having control in a Teams meetingTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-6MaesterMT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'IntuneDevice complianceDevices and endpointsMediumMediumMediumT1078.004nist-800-53-r5:AC-19, nist-800-53-r5:CM-6MaesterMT.1057App registrations should no longer use secrets.Entra IDApplicationsApplications and workload identitiesMediumLowHighT1078.004, T1552nist-800-53-r5:IA-5MaesterMT.1058Exchange application access policies must be configured.Entra IDApp consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1059Microsoft Defender for Identity health issues should be resolvedDefenderDefender for IdentityLogging and detectionMediumLowMedium——MaesterMT.1060Drift folders should match their baseline.New in 3.0Microsoft 365
Configuration driftInfrastructure hardeningMediumLowLow——MaesterMT.1061Device registration MFA control conflicts with Conditional Access policies.Entra IDConditional AccessAuthenticationMediumLowLowT1098.005—MaesterMT.1062Ensure Direct Send is set to be rejectedExchange OnlineMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002nist-800-53-r5:CM-7MaesterMT.1064Ensure that write permissions are required to create new management groupsAzure
Management groupsAccess controlMediumLowLowT1666nist-800-53-r5:AC-6MaesterMT.1066Conditional Access policies should not reference non-existent users, groups, or roles.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1068Restrict non-admin users from creating tenants.Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7MaesterMT.1070Restrict device join to selected users/groups or none.Entra IDDevice identityDevices and endpointsMediumLowLowT1098.005nist-800-53-r5:AC-6, nist-800-53-r5:IA-3MaesterMT.1071At least one Conditional Access policy explicitly includes Azure DevOps.Entra IDConditional AccessAccess controlMediumLowLowT1078.004nist-800-53-r5:AC-3MaesterMT.1073Soft- and hard-matching of synchronized objects should be blocked.Entra IDHybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098nist-800-53-r5:IA-4, nist-800-53-r5:CM-6MaesterMT.1075Require explicit assignment of Third Party Entra Apps.Entra IDApplicationsApplications and workload identitiesMediumMediumHighT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1077App registrations with privileged API permissions should not have owners.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1078App registrations with highly privileged directory roles should not have owners.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1079Privileged API permissions on service principals should not remain unused.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1078.004nist-800-53-r5:AC-6Exposure management (XSPM)MT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.DefenderExposure ManagementPrivileged accessMediumLowMediumT1539, T1528—Exposure management (XSPM)MT.1081Hybrid users should not be assigned Entra ID role assignments.DefenderExposure ManagementPrivileged accessMediumLowMediumT1078.002, T1078.004 +1nist-800-53-r5:AC-6(5)Exposure management (XSPM)MT.1088Devices with critical credentials should be protected by TPM.DefenderExposure ManagementDevices and endpointsMediumLowMediumT1552.004—Exposure management (XSPM)MT.1089Devices with critical credentials should be protected by Credential Guard.DefenderExposure ManagementDevices and endpointsMediumLowMediumT1003.001—Exposure management (XSPM)MT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra joinEntra IDDevice identityPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-6MaesterMT.1091Registering user should not be added as local administrator on the device during Microsoft Entra joinEntra IDDevice identityPrivileged accessMediumMediumLowT1078.004nist-800-53-r5:AC-6MaesterMT.1096Ensure at least one Intune Multi Admin Approval policy is configuredIntuneTenant administrationPrivileged accessMediumLowLowT1072, T1078.004nist-800-53-r5:AC-3(2), nist-800-53-r5:CM-5(4)MaesterMT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreviewDefenderExposure ManagementPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-2Exposure management (XSPM)MT.1115AI agents should not have risky HTTP configurations.Copilot StudioAgentsAI and agentsMediumLowMediumT1571, T1048 +1nist-800-53-r5:SC-7MaesterMT.1118AI agents should not use author (maker) authentication for connections.Copilot StudioAgentsAI and agentsMediumMediumMediumT1550.001, T1213nist-800-53-r5:AC-6MaesterMT.1120AI agents should not use MCP server tools without review.Copilot StudioAgentsAI and agentsMediumLowMediumT1195, T1199—MaesterMT.1121AI agents with generative orchestration should have custom instructions.Copilot StudioAgentsAI and agentsMediumLowMedium——MaesterMT.1122AI agents should not have orphaned ownership.Copilot StudioAgentsAI and agentsMediumLowMedium——MaesterMT.1148Archive Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1027.015, T1204.002nist-800-53-r5:SI-3MaesterMT.1151Email Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1566.001nist-800-53-r5:SI-3MaesterMT.1154Full Scan Removable Drives should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1091nist-800-53-r5:SI-3MaesterMT.1156Scanning Network Files should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1080nist-800-53-r5:SI-3MaesterMT.1161Cloud Block Level should be High or higher.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1164PUA Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1166Local Admin Merge should be disabled.DefenderEndpoint antivirusDevices and endpointsMediumLowMediumT1685, T1564.012nist-800-53-r5:CM-6MaesterMT.1167Real-Time Scan Direction should cover both directions.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1171Sample Submission should send safe samples automatically.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002—MaesterMT.1174Insider Risk Management policy for Risky AI usage is enabled.PurviewInsider risk managementLogging and detectionMediumLowMediumT1213nist-800-53-r5:SI-4MaesterMT.1175DLP policy is configured for the Microsoft 365 Copilot location.PurviewData loss preventionData protectionMediumLowMediumT1213.002, T1530nist-800-53-r5:SC-7(10)MaesterMT.1176Retention policy is configured for the Microsoft Copilot location.Purview
Data lifecycle managementData protectionMediumLowLow—nist-800-53-r5:SI-12MaesterMT.1177Ensure LAPS Configuration Policy is properly set.IntuneEndpoint securityPrivileged accessMediumLowMediumT1078.003, T1021nist-800-53-r5:IA-5MaesterMT.1180Ensure Managed Installer Rules are configured correctly.IntuneEndpoint securityDevices and endpointsMediumLowLow—nist-800-53-r5:CM-7(5)MaesterMT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.Entra IDUser and directory settingsEmail and collaboration protectionMediumMediumHighT1566, T1684.002nist-800-53-r5:SI-8MaesterMT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.Entra IDHybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098—MaesterMT.1184Conditional Access policy without any target resources configured.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1185Block legacy MSOnline (MSOL) PowerShell module.Entra IDUser and directory settingsAccess controlMediumLowLowT1059.009, T1078.004nist-800-53-r5:CM-7MaesterMT.1186Require explicit assignment of high-privilege first-party Entra Apps.Entra IDApplicationsApplications and workload identitiesMediumMediumMediumT1059.009, T1087.004 +1nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowMedium——MaesterMT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1078.004, T1133nist-800-53-r5:AC-17, nist-800-53-r5:IA-3MaesterMT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowLow——MaesterMT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreviewEntra IDGlobal Secure AccessPrivileged accessMediumLowLow——MaesterMT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1021, T1046nist-800-53-r5:SC-7, nist-800-53-r5:AC-17MaesterMT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowLowT1204.001, T1566.002—MaesterMT.1196Review who can change attributes used by dynamic group rules.Entra IDGroupsAccess controlMediumLowMediumT1098—MaesterMT.1197Remove memberOf rules.Entra IDGroupsIdentity lifecycle and hygieneMediumLowMedium——MaesterMT.1198App registration certificates should not have excessive validity periods.Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1649nist-800-53-r5:IA-5MaesterMT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2MaesterMT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2MaesterMT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-2(3)MaesterMT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowMediumT1078.004, T1098.001 +1nist-800-53-r5:IA-5MaesterMT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1214Ensure macOS compliance policy requires System Integrity Protection.IntuneDevice complianceDevices and endpointsMediumLowLowT1553.006, T1547.006 +1nist-800-53-r5:SI-7, nist-800-53-r5:CM-6MaesterMT.1215Ensure Gatekeeper restricts macOS app download locations.IntuneDevice complianceDevices and endpointsMediumLowLowT1553.001, T1204.002nist-800-53-r5:CM-11, nist-800-53-r5:CM-7(5)MaesterMT.1216Ensure macOS compliance policy requires a Defender machine risk score level.IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6MaesterMT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreviewEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1199nist-800-53-r5:IA-4MaesterMT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0AzureSubscriptionsInfrastructure hardeningMediumLowLowT1537nist-800-53-r5:AC-4MaesterMT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11MaesterMT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6MaesterMT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1233Ensure Android compliance policy requires a strong device password.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11MaesterMT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6MaesterMT.1235Ensure Android compliance policy requires device threat protection.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0IntuneApp protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19MaesterMT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0IntuneApp protectionData protectionMediumMediumLowT1567.002, T1115nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterMT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0IntuneApp protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19MaesterMT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0IntuneApp protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0IntuneApp protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19MaesterMT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0IntuneApp protectionData protectionMediumMediumLowT1115, T1567.002nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterMT.1246Ensure Android app protection policy encrypts organization data.New in 3.0IntuneApp protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19MaesterMT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0IntuneApp protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0IntuneApp protectionDevices and endpointsMediumMediumLowT1068nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreviewEntra IDIdentity ProtectionLogging and detectionMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IR-4MaesterMT.1265Fix dynamic groups whose rule processing failed.New in 3.0Entra IDGroupsIdentity lifecycle and hygieneMediumLowLow——MaesterORCA.103Outbound spam filter policy settings configured.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1078.004, T1534nist-800-53-r5:SI-8ORCAORCA.105Safe Links Synchronous URL detonation is enabled.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002nist-800-53-r5:SI-3ORCAORCA.108DKIM signing is set up for all your custom domains.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.108.1DNS Records have been set up to support DKIM.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.109Senders are not being allow listed in an unsafe manner.DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.113AllowClickThrough is disabled in Safe Links policies.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.114No IP Allow Lists have been configured.DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:AC-4ORCAORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.120.1Zero Hour Autopurge Enabled for Phish.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.120.2Zero Hour Autopurge Enabled for Malware.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566.001nist-800-53-r5:SI-3ORCAORCA.120.3Zero Hour Autopurge Enabled for Spam.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.121Supported filter policy action used.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566—ORCAORCA.140High Confidence Spam action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.142Phish action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.156Safe Links Policies are tracking when user clicks on safe links.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3, nist-800-53-r5:AU-12ORCAORCA.158Safe Attachments is enabled for SharePoint and Teams.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1080, T1204.002nist-800-53-r5:SI-3ORCAORCA.179Safe Links is enabled intra-organization.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1534, T1204.001nist-800-53-r5:SI-3ORCAORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.189Safe Attachments is not bypassed.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.205Common attachment type filter is enabled.DefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.220Advanced Phish filter Threshold level is adequate.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.221Mailbox intelligence is enabled in anti-phishing policies.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.222Domain Impersonation action is set to move to Quarantine.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.223User impersonation action is set to move to Quarantine.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.225Safe Documents is enabled for Office clients.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1204.002nist-800-53-r5:SI-3ORCAORCA.226Each domain has a Safe Link policy applied to it.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.227Each domain has a Safe Attachments policy applied to it.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.228No trusted senders in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowMediumT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.229No trusted domains in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowMediumT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.233Domains are pointed directly at EOP or enhanced filtering is used.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566—ORCAORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566—ORCAORCA.234Click through is disabled for Safe Documents.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1204.002nist-800-53-r5:SI-3ORCAORCA.235SPF records is set up for all your custom domains.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.236Safe Links is enabled for emails.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.237Safe Links is enabled for teams messages.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1204.001nist-800-53-r5:SI-3ORCAORCA.238Safe Links is enabled for office documents.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1204.001nist-800-53-r5:SI-3ORCAORCA.240Outlook is configured to display external tags for external emails.DefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.244Policies are configured to honor sending domains DMARC.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsZTAEntra IDApp consent and permissionsApplications and workload identitiesMediumHighLowT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21773Applications don't have certificates with expiration longer than 180 daysZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1649, T1078.004—Microsoft Zero Trust AssessmentZTA.21778Line-of-business and partner apps use MSALZTAEntra IDApplicationsApplications and workload identitiesMediumLowHigh——Microsoft Zero Trust AssessmentZTA.21779Use recent versions of Microsoft ApplicationsZTAEntra IDApplicationsApplications and workload identitiesMediumLowMedium——Microsoft Zero Trust AssessmentZTA.21780No usage of ADAL in the tenantZTAEntra IDApplicationsApplications and workload identitiesMediumLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21784All user sign in activity uses phishing-resistant authentication methodsZTAEntra IDConditional AccessAuthenticationMediumLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21789Tenant creation events are triagedZTAEntra IDLogs and monitoringLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.21791Guests can’t invite other guestsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003—Microsoft Zero Trust AssessmentZTA.21792Guests have restricted access to directory objectsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumLowT1087.004, T1069.003—Microsoft Zero Trust AssessmentZTA.21795No legacy authentication sign-in activityZTAEntra IDConditional AccessAuthenticationMediumHighLowT1110.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21796Block legacy authentication policy is configuredZTAEntra IDConditional AccessAuthenticationMediumHighLowT1110.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21800All user sign-in activity uses strong authentication methodsZTAEntra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1111 +1—Microsoft Zero Trust AssessmentZTA.21801Users have strong authentication methods configuredZTAEntra IDAuthentication methodsAuthenticationMediumMediumMediumT1078.004, T1111—Microsoft Zero Trust AssessmentZTA.21802Authenticator app shows sign-in contextZTAEntra IDAuthentication methodsAuthenticationMediumLowLowT1621—Microsoft Zero Trust AssessmentZTA.21807Creating new applications and service principals is restricted to privileged usersZTAEntra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528—Microsoft Zero Trust AssessmentZTA.21810Resource-specific consent is restrictedZTAEntra IDApp consent and permissionsApplications and workload identitiesMediumMediumMediumT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21811Password expiration is disabledZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110—Microsoft Zero Trust AssessmentZTA.21819Activation alert for Global Administrator role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21821Guest access is restrictedZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1087.004, T1069.003—Microsoft Zero Trust AssessmentZTA.21822Guest access is limited to approved tenantsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumHighT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21823Guest self-service sign-up via user flow is disabledZTAEntra IDExternal identitiesExternal access and sharingMediumLowLowT1136.003—Microsoft Zero Trust AssessmentZTA.21824Guests don't have long lived sign-in sessionsZTAEntra IDConditional AccessAuthenticationMediumMediumLowT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21825Privileged user sessions don't have long lived sign-in sessionsZTAEntra IDConditional AccessPrivileged accessMediumMediumLowT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21831Conditional Access protected actions are enabledZTAEntra IDRoles and administratorsPrivileged accessMediumLowLowT1556.009, T1484.002—Microsoft Zero Trust AssessmentZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitZTAEntra IDConditional AccessPrivileged accessMediumLowLowT1098, T1556.009—Microsoft Zero Trust AssessmentZTA.21849Smart lockout duration is set to a minimum of 60ZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110.003, T1110.004—Microsoft Zero Trust AssessmentZTA.21850Smart lockout threshold isn't greater than 10ZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003—Microsoft Zero Trust AssessmentZTA.21851Guest access is protected by strong authentication methodsZTAEntra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21854Privileged roles aren't assigned to stale identitiesZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21855Privileged roles have access reviewsZTAEntra IDIdentity GovernancePrivileged accessMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21857Guest identities are lifecycle managed with access reviewsZTAEntra IDIdentity GovernanceExternal access and sharingMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21858Inactive guest identities are disabled or removed from the tenantZTAEntra IDExternal identitiesExternal access and sharingMediumLowMediumT1078.004, T1110.003—Microsoft Zero Trust AssessmentZTA.21859GDAP admin least privilegeZTAEntra IDRoles and administratorsPrivileged accessMediumLowMediumT1199, T1078.004—Microsoft Zero Trust AssessmentZTA.21862All risky workload identities are triagedZTAEntra IDIdentity ProtectionApplications and workload identitiesMediumLowHighT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21865Named locations are configuredZTAEntra IDConditional AccessAccess controlMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21866All Microsoft Entra recommendations are addressedZTAEntra IDEntra recommendationsInfrastructure hardeningMediumLowMedium——Microsoft Zero Trust AssessmentZTA.21868Guests do not own apps in the tenantZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001, T1199—Microsoft Zero Trust AssessmentZTA.21869Enterprise applications must require explicit assignment or scoped provisioningZTAEntra IDApplicationsApplications and workload identitiesMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1199, T1078.004—Microsoft Zero Trust AssessmentZTA.21876Use PIM for Microsoft Entra privileged rolesZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21877All guests have a sponsorZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21878All entitlement management policies have an expiration dateZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21879All entitlement management policies that apply to External users require approvalZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21882No nested groups in PIM for groupsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowMediumT1098—Microsoft Zero Trust AssessmentZTA.21883Workload Identities are configured with risk-based policiesZTAEntra IDConditional AccessApplications and workload identitiesMediumHighLowT1078.004—Microsoft Zero Trust AssessmentZTA.21884Workload identities based on known networks are configuredZTAEntra IDConditional AccessApplications and workload identitiesMediumLowMediumT1078.004, T1552.001—Microsoft Zero Trust AssessmentZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredZTAEntra IDApplicationsIdentity lifecycle and hygieneMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21887All registered redirect URIs must have proper DNS records and ownershipsZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1528, T1584.001—Microsoft Zero Trust AssessmentZTA.21890Require password reset notifications for user rolesZTAEntra IDAuthentication methodsLogging and detectionMediumMediumLowT1098—Microsoft Zero Trust AssessmentZTA.21892All sign-in activity comes from managed devicesZTAEntra IDConditional AccessAccess controlMediumHighHighT1078.004—Microsoft Zero Trust AssessmentZTA.21896Service principals don't have certificates or credentials associated with themZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001—Microsoft Zero Trust AssessmentZTA.21897All app assignment and group membership is governedZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumHighHighT1078.004—Microsoft Zero Trust AssessmentZTA.21898All supported access lifecycle resources are managed with entitlement management packagesZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumMediumHighT1078.004—Microsoft Zero Trust AssessmentZTA.21899All privileged role assignments have a recipient that can receive notificationsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003—Microsoft Zero Trust AssessmentZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21941Token protection policies are configuredZTAEntra IDConditional AccessAuthenticationMediumLowMediumT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21983No Active Medium priority Entra recommendations foundZTAEntra IDEntra recommendationsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.21985Turn off Seamless SSO if there is no usageZTAEntra IDHybrid identityAuthenticationMediumLowLowT1110, T1558.002—Microsoft Zero Trust AssessmentZTA.22072Self-Service Password Reset does not use Q & AZTAEntra IDAuthentication methodsAuthenticationMediumMediumMediumT1110.001, T1078.004—Microsoft Zero Trust AssessmentZTA.24518Enterprise applications have ownersZTAEntra IDApplicationsApplications and workload identitiesMediumLowMedium——Microsoft Zero Trust AssessmentZTA.24552macOS - Firewall policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsMediumHighHighT1021, T1210—Microsoft Zero Trust AssessmentZTA.24823Company Portal branding and support settings enhance user experience and trustZTAIntuneTenant administrationDevices and endpointsMediumLowLow——Microsoft Zero Trust AssessmentZTA.25370Source IP restoration is enabledZTAEntra IDGlobal Secure AccessAccess controlMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.25379Conditional Access policies use compliant network controlsZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1078.004, T1550.001—Microsoft Zero Trust AssessmentZTA.25380Global Secure Access signaling for Conditional Access is enabledZTAEntra IDGlobal Secure AccessAccess controlMediumHighLowT1078.004—Microsoft Zero Trust AssessmentZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumMediumLow——Microsoft Zero Trust AssessmentZTA.25392Private network connectors are running the latest versionZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumLowLowT1190—Microsoft Zero Trust AssessmentZTA.25399Private DNS is configured for internal name resolutionZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumLowMediumT1557.001—Microsoft Zero Trust AssessmentZTA.25405Intelligent Local Access is enabled and configuredZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.25408Web content filtering policies are configuredZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1189, T1204.001 +1—Microsoft Zero Trust AssessmentZTA.25409Web content filtering uses category-based rulesZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.25410Web content filtering policies are linked to security profilesZTAEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.25419Network access activity is visible to security operations for threat detection and responseZTAEntra IDLogs and monitoringLogging and detectionMediumLowLowT1046, T1021 +1—Microsoft Zero Trust AssessmentZTA.25422Global Secure Access deployment logs are populated and reviewedZTAEntra IDGlobal Secure AccessLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.25480Quick Access has user or group assignmentsZTAEntra IDGlobal Secure AccessAccess controlMediumLowLow——Microsoft Zero Trust AssessmentZTA.26885Metrics are enabled for DDoS-protected public IPsZTAAzureNetwork securityLogging and detectionMediumLowLowT1498—Microsoft Zero Trust AssessmentZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsZTAAzureNetwork securityLogging and detectionMediumLowLowT1498—Microsoft Zero Trust AssessmentZTA.27001TLS inspection bypass rules are regularly reviewedZTAEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1573, T1071.001 +1—Microsoft Zero Trust AssessmentZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningMediumLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningMediumLowLowT1110.004—Microsoft Zero Trust AssessmentZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningMediumMediumLowT1110.004—Microsoft Zero Trust AssessmentZTA.35006PDF labeling is enabled in SharePointZTAPurviewInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAPurviewInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAPurviewInformation protectionData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35012Container labels are configured for collaborative workspacesZTAPurviewInformation protectionData protectionMediumHighMediumT1213.002—Microsoft Zero Trust AssessmentZTA.35014Email label policies inherit sensitivity from attachmentsZTAPurviewInformation protectionData protectionMediumHighLow——Microsoft Zero Trust AssessmentZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAPurviewInformation protectionData protectionMediumHighMedium——Microsoft Zero Trust AssessmentZTA.35017A default sensitivity label is configured in label policiesZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35018Users must provide justification to downgrade sensitivity labelsZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35022On-demand scans are configured for sensitive information discoveryZTAPurviewData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35023OCR is enabled for sensitive information detectionZTAPurviewData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35028Email retention policies are configuredZTAPurviewData lifecycle managementData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAExchange OnlineMail flowData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAPurviewInsider risk managementData protectionMediumMediumLowT1567—Microsoft Zero Trust AssessmentZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAPurviewData classificationData protectionMediumMediumHigh——Microsoft Zero Trust AssessmentZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAPurviewData loss preventionData protectionMediumMediumHighT1567—Microsoft Zero Trust AssessmentZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageZTADefenderDefender for IdentityLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedZTADefenderDefender for IdentityLogging and detectionMediumLowLowT1558.003, T1003.006 +1—Microsoft Zero Trust AssessmentZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsZTADefenderAnti-spamEmail and collaboration protectionMediumMediumLowT1566—Microsoft Zero Trust AssessmentZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxZTADefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566—Microsoft Zero Trust AssessmentZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsZTADefenderTenant settingsEmail and collaboration protectionMediumMediumMediumT1566—Microsoft Zero Trust AssessmentZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersZTAIntuneEndpoint securityDevices and endpointsMediumMediumLowT1685—Microsoft Zero Trust AssessmentZTA.41051Removable storage and device control policies are enforced via IntuneZTAIntuneEndpoint securityDevices and endpointsMediumMediumMediumT1052.001, T1091 +1—Microsoft Zero Trust AssessmentZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalZTADefenderTenant settingsLogging and detectionMediumLowMediumT1566—Microsoft Zero Trust AssessmentZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1071, T1566—Microsoft Zero Trust AssessmentZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1685—Microsoft Zero Trust AssessmentZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantZTAAzureSubscriptionsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementZTAAzureSubscriptionsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)ZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.51019MAM app access timeout and re-authentication are enforced after idle periodZTAIntuneApp protectionAuthenticationMediumMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)ZTAEntra IDAgent identitiesAI and agentsMediumLowMedium——Microsoft Zero Trust AssessmentZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeZTAEntra IDAgent identitiesAI and agentsMediumLowLow——Microsoft Zero Trust AssessmentZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentAD-DFSR-01All domain controllers should have DFS-R subscriptionsActive Directory
ReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-04Unlinked GPO count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-05GPO unlinked details should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOL-03GPO unlinked target count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOREP-06GPOs without domain computers count should be retrievableActive DirectoryGroup PolicyAccess controlLowLowMedium——Active DirectoryAD-REPL-01No replication connections should be disabledActive DirectoryReplicationInfrastructure hardeningLowLowLow——Active DirectoryAD-ROOTDSE-03Root DSE should be synchronizedActive DirectoryReplicationInfrastructure hardeningLowLowMedium——Active DirectoryASD.ISM-1654Internet Explorer 11 is disabled or removed.New in 3.0IntuneDevice configurationDevices and endpointsLowLowLowT1189essential-eight:ISM-1654, nist-800-53-r5:CM-7 +1ASD Essential EightAZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0Azure DevOpsUsers and accessAccess controlLowLowLow——MaesterAZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0Azure DevOpsRepositoriesEngineering systemsLowLowLowT1589.002—MaesterCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Microsoft 365Organization settingsExternal access and sharingLowLowLowT1566cis-m365:1.3.9, nist-800-53-r5:AC-3CISCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0PurviewInformation protectionData protectionLowMediumMedium—cis-m365:3.3.1, nist-800-53-r5:AC-4CISCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0Entra IDGroupsAccess controlLowMediumLowT1098cis-m365:5.1.3.1, nist-800-53-r5:AC-6CISCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0Entra IDGroupsAccess controlLowMediumLow—cis-m365:5.1.3.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Entra IDDevice identityDevices and endpointsLowLowLowT1098.005cis-m365:5.1.4.2, nist-800-53-r5:CM-8CISCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Entra IDConditional AccessAccess controlLowLowLow—cis-m365:5.2.2.14, nist-800-53-r5:AC-3CISCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowLowLowT1111cis-m365:5.2.3.6, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowMediumLowT1111cis-m365:5.2.3.10, nist-800-53-r5:IA-2CISCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0Exchange OnlineOutlookExternal access and sharingLowLowLowT1566cis-m365:6.3.2, nist-800-53-r5:AC-20CISCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Exchange OnlineClient accessAuthenticationLowLowLow—cis-m365:6.5.1, nist-800-53-r5:IA-2CISCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0Exchange OnlineOutlookEmail and collaboration protectionLowLowLow—cis-m365:6.5.2, nist-800-53-r5:AC-4CISCIS.M365.8.5.6Ensure only organizers and co-organizers can presentNew in 3.0TeamsMeetingsEmail and collaboration protectionLowMediumLowT1566.003cis-m365:8.5.6, nist-800-53-r5:AC-3CISCIS.M365.8.5.9Ensure meeting recording is off by defaultNew in 3.0TeamsMeetingsData protectionLowMediumLow—cis-m365:8.5.9, nist-800-53-r5:CM-7CISCIS.M365.9.1.3Restrict guest browsing of Fabric contentNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingLowMediumLowT1213cis-m365:9.1.3, nist-800-53-r5:AC-3CISCIS.M365.9.1.7Restrict organization-wide Fabric linksNew in 3.0Microsoft FabricExport and sharing settingsAccess controlLowMediumLow—cis-m365:9.1.7, nist-800-53-r5:AC-3CISCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDAuthentication methodsAuthenticationLowLowMedium—cisa-scuba:MS.AAD.3.4, nist-800-53-r5:CM-7CISA SCuBADISA.V-267355Microsoft Intune service must enforce a 60-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationLowMediumLowT1078.004disa-stig-intune-desktop:V-267355, nist-800-53-r5:IA-5(1)DISA STIGsDISA.V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.New in 3.0-IncludePreviewEntra IDUser and directory settingsAccess controlLowLowLow—disa-stig-entra-id:V-270209, nist-800-53-r5:AC-8DISA STIGsDISA.V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationLowMediumLowT1078.004disa-stig-entra-id:V-270239, nist-800-53-r5:IA-5(1)DISA STIGsEIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDAuthentication methodsAuthenticationLowLowMedium—nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDGroupsExternal access and sharingLowLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:AC-21Entra ID SCA (EIDSCA)MT.1022All users utilizing a P1 license should be licensed.Entra IDConditional AccessInfrastructure hardeningLowLowMedium——MaesterMT.1023All users utilizing a P2 license should be licensed.Entra IDConditional AccessInfrastructure hardeningLowLowMedium——MaesterMT.1037Only users with Presenter role are allowed to present in Teams meetingsTeamsMeetingsEmail and collaboration protectionLowMediumLow—nist-800-53-r5:AC-6MaesterMT.1039Ensure MailTips are enabled for end usersExchange OnlineOutlookEmail and collaboration protectionLowLowLow——MaesterMT.1044Ensure modern authentication for Exchange Online is enabledExchange OnlineClient accessAuthenticationLowLowLowT1110—MaesterMT.1053Ensure intune device clean-up rule is configuredIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.Entra IDGroupsAccess controlLowMediumLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7MaesterMT.1067Authentication method policies should not reference non-existent groups.Entra IDAuthentication methodsAuthenticationLowLowLow——MaesterMT.1069Restrict non-admin users from creating security groups.Entra IDUser and directory settingsAccess controlLowLowLow—nist-800-53-r5:AC-6MaesterMT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainExchange Online
MailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1076MOERA SHOULD NOT be used for sent mailExchange OnlineMailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1083Ensure Delicensing Resiliency is enabledExchange OnlineMailboxesInfrastructure hardeningLowLowLow——MaesterMT.1085Pending approvals for Critical Asset Management should not be present.DefenderExposure ManagementLogging and detectionLowLowLow——Exposure management (XSPM)MT.1086Devices should not share both critical and non-critical user credentials.DefenderExposure ManagementDevices and endpointsLowLowHighT1003—Exposure management (XSPM)MT.1099Windows Diagnostic Data Processing should be enabledIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1101Default Branding Profile should be customizedIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1105Ensure MDM Authority is set to IntuneIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1107Access packages and catalogs should not reference deleted groups.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1108Access packages should not reference inactive or orphaned assignment policies.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1109Access package approval workflows must have valid approvers.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1110No catalog should contain resources without any associated access packages.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1111High privileged user should be linked to an identity.-IncludePreviewDefenderExposure ManagementPrivileged accessLowLowLow—nist-800-53-r5:AC-2Exposure management (XSPM)MT.1117Published AI agents should not be dormant.Copilot StudioAgentsAI and agentsLowLowMedium——MaesterMT.1155Full Scan Mapped Drives should be disabled for performance.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1157CPU Load Factor should be optimized (20-30%).DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1158Scan should be scheduled.DefenderEndpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3MaesterMT.1160Signatures should be checked before scan.DefenderEndpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3MaesterMT.1162Cloud Extended Timeout should be 30-50 seconds.DefenderEndpoint antivirusDevices and endpointsLowLowLowT1204.002—MaesterMT.1163Signature Update Interval should be 1-4 hours.DefenderEndpoint antivirusDevices and endpointsLowLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1168Cleaned Malware should be retained for at least 30 days.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1169Catch-up Full Scan should be disabled.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1170Catch-up Quick Scan should be disabled.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.PurviewInformation protectionData protectionLowMediumMedium—nist-800-53-r5:AC-16MaesterMT.1190Entra Private Access applications should not use the Default connector group.-IncludePreviewEntra IDGlobal Secure AccessInfrastructure hardeningLowLowLow——MaesterMT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreviewEntra IDGlobal Secure AccessAccess controlLowLowLow——MaesterMT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreviewEntra IDGlobal Secure AccessAuthenticationLowLowLow——MaesterMT.1199App registration credentials should not be expired or expiring soon.Entra IDApplicationsApplications and workload identitiesLowLowMediumT1098.001—MaesterMT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0Entra IDConditional AccessAccess controlLowLowLow—nist-800-53-r5:CM-3MaesterMT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0IntuneDevice complianceDevices and endpointsLowLowLowT1005, T1052.001nist-800-53-r5:SC-41, nist-800-53-r5:CM-7MaesterMT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0IntuneDevice complianceDevices and endpointsLowMediumMedium—nist-800-53-r5:AC-19, nist-800-53-r5:CM-6MaesterMT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0IntuneApp protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19MaesterMT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0IntuneApp protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19MaesterMT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0IntuneApp protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19MaesterMT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0IntuneApp protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19MaesterMT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0IntuneApp protectionData protectionLowMediumLowT1113nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterORCA.100Bulk Complaint Level threshold is between 4 and 6.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.101Bulk is marked as spam.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.102Advanced Spam filter options are turned off.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.106Quarantine retention period is 30 days.DefenderAnti-spamEmail and collaboration protectionLowLowLow——ORCAORCA.107End-user spam notification is enabled.Defender
QuarantineEmail and collaboration protectionLowLowLow——ORCAORCA.110Internal Sender notifications are disabled.DefenderAnti-malwareEmail and collaboration protectionLowLowLow——ORCAORCA.139Spam action set to move message to junk mail folder or quarantine.DefenderAnti-spamEmail and collaboration protectionLowLowLowT1566nist-800-53-r5:SI-8ORCAORCA.141Bulk action set to Move message to Junk Email Folder.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.DefenderAnti-phishingEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.DefenderAnti-malwareEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-3ORCAZTA.21775Tenant app management policy is configuredZTAEntra IDApplicationsApplications and workload identitiesLowMediumLowT1098.001, T1552—Microsoft Zero Trust AssessmentZTA.21812Maximum number of Global Administrators doesn't exceed eight usersZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21813High Global Administrator to privileged user ratioZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21816All privileged role assignments are managed with PIMZTAEntra IDPrivileged Identity ManagementPrivileged accessLowLowLowT1098.003—Microsoft Zero Trust AssessmentZTA.21820Activation alert for all privileged role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessLowLowMediumT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21833Directory Sync account credentials haven't been rotated recentlyZTAEntra IDHybrid identityPrivileged accessLowLowHighT1078.004, T1556.007—Microsoft Zero Trust AssessmentZTA.21834Directory sync account is locked down to specific named locationZTAEntra IDConditional AccessPrivileged accessLowLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21835Emergency account existsZTAEntra IDRoles and administratorsPrivileged accessLowLowLow——Microsoft Zero Trust AssessmentZTA.21837Limit the maximum number of devices per user to 10ZTAEntra IDDevice identityDevices and endpointsLowLowLowT1098.005—Microsoft Zero Trust AssessmentZTA.21838Security key authentication method enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1566.002—Microsoft Zero Trust AssessmentZTA.21839Passkey authentication method enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21840Security key attestation is enforcedZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1098.005—Microsoft Zero Trust AssessmentZTA.21841Authenticator app report suspicious activity is enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1621, T1078.004—Microsoft Zero Trust AssessmentZTA.21842Block administrators from using SSPRZTAEntra IDUser and directory settingsPrivileged accessLowLowLowT1078.004, T1531—Microsoft Zero Trust AssessmentZTA.21843Block legacy Microsoft Online PowerShell moduleZTAEntra IDUser and directory settingsAccess controlLowLowHighT1059.009, T1078.004—Microsoft Zero Trust AssessmentZTA.21844Block legacy Azure AD PowerShell moduleZTAEntra IDApplicationsApplications and workload identitiesLowLowHighT1059.009, T1078.004—Microsoft Zero Trust AssessmentZTA.21845Temporary access pass is enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLow——Microsoft Zero Trust AssessmentZTA.21846Temporary access pass restricted to one-time useZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1078.004, T1098.005—Microsoft Zero Trust AssessmentZTA.21848Enable custom banned passwordsZTAEntra IDPassword protectionAuthenticationLowLowLowT1110.003—Microsoft Zero Trust AssessmentZTA.21867All enterprise applications have ownersZTAEntra IDApplicationsApplications and workload identitiesLowLowMediumT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21870Enable SSPRZTAEntra IDAuthentication methodsAuthenticationLowLowLow——Microsoft Zero Trust AssessmentZTA.21889Reduce the user-visible password surface areaZTAEntra IDAuthentication methodsAuthenticationLowMediumMediumT1110.003, T1110.004 +1—Microsoft Zero Trust AssessmentZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationZTAEntra IDIdentity ProtectionAuthenticationLowMediumMediumT1078.004, T1098.005—Microsoft Zero Trust AssessmentZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityZTAEntra IDApplicationsApplications and workload identitiesLowLowMediumT1649, T1098.001—Microsoft Zero Trust AssessmentZTA.21895Application Certificate Credentials are managed using HSMZTAEntra IDApplicationsApplications and workload identitiesLowLowHighT1552.004—Microsoft Zero Trust AssessmentZTA.21953Local Admin Password Solution is deployedZTAEntra IDDevice identityPrivileged accessLowLowLowT1078.003, T1021—Microsoft Zero Trust AssessmentZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesZTAEntra IDDevice identityAccess controlLowLowLowT1552—Microsoft Zero Trust AssessmentZTA.21955Manage the local administrators on Microsoft Entra joined devicesZTAEntra IDDevice identityPrivileged accessLowLowLowT1531, T1078.004—Microsoft Zero Trust AssessmentZTA.21964Enable protected actions to secure Conditional Access policy creation and changesZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1556.009—Microsoft Zero Trust AssessmentZTA.21984No Active low priority Entra recommendations foundZTAEntra IDEntra recommendationsInfrastructure hardeningLowLowLow——Microsoft Zero Trust AssessmentZTA.24576Intune Endpoint Analytics policy is created and AssignedZTAIntuneTenant administrationDevices and endpointsLowLowLow——Microsoft Zero Trust AssessmentZTA.25400DNS traffic for internal domains is routed through Private AccessZTAEntra IDGlobal Secure AccessInfrastructure hardeningLowLowLowT1557.001—Microsoft Zero Trust AssessmentZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsZTAEntra IDGlobal Secure AccessAccess controlLowLowLow——Microsoft Zero Trust AssessmentZTA.35004Sensitivity label policies are published to usersZTAPurviewInformation protectionData protectionLowMediumLow——Microsoft Zero Trust AssessmentZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAPurviewInformation protectionData protectionLowLowLow——Microsoft Zero Trust AssessmentZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAPurviewInformation protectionData protectionLowHighLow——Microsoft Zero Trust AssessmentZTA.35010Double Key Encryption labels are configuredZTAPurviewInformation protectionData protectionLowHighMedium——Microsoft Zero Trust AssessmentZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAPurviewInformation protectionData protectionLowLowLow——Microsoft Zero Trust AssessmentZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorZTAAzureMicrosoft SentinelLogging and detectionLowLowHigh——Microsoft Zero Trust AssessmentZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingZTAAzureMicrosoft SentinelLogging and detectionLowLowLow——Microsoft Zero Trust AssessmentZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesZTAAzureMicrosoft SentinelLogging and detectionLowLowLow——Microsoft Zero Trust AssessmentAD-CFG-01Tombstone lifetime configuration should be retrievableActive Directory
Directory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-02dSHeuristics count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-03SPN mappings should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-04Optional features count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-05Recycle bin enabled paths should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-06LDAP query policy count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-07Default query policy should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-08AuthN policy container count should be retrievableActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-CFG-09AD activation objects count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-10Well-known security principals count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-11Registered DHCP servers count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-12Enterprise CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-13Certificate templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-14Enrollment templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-15Enrollment CA certificate details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-16Trusted root CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-17Trusted root CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-18Intermediate CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-19Intermediate CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-20CRL distribution points count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-21NTAuth certificates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-22KDS root key count should be acceptableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-23SMTP site links count should be retrievableActive Directory
Sites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-CFG-24IP site links count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-COMP-01Computer disabled count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-02Computer dormant count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1078.002—Active DirectoryAD-COMP-03Computer CreatorSid count should be retrievableActive DirectoryComputersAccess controlInfo————Active DirectoryAD-COMP-04Computer non-standard primary group count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-05Computer SID History count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-COMP-06Computer default container count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-07Computer OU count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-08Computer per OU average should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-09Computer delegation count should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-COMP-10Computer delegation details should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DACL-01Distinct DACL object count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-02OU DACL entry count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-03Conflict object count should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-04Conflict object details should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-05Deny ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-06Deny ACE details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-07Distinct DACL identity count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-08DACL ACE distribution per identity should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-09Privileged allow ACE count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-10Privileged allow ACE details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-11Privileged extended right count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-12Privileged extended right details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-13Privileged extended right identities should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-14Non-inherited ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-15Unresolved SID count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-16Unresolved SID details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-17Inherited object type count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-18Inherited object type details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DC-01DC site coverage count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-03SMBv3.1.1 enabled count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-05DCs with all FSMO roles count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-06FSMO role holder details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-07DC operating system count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-08DC operating system details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-01DC non-standard LDAP port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-02DC non-standard LDAPS port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-03Read-only domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-04Non-Global Catalog DC count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-01Computers with unconstrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-04Computer operating system count should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-05Computer operating system details should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-07Computer DNS host name count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-08Computer DNS zone count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-09Computer DNS zone details should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DNS-01DNS zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-02Zones with only SOA/NS records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-03Root servers with incorrect IPs should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-04Root server incorrect IP details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-05Dynamic DNS record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-06Zones with non-default records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-07Zone record count details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-08Zone delegation count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-09Zone delegation details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-10SOA record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-11AD DS SRV record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-12AD DS SRV record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-13DNSSEC record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-14Empty zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-15Duplicate zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-16Reverse lookup zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-17Non-standard zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-18Reverse zone network count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-19Reverse zone network details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DOM-01Domain functional level should be retrievableActive Directory
Domain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-02Machine account quota should be retrievableActive DirectoryDomain and forestAccess controlInfo——T1136.002—Active DirectoryAD-DOM-03Domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DOM-04RIDs remaining should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-05Domain name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-06Domain name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-07NetBIOS name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-08NetBIOS name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOMS-01Allowed DNS suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FEAT-01Optional feature count should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FEAT-02Optional feature enabled details should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FGPP-01Fine-grained password policy count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-02Fine-grained password policy value count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-03Fine-grained password policy setting counts should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-04Fine-grained password policy application targets should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FOR-01Forest functional level should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-02Forest domain count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-03Tombstone lifetime should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FOR-04Recycle Bin status should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FORS-01UPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-02UPN suffixes details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-03SPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-04Cross-forest references count should be retrievableActive DirectoryDomain and forestExternal access and sharingInfo————Active DirectoryAD-GCHG-01Average group membership changes per year should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-01Distinct groups with members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-02Distinct account types of members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-03Member account types breakdown should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-04Trust members count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-05Trust members details by group should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-06Foreign SID principals count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-07Foreign SID details by domain should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-08Empty non-privileged group count should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-09Empty non-privileged group details should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-10Privileged groups with members count should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GMC-11Privileged groups with members details should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GPO-01GPO total count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-02GPO created before 2020 count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-03GPO stale-before-2020 count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-01GPO linked count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-02Disabled GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-04Enforced GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-06GPO linked OU count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-12GPO disabled link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-13GPO disabled link details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-14GPO enforcement count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-01GPO state total count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-02WMI filter count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-03WMI filter details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-04Disabled GPO settings count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-05Computer disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-06User disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-07All disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-08GPO owner distinct count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOS-09GPO owner details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GRP-01Group AdminCount should be retrievableActive DirectoryGroupsPrivileged accessInfo————Active DirectoryAD-GRP-02Groups in container objects count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-03Stale groups count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-04Groups with manager count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-05Group SID History count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-GRP-06Distribution group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-07Security group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-08Domain local group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-09Global group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-10Universal group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-KRBTGT-02KRBTGT last logon should be investigatedActive DirectoryAccount securityAuthenticationInfo——T1078.001—Active DirectoryAD-MSA-01Managed service account count should be investigatedActive DirectoryAccount securityApplications and workload identitiesInfo————Active DirectoryAD-OU-01OU overlapping name count should be retrievableActive Directory
Organizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-02OU at domain root count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-03OU stale count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-04OU empty count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-05OU empty details should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-PRINT-01Printer total count should be retrievableActive Directory
PrintersInfrastructure hardeningInfo————Active DirectoryAD-PWDPOL-01Password history count should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.004—Active DirectoryAD-PWDPOL-02Password maximum age should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.002, T1078.002—Active DirectoryAD-PWDPOL-03Password minimum length should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-06Account lockout duration should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-07Account lockout threshold should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-REPL-02Non-auto replication connection count should be investigatedActive DirectoryReplicationInfrastructure hardeningInfo————Active DirectoryAD-ROOTDSE-01Supported SASL mechanism count should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-ROOTDSE-02Supported SASL mechanism details should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-SCH-01Schema modification year count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-02Schema modification year details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-03Schema version entry count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-04Schema version details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SITE-01Site total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-02Sites without domain controllers count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-03Sites without domain controllers details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-04Sites without subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-05Sites without subnet associations details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SPN-01Computer SPN service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-02Computer SPN service class usage should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-03Computer SPN unknown service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-04Computer SPN unknown service class details should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-05Computer SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-06User SPN total count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-07User SPN service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-08User SPN service class usage should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-09User SPN unknown service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-10User SPN unknown service class details should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-11User SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesAuthenticationInfo————Active DirectoryAD-SUB-01Subnet total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-02Sites with subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-03Catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-04IPv6 subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-05IPv6 catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-08Distinct first octets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-11Subnets without site associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-TRUST-01Trust total count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-02Trust inter-forest count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-03Trust quarantined count should be investigatedActive DirectoryTrustsExternal access and sharingInfo——T1134.005—Active DirectoryAD-TRUST-05Trust configuration details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-06Trust stale count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-07Trust stale details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-USER-01Disabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-02Dormant enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-USER-03Non-expiring password user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-04Reversible encryption user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1556.005—Active DirectoryAD-USER-05Delegation-enabled user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-USER-06DES-only Kerberos user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558—Active DirectoryAD-USER-07No pre-authentication user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558.004—Active DirectoryAD-USER-08Never-logged-in enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-09Password-not-required user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-10Workstation-restricted user count should be retrievableActive DirectoryUsersAccess controlInfo————Active DirectoryAD-USER-11User AdminCount count should be retrievableActive DirectoryUsersPrivileged accessInfo————Active DirectoryAD-USER-12User non-standard primary group count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-13User SID History count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-USER-14User SPN count should be retrievableActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-USER-15User manager count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-16User home directory count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-17User profile path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-18User script path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo——T1037.003—Active DirectoryAD-USER-19User in container count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-20Known service account count should be retrievableActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-21Known service account details should be investigatedActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-22Built-in administrator account count should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-23Enabled built-in administrator details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-24Built-in administrator last logon details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-25Built-in administrator password age details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001, T1110.003—Active DirectoryAD-USER-26Honey pot user count should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-27Honey pot user details should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-28User delegation configured count should be investigatedActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAZDO.1009Feedback Collection.New in 3.0Azure DevOpsOrganization policiesEngineering systemsInfo————MaesterAZDO.1011Project Resource Limits.New in 3.0Azure DevOps
Resource usage and limitsEngineering systemsInfo————MaesterAZDO.1012Work Items Tags Limits.New in 3.0Azure DevOpsResource usage and limitsEngineering systemsInfo————MaesterAZDO.1029Storage Usage Limit.New in 3.0Azure DevOpsResource usage and limitsEngineering systemsInfo————MaesterAZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreviewAzure DevOpsRepositoriesAI and agentsInfo————MaesterEIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDUser and directory settingsAccess controlInfo———nist-800-53-r5:AC-3Entra ID SCA (EIDSCA)MT.1159Quick Scan Time configuration is not required.DefenderEndpoint antivirusDevices and endpointsInfo————MaesterORCA.119Similar Domains Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.123Unusual Characters Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.143Safety Tips are enabled.DefenderAnti-spamEmail and collaboration protectionInfo——T1566nist-800-53-r5:SI-8ORCAORCA.224Similar Users Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAMP.CLT.UA.1001All member users have a usage location.Community pack · CLT.UAEntra ID——High————User AttributesMP.JL.CISDEFINT.L1.014ASR: Block abuse of exploited vulnerable signed drivers is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.015ASR: Block Adobe Reader from creating child processes is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.016ASR: Block all Office applications from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.017ASR: Block credential stealing from the Windows local security authority subsystem is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.018ASR: Block executable content from email client and webmail is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.019ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.020ASR: Block execution of potentially obfuscated scripts is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.021ASR: Block JavaScript or VBScript from launching downloaded executable content is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.022ASR: Block Office applications from creating executable content is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.023ASR: Block Office applications from injecting code into other processes is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.024ASR: Block Office communication application from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.025ASR: Block persistence through WMI event subscription is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.026ASR: Block process creations originating from PSExec and WMI commands is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.027ASR: Block rebooting machine in Safe Mode is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.028ASR: Block untrusted and unsigned processes that run from USB is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.029ASR: Block Win32 API calls from Office macros is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.030ASR: Use advanced protection against ransomware is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.031Check For Signatures Before Running Scan is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISIOSINT.L1.001Block viewing corporate documents in unmanaged apps is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.008Force encrypted backup is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.009Block managed apps from storing data in iCloud is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.012Block iCloud Photos sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.013Block iCloud Photo Library is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.014Block My Photo Stream is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.016Block iCloud backup is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.017Block iCloud document and data sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.018Block iCloud Keychain sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.029Block users from erasing all content and settings on device is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.030Block modification of device name is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.031Block configuration profile changes is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.032Allow activation lock is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.038Require password is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.039Block simple passwords is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.040Minimum password length is at least 6Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.041Maximum minutes after screen lock before password is required is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.042Maximum minutes of inactivity until screen locks is at most 2Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.043Block password proximity requests is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.044Block password sharing is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.045Require Touch ID or Face ID authentication for AutoFill of password or credit card information is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.047Lock Screen Message is configuredCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.048Locked enrollment is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.049Sync with computers is set to Deny AllCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.050Jailbroken devices is set to BlockCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.051Minimum OS version is configuredCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.052Mark device noncompliant is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.053Device compliance status is set to CompliantCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.054Mark devices with no compliance policy assigned as is set to Not compliantCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.055Compliance status validity period (days) is at most 7Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISMACINT.L1.024Require Passcode on Device is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.026Enforce Latest Software Update Version is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.027Allow Standard User OS Updates is set to AllowedCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.028Download is set to AlwaysOnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.029Install OS Updates is set to Always OnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.030Install Security Update is set to AlwaysOnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.033Defer is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.034Defer Force At User Login Max Bypass Attempts is set to 0Community pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.035Enable is set to OnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.036Force Enable In Setup Assistant is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.037Show Recovery Key is set to DisabledCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.038User Enters Missing Info is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.039Prevent FileVault From Being Disabled is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.042Enable Firewall is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.043Enable Stealth Mode is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.083Destroy FV Key On Standby is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.084Ask For Password is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.089Removal Password is configuredCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.090Locked enrollment is set to YesCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISOFFINT.L1.003Add-on Management is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.013Restrict ActiveX Install is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.017Enable Automatic Updates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.019Access: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.022Access: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.031Default file format is set to Enabled: Excel Workbook (*.xlsx)Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.039Excel: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.040Excel: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.041Prevent Excel from running XLM macros is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.042Excel: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.051Excel 2 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.052Excel 2 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.053Excel 3 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.054Excel 3 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.055Excel 4 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.056Excel 4 workbooks is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.057Excel 4 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.058Excel 95 workbooks is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.059Excel 95-97 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.060Excel 97-2003 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.061Excel: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.062Web pages and Excel 2003 XML spreadsheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.064Excel: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.065Excel: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.069Excel: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.077Block signing into Office is set to Enabled: Org ID onlyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.162Junk E-mail protection level is set to Enabled: HighCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.163Minimum encryption settings is set to Enabled: 256Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.175Default file format is set to Enabled: PowerPoint Presentation (*pptx)Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.181PowerPoint: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.182PowerPoint: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.185PowerPoint: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.186PowerPoint 97-2003 presentations, shows, templates and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.193PowerPoint: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.195Publisher: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.196Publisher: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.198Publisher: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.204Word: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.206Word: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.210Word: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.211Word: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.212Word 2 and earlier binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.213Word 2000 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.214Word 2003 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.215Word 2007 and later binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.216Word 6.0 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.217Word 95 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.218Word 97 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.219Word XP binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.220Word: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.221Word: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.225Word: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISW11INT.BL.001Require Device Encryption is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.004Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.005Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.006Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for removable data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.025Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.026Enforce drive encryption type on operating system drives: Select the encryption type is set to Enabled: Full encryption or Used Space Only encryptionCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.L1.131Configure System Guard Launch is set to Unmanaged Enables Secure Launch if supported by hardwareCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.132Credential Guard is set to (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.133Enable Virtualization Based Security is set to enable virtualization based security.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.134Require Platform Security Features is set to Turns on VBS with Secure Boot, with or without DMACommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.139Enable Domain Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.140Enable Domain Network Firewall: Default Inbound Action for Domain Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.141Enable Domain Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.142Enable Domain Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.143Enable Domain Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.144Enable Domain Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\domainfw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.145Enable Domain Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.146Enable Private Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.147Enable Private Network Firewall: Default Inbound Action for Private Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.148Enable Private Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.149Enable Private Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.150Enable Private Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.151Enable Private Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\privatefw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.152Enable Private Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.153Enable Public Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.154Enable Public Network Firewall: Allow Local Ipsec Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.155Enable Public Network Firewall: Allow Local Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.156Enable Public Network Firewall: Default Inbound Action for Public Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.157Enable Public Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.158Enable Public Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.159Enable Public Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.160Enable Public Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\publicfw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.161Enable Public Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.257Hypervisor Enforced Code Integrity is set to (Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.258Require UEFI Memory Attributes Table is set to Require UEFI Memory Attributes TableCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.260Enable ESS with Supported Peripherals is set to Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For system…Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.261Facial Features Use Enhanced Anti Spoofing is set to trueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.262Minimum PIN Length is set to 6Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.263Require Security Device is set to trueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.273Backup Directory is set to Backup the password to Microsoft Entra ID onlyCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.274Password Age Days is at most 30Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.275Password Complexity is set to Large letters + small letters + numbers + special characters or strongerCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.276Password Length is at least 15Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.277Post Authentication Actions is set to Reset the password and logoff, or reset and rebootCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.278Post Authentication Reset Delay is set to 1 to 8 hoursCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.RKS.IA.1001Windows devices are BitLocker-encrypted and their recovery key is in Entra IDCommunity pack · RKS.IAIntune——High————RKSolutions Intune AnomaliesMP.RKS.IA.1002Windows devices back up their local administrator password to Entra IDCommunity pack · RKS.IAIntune——High————RKSolutions Intune AnomaliesMP.CLT.ADUA.1001All Active Directory users have a manager.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.ADUA.1004All Active Directory users have an employee ID.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.ADUA.1011Every Active Directory employee ID belongs to only one user.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.UA.1002All member users have a manager.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1005All member users have an employee ID.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1006All member users have an employee hire date.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1009All guest users have a sponsor.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1010Every employee ID belongs to only one user.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.JL.CISDEFINT.L1.001Configure local setting override for reporting to Microsoft MAPS is set to DisabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.002Configure the 'Block at First Sight' feature is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.003Turn on process scanning whenever real-time protection is enabled is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.004Turn off routine remediation is set to DisabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.005Allow Archive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.006Allow Behavior Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.007Allow Cloud Protection is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.008Allow Email Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.009Allow Full Scan Removable Drive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.010Allow On Access Protection is set to AllowCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.011Allow Realtime Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.012Allow scanning of all downloaded files and attachments is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.013Allow Script Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.032Cloud Block Level is set to High or higherCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.033Cloud Extended Timeout is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.034Days Until Aggressive Catchup Quick Scan is set to 7Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.035Enable Dynamic Signature Dropped Event Reporting is set to Dynamic Security intelligence update events will be reportedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.036Enable File Hash Computation is set to EnableCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.037Enable Network Protection is set to Enabled (block mode)Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.038Hide Exclusions From Local Users is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.039Oobe Enable Rtp And Sig Update is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.040PUA Protection is set to PUA Protection onCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.041Quick Scan Include Exclusions is set to 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.042Real Time Scan Direction is set to Monitor all files bi-directionalCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.043Remote Encryption Protection Configured State is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.044Scan Parameter is set to Quick scan or Full scanCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.045Schedule Quick Scan Time is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.046Schedule Scan Time is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.047Schedule Scan Day is not set to No scheduled scanCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.048Signature Update Interval is set to 1 to 4Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.049Submit Samples Consent is set to Send safe samples or all samples automaticallyCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.050Remediation action for Moderate severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.051Remediation action for High severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.052Remediation action for Severe threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISEDGEINT.L1.001Enable Google Cast is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.002Allow users to manage installed CA certificates is set to Enabled: Disallow users from managing certificatesCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.003Control use of insecure content exceptions is set to Enabled: Do not allow any site to load blockable mixed contentCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.004Control use of the File System API for writing is set to Enabled: Don't allow any site to request write access to files and directoriesCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.005Default automatic downloads setting is set to Enabled: Don't allow any website to perform automatic downloadsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.006Default geolocation setting is set to Enabled: Don't allow any site to track users' physical locationCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.007Enable insecure download warnings is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.008Configure Edge Website Typo Protection is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.009Configure users ability to override feature flags is set to Enabled: Prevent users from overriding feature flagsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.010Blocks external extensions from being installed is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.011Enable Gamer Mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.012Allow Basic authentication for HTTP is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.013Allow cross-origin HTTP Basic Auth prompts is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.014Guided Switch Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.015Specifies whether to block requests from public websites to devices on a user's local network is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.016Enable saving passwords to the password manager is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.017Enable startup boost is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.018Configure Microsoft Defender SmartScreen is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.019Configure Microsoft Defender SmartScreen to block potentially unwanted apps is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.020Enable Microsoft Defender SmartScreen DNS requests is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.021Force Microsoft Defender SmartScreen checks on downloads from trusted sources is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.022Prevent bypassing Microsoft Defender SmartScreen prompts for sites is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.023Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.024Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.025Ads setting for sites with intrusive ads is set to Enabled: Block ads on sites with intrusive adsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.026Allow download restrictions is set to Enabled: Block malicious downloadsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.027Allow Google Cast to connect to Cast devices on all IP addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.028Allow import of data from other browsers on each Microsoft Edge launch is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.029Allow importing of autofill form data is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.030Allow importing of browser settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.031Allow importing of home page settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.032Allow importing of payment info is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.033Allow importing of saved passwords is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.034Allow importing of search engine settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.035Allow managed extensions to use the Enterprise Hardware Platform API is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.036Allow personalization of ads, search and news by sending browsing history to Microsoft is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.037Allow queries to a Browser Network Time service is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.038Allow remote debugging is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.039Allow the audio sandbox to run is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.040Allow user feedback is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.041Allow Web Authentication requests on sites with broken TLS certificates is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.042Allow websites to query for available payment methods is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.043Automatically import another browser's data and settings at first run is set to Enabled: Disables automatic import, and the import section of the first-run experience is skippedCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.044Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.045Block tracking of users' web-browsing activity is set to Enabled: Balanced or StrictCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.046Clear browsing data when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.047Clear cached images and files when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.048Clear history for IE and IE mode every time you exit is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.049Configure browser process code integrity guard setting is set to Enabled: Enable code integrity guard enforcement in the browser processCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.050Configure InPrivate mode availability is set to Enabled: InPrivate mode disabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.051Configure the list of names that will bypass the HSTS policy check is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.052Configure the list of types that are excluded from synchronization is set to Enabled and includes passwordsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.053Configure the Share experience is set to Enabled: Don't allow using the Share experienceCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.054Continue running background apps after Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.055Control communication with the Experimentation and Configuration Service is set to Enabled: Disable communication with the Experimentation and Configuration ServiceCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.056Control where security restrictions on insecure origins apply is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.057Delete old browser data on migration is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.058Disable saving browser history is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.059Disable synchronization of data using Microsoft sync services is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.060DNS interception checks enabled is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.061Dynamic Code Settings is set to Enabled: Prevent the browser process from creating dynamic codeCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.062Edge 3P SERP Telemetry Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.063Edge Wallet E-Tree Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.064Enable Application Bound Encryption is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.065Enable AutoFill for addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.066Enable AutoFill for payment instruments is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.067Enable browser legacy extension point blocking is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.068Enable component updates in Microsoft Edge is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.069Enable deleting browser and download history is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.070Enable globally scoped HTTP auth cache is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.071Enable network prediction is set to Enabled: Don't predict network actions on any network connectionCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.072Enable profile creation from the Identity flyout menu or the Settings page is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.073Enable resolution of navigation errors using a web service is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.074Enable security warnings for command-line flags is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.075Enable site isolation for every site is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.076Enable the Search bar is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.077Enable tab organization suggestions is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.078Enable upload files from mobile in Microsoft Edge desktop is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.079Enable use of ephemeral profiles is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.080Enable warnings for insecure forms is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.081Enables DALL-E themes generation is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.082Enhance the security state in Microsoft Edge is set to Enabled: Balanced mode or Strict modeCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.083Hide the First-run experience and splash screen is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.084In-app support Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.085Manage exposure of local IP addressess by WebRTC is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.086Notify a user that a browser restart is recommended or required for pending updates is set to Enabled: Required - Show a recurring prompt to the user indicating that a restart is requiredCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.087Set disk cache size, in bytes is set to Enabled: 250609664Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.088Set the time period for update notifications is set to Enabled: 86400000Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.089Shopping in Microsoft Edge Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.090Show Microsoft Rewards experiences is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.091Show the Reload in Internet Explorer mode button in the toolbar is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.092Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.093Standalone Sidebar Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.094Suggest similar pages when a webpage can't be found is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.095Suppress the unsupported OS warning is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.096Wait for Internet Explorer mode tabs to completely unload before ending the browser session is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.097Wallet Donation Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.098Update policy override default is set to Enabled: Always allow updates or Automatic silent updates onlyCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.099Auto-update check period override is set to Enabled: any value except 0Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISIOSINT.L1.002Treat AirDrop as an unmanaged destination is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.003Allow copy/paste to be affected by managed open-in is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.004Block App Store is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.005Block access to network drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.006Block Siri while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.007Require Safari fraud warnings is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.010Block backup of enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.011Block notes and highlights sync for enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.015Block Handoff is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.019Force Apple Watch wrist detection is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.020Require AirPlay outgoing requests pairing password is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.021Block Apple Watch auto unlock is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.022Block iBeacon discovery of AirPrint printers is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.023Block access to USB drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.024Block sending diagnostic and usage data to Apple is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.025Block screenshots and screen recording is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.026Force limited ad tracking is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.027Block trusting new enterprise app authors is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.028Limit Apple personalized advertising is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.033Force automatic date and time is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.034Block VPN creation is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.035Block Control Center access in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.036Block Today view in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.037Block Wallet notifications in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.046Block voice dialing while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISMACINT.L1.001Disable Guest Account is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.002Allow Sign In is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.003Enabled is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.004Allow Apple Intelligence Report is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.005Allow Genmoji is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.006Allow Image Playground is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.007Allow Writing Tools is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.008Allow Smart Replies is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.009Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.010Allow Transcription is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.011Allow Transcription Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.012Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.013Force On Device Only Dictation is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.014Automatic Device Lock is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.015Change At Next Auth is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.016Regex is configuredCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.017Failed Attempts Reset In Minutes is at least 15Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.018Maximum Grace Period is set to 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.019Maximum Number of Failed Attempts is set to 5 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.020Maximum Passcode Age In Days is set to 365 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.021Minimum Passcode Length is at least 15Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.022Passcode Reuse Limit is at least 24Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.023Require Alphanumeric Passcode is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.025Enabled is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.031Enable is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.032Enable Rollback is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.040Show Full Name is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.041Disable Login Items Suppression is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.044Allow Activity Continuation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.045Allow Air Play Incoming Requests is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.046Allow AirDrop is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.047Allow Apple Personalized Advertising is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.048Allow ARD Remote Management Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.049Allow Auto Unlock is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.050Allow Bluetooth Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.051Allow Cloud Address Book is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.052Allow Cloud Bookmarks is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.053Allow Cloud Calendar is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.054Allow Cloud Desktop And Documents is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.055Allow Cloud Document Sync is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.056Allow Cloud Freeform is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.057Allow Cloud Keychain Sync is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.058Allow Cloud Mail is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.059Allow Cloud Notes is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.060Allow Cloud Photo Library is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.061Allow Cloud Reminders is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.062Allow Device Name Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.063Allow Diagnostic Submission is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.064Allow Erase Content And Settings is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.065Allow File Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.066Allow Find My Friends is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.067Allow Internet Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.068Allow iPhone Mirroring is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.069Allow iTunes File Sharing is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.070Allow Local User Creation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.071Allow Media Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.072Allow Multiplayer Gaming is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.073Allow Password Proximity Requests is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.074Allow Password Sharing is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.075Allow Printer Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.076Allow Startup Disk Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.077Allow UI Configuration Profile Installation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.078Allow Universal Control is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.079Display Sleep Timer is set to 10 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.080System Sleep Timer is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.081Wake on LAN is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.082Wake On Modem Ring is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.085Allow User Overrides is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.086Allow Identified Developers is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.087Enable XProtect Malware Upload is set to DisabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.088Disable Override is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISOFFINT.L1.001Block Flash activation in Office documents is set to Enabled: Block all activationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.002Restrict legacy JScript execution for Office is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.004Bind to object is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.005Consistent Mime Handling is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.006Disable user name and password is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.007Information Bar is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.008Local Machine Zone Lockdown Security is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.009Mime Sniffing Safety Feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.010Navigate URL is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.011Object Caching Protection is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.012Protection From Zone Elevation is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.014Restrict File Download is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.015Saved from URL is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.016Scripted Window Security Restrictions is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.018Hide option to enable or disable updates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.020Access: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.021Access: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.023Underline hyperlinks is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.024Default file format is set to Enabled: Access 2007Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.025Do not prompt to convert older databases is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.026Modal Trust Decision Only is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.027Do not show data extraction options when opening corrupt workbooks is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.028Ask to update automatic links is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.029Load Pictures from Web pages not created in Excel is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.030Internet and network paths as hyperlinks is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.032Disable AutoRepublish is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.033Do not show AutoRepublish warning alert is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.034Force file extension to match file type is set to Enabled: Always match file typeCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.035Scan encrypted macros in Excel Open XML workbooks is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.036Excel: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.037WEBSERVICE Function Notification Settings is set to Enabled: Disable all with notification or Disable all without notificationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.038Block Excel XLL Add-ins that come from an untrusted source is set to Enabled: BlockedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.043Excel: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.044Store macro in Personal Macro Workbook by default is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.045Excel: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.046Always prevent untrusted Microsoft Query files from opening is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.047Don't allow Dynamic Data Exchange (DDE) server launch in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.048Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.049dBase III /IV files is set to Enable: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.050Dif and Sylk files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.063Always open untrusted database files in Protected View is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.066Excel: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.067Excel: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.068Excel: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.070Disable UI extending from documents and templates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.071Document Information Panel Beaconing UI is set to Enabled: Always show UICommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.072Allow users with earlier versions of Office to read with browsers... is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.073Always expand groups in Office when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.074Always require users to connect to verify permission is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.075Never allow users to specify groups when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.076Prevent users from changing permissions on rights managed content is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.078Control Blogging is set to Enabled: All Blogging DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.079Block opening of pre-release versions of file formats new to Excel 2016 through the Compatibility Pack for Office 2016 and Excel 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.080Block opening of pre-release versions of file formats new to PowerPoint 2016 through the Compatibility Pack for Office 2016 and PowerPoint 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.081ActiveX Control Initialization is set to Enabled: 6Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.082Allow Basic Authentication prompts from network proxies is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.083Allow VBA to load typelib references by path from untrusted intranet locations is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.084Automation Security is set to Enabled: Disable Macros by defaultCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.085Control how Office handles form-based sign-in prompts is set to Enabled: Block all promptsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.086Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.087Disable all Trust Bar notifications for security issues is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.088Disable password to open UI is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.089Encryption mode for Information Rights Management (IRM) is set to Enabled: Cipher Block Chaining (CBC)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.090Encryption type for password protected Office 97-2003 files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.091Encryption type for password protected Office Open XML files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.092Load Controls in Forms3 is set to Enabled: 4Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.093Macro Runtime Scan Scope is set to Enabled: Enable for all documentsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.094Protect document metadata for password protected files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.095Protect document metadata for rights managed Office Open XML Files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.096Suppress hyperlink warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.097Allow mix of policy and user locations is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.098Disable the Office client from polling the SharePoint Server for published links is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.099Disable Internet Fax feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.100Legacy format signatures is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.101Suppress external signature services menu item is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.102Disable Smart Document's use of manifests is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.103Open Office documents as read/write while browsing is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.104Send Office Feedback is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.105Automatically receive small updates to improve reliability is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.106Disable Opt-in Wizard on first run is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.107Enable Customer Experience Improvement Program is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.108Send personal information is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.109Do not allow users to change permissions on folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.110Automatically download attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.111Do not include Internet Calendar integration in Outlook is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.112Download full text of articles as HTML attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.113Synchronize Outlook RSS Feeds with Common Feed List is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.114Turn off RSS feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.115Do not allow Home Page URL to be set in folder Properties is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.116Disable user entries to server list is set to Enabled: Publish default, disallow othersCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.117PST Null Data on Delete is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.118Plain Text Options is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.119Make Outlook the default program for E-mail, Contacts, and Calendar is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.120Do not allow folders in non-default stores to be set as folder home pages is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.121Access to published calendars is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.122Prevent publishing to a DAV server is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.123Prevent publishing to Office.com is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.124Restrict level of calendar details users can publish is set to Enabled: Disables Full details and Limited detailsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.125Restrict upload method is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.126Add e-mail recipients to users' Safe Senders Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.127Hide Junk Mail UI is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.128Trust e-mail from contacts is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.129Turn off Outlook Social Connector is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.130Disable 'Remember password' for Internet e-mail accounts is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.131Do not automatically sign replies is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.132Prompt user to choose security settings if default settings fail is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.133Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.134Block Trusted Zones is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.135Display pictures and external content in HTML e-mail is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.136Do not permit download of content from safe zones is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.137Do not display 'Publish to GAL' button is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.138Do not provide Continue option on Encryption warning dialog boxes is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.139Message Formats is set to Enabled: S/MIMECommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.140S/MIME interoperability with external clients is set to Enabled: Handle internallyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.141Attachment Secure Temporary Folder is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.142Missing CRLs is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.143Missing Root Certificates is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.144Promote Level 2 errors as errors, not warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.145Outlook Security Mode is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.146Allow Active X One Off Forms is set to Enabled: Load only Outlook ControlsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.147Allow hyperlinks in suspected phishing e-mail messages is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.148Allow scripts in one-off Outlook forms is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.149Allow users to demote attachments to Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.150Authentication with Exchange server is set to Enabled: Kerberos Password AuthenticationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.151Configure Outlook object model prompt when accessing an address book is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.152Configure Outlook object model prompt When accessing the Formula property of a UserProperty object is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.153Configure Outlook object model prompt when executing Save As is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.154Configure Outlook object model prompt when reading address information is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.155Configure Outlook object model prompt when responding to meeting and task requests is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.156Display Level 1 attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.157Configure Outlook object model prompt when sending mail is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.158Do not allow Outlook object model scripts to run for public folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.159Do not allow Outlook object model scripts to run for shared folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.160Enable RPC encryption is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.161Include Internet in Safe Zones for Automatic Picture Download is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.164Outlook Security Policy is set to Use Outlook Security Group PolicyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.165Prevent users from customizing attachment security settings is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.166Remove file extensions blocked as Level 1 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.167Remove file extensions blocked as Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.168Retrieving CRLs (Certificate Revocation Lists) is set to Enabled: When online always retrieve the CRLCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.169Security setting for macros is set to Enabled: Warn for signed, disable unsignedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.170Set Outlook object model custom actions execution prompt is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.171Signature Warning is set to Enabled: Always warn about invalid signaturesCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.172Use Unicode format when dragging e-mail message to file system is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.173Do not prompt about Level 1 attachments when closing an item is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.174Do not prompt about Level 1 attachments when sending an item is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.176PowerPoint: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.177Run Programs is set to Enabled: disable (don't run any programs)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.178Scan encrypted macros in PowerPoint Open XML presentations is set to Enabled: Scan encrypted macrosCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.179PowerPoint: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.180Unblock automatic download of linked images is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.183PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.184PowerPoint: Trust Access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.187PowerPoint: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.188PowerPoint: Do not open files from the Internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.189PowerPoint: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.190PowerPoint: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.191PowerPoint: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.192PowerPoint: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.194Publisher Automation Security Level is set to Enabled: By UI (prompted)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.197Publisher: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.199Update automatic links at Open is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.200Hidden text is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.201Default file format is set to Enabled: Word Document (.docx)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.202Word: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.203Word: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.205Dynamic Data Exchange is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.207Word: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.208Scan encrypted macros in Word Open XML Documents is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.209Word: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.222Word: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.223Word: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.224Word: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISW11INT.BL.002Allow Warning For Other Disk Encryption is set to DisabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.003Allow Warning For Other Disk Encryption: Allow Standard User Encryption is set to Disabled: EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.007Prevent installation of devices using drivers that match these device setup classes is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.008Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed. is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.009Prevent installation of devices using drivers that match these device setup classes: Prevented Classes is set to Enabled: {d48179be-ec20-11d1-b6b8-00c04fa372a7}, {7ebefbc0-3200-11d2-b4c2-00a0C9697d07…Community pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.010Choose how BitLocker-protected fixed drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.011Choose how BitLocker-protected fixed drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Allow 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.012Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.013Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.014Choose how BitLocker-protected fixed drives can be recovered: FDVRecoveryKeyUsageDropDown_Name is set to Enabled: Allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.015Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Backup recovery passwords onlyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.016Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.017Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.018Choose how BitLocker-protected operating system drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.019Choose how BitLocker-protected operating system drives can be recovered: OSRecoveryKeyUsageDropDown_Name is set to Enabled: Do not allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.020Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Store recovery passwords and key packagesCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.021Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.022Choose how BitLocker-protected operating system drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Require 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.023Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.024Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.027Deny write access to removable drives not protected by BitLocker is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.028Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.L1.001Allow Cortana Above Lock is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.002Allow Toasts is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.003Prevent enabling lock screen camera is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.004Apply UAC restrictions to local accounts on network logons is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.005Configure SMB v1 client driver is set to Enabled: Disable driver (recommended)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.006Configure SMB v1 server is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.007Enable Structured Exception Handling Overwrite Protection (SEHOP) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.008WDigest Authentication (disabling may require KB2871997) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.009MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.010MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.011MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.012MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.013MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.014MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.015MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning: WarningLevel is set to Enabled: 90% or lessCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.016Turn off multicast name resolution is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.017Prohibit installation and configuration of Network Bridge on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.018Prohibit use of Internet Connection Sharing on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.019Require domain users to elevate when setting a network's location is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.020Hardened UNC Paths is set to Enabled: \\*\NETLOGON and \\*\SYSVOL with RequireIntegrity=1,RequireMutualAuthentication=1,RequirePrivacy=1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.021Minimize the number of simultaneous connections to the Internet or a Windows Domain is set to Enabled: 3 = Prevent Wi-Fi when on EthernetCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.022Prohibit connection to non-domain networks when connected to domain authenticated network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.023Allow Print Spooler to accept client connections is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.024Configure Redirection Guard: Redirection Guard Options is set to Enabled: Redirection Guard EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.025Configure RPC connection settings: Protocol to use for outgoing RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.026Configure RPC connection settings: Use authentication for outgoing RPC connections is set to Enabled: DefaultCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.027Configure RPC listener settings: Authentication protocol to use for incoming RPC connections is set to Enabled: Negotiate or KerberosCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.028Configure RPC listener settings: Protocols to allow for incoming RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.029Configure RPC over TCP port: RPC over TCP port is set to Enabled: 0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.030Limits print driver installation to Administrators is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.031Manage processing of Queue-specific files: Manage processing of Queue-Specific files is set to Enabled: Limit Queue-specific files to Color profilesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.032Point and Print Restrictions: When installing drivers for a new connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.033Point and Print Restrictions: When updating drivers for an existing connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.034Include command line in process creation events is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.035Encryption Oracle Remediation is set to Enabled: Force Updated ClientsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.036Remote host allows delegation of non-exportable credentials is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.037Prevent automatic download of applications associated with device metadata is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.038Boot-Start Driver Initialization Policy is set to Enabled: Good, unknown and bad but criticalCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.039Continue experiences on this device is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.040Turn off downloading of print drivers over HTTP is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.041Turn off Internet download for Web publishing and online ordering wizards is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.042Allow Custom SSPs and APs to be loaded into LSASS is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.043Block user from showing account details on sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.044Do not display network selection UI is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.045Do not enumerate connected users on domain-joined computers is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.046Enumerate local users on domain-joined computers is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.047Turn off app notifications on the lock screen is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.048Turn off picture password sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.049Turn on convenience PIN sign-in is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.050Require a password when a computer wakes (on battery) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.051Require a password when a computer wakes (plugged in) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.052Configure Offer Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.053Configure Solicited Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.054Enable RPC Endpoint Mapper Client Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.055Restrict Unauthenticated RPC clients is set to Enabled: AuthenticatedCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.056Enable Windows NTP Client is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.057Enable Windows NTP Server is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.058Allow Microsoft accounts to be optional is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.059Do not preserve zone information in file attachments (User) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.060Notify antivirus programs when opening attachments (User) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.061Disallow Autoplay for non-volume devices is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.062Set the default behavior for AutoRun is set to Enabled: Do not execute any autorun commandsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.063Turn off Autoplay is set to Enabled: All drivesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.064Do not display the password reveal button is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.065Enumerate administrator accounts on elevation is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.066Prevent the use of security questions for local accounts is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.067Enable App Installer Experimental Features is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.068Enable App Installer Hash Override is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.069Enable App Installer ms-appinstaller protocol is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.070Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.071Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.072Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.073Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 196,608 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.074Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.075Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.076Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.077Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.078Configure Windows Defender SmartScreen is set to Enabled: Warn and prevent bypassCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.079Turn off Data Execution Prevention for Explorer is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.080Turn off heap termination on corruption is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.081Turn off shell protocol protected mode is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.082Block all consumer Microsoft account user authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.083Prevent users from sharing files within their profile. (User) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.084Do not allow passwords to be saved is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.085Do not allow drive redirection is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.086Always prompt for password upon connection is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.087Require secure RPC communication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.088Require use of specific security layer for remote (RDP) connections is set to Enabled: SSLCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.089Require user authentication for remote connections by using Network Level Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.090Set client connection encryption level is set to Enabled: High LevelCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.091Do not delete temp folders upon exit is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.092Prevent downloading of enclosures is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.093Turn off the offer to update to the latest version of Windows is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.094Configure the transmission of the user's password in the content of MPR notifications sent by winlogon. is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.095Sign-in and lock last interactive user automatically after a restart is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.096Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.097Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.098Disallow Digest authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.099Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.100Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.101Disallow WinRM from storing RunAs credentials is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.102Account Logon Audit Credential Validation is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.103Account Logon Logoff Audit Account Lockout is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.104Account Logon Logoff Audit Group Membership is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.105Account Logon Logoff Audit Logoff is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.106Account Logon Logoff Audit Logon is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.107Account Management Audit Application Group Management is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.108Audit Authentication Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.109Audit Authorization Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.110Audit Changes to Audit Policy is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.111Audit File Share Access is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.112Audit Other Logon Logoff Events is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.113Audit Security Group Management is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.114Audit Security System Extension is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.115Audit Special Logon is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.116Audit User Account Management is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.117Detailed Tracking Audit PNP Activity is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.118Detailed Tracking Audit Process Creation is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.119Object Access Audit Detailed File Share is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.120Object Access Audit Other Object Access Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.121Object Access Audit Removable Storage is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.122Policy Change Audit MPSSVC Rule Level Policy Change is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.123Policy Change Audit Other Policy Change Events is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.124Privilege Use Audit Sensitive Privilege Use is set to SuccessCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.125System Audit I Psec Driver is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.126System Audit Other System Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.127System Audit Security State Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.128System Audit System Integrity is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.129Refresh cadence is at most 90Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.130DO Download Mode is not set to HTTP blended with Internet peeringCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.135Allow Cortana is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.136Allow Spotlight Collection (User) is set to 0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.137Disable Consumer Account State Content is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.138Do Not Show Feedback Notifications is set to Feedback notifications are disabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.162Audit Client Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.163Audit Client Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.164Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.165Auth Rate Limiter Delay In Ms is at least 2000Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.166Enable Auth Rate Limiter is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.167Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.168Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.169Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.170Audit Server Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.171Audit Server Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.172Enable Insecure Guest Logons is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.173Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.174Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.175Require Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.176Accounts Enable Guest Account Status is set to DisableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.177Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.178Accounts Rename Administrator Account is not AdministratorCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.179Accounts Rename Guest Account is not GuestCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.180Interactive Logon Do Not Display Last Signed In is set to Enabled (username will not be shown)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.181Interactive Logon Machine Inactivity Limit is set to 1 to 900 secondsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.182Interactive Logon Message Title For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.183Interactive Logon Message Text For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.184Interactive Logon Smart Card Removal Behavior is set to Lock Workstation, Force Logoff or Disconnect Remote Desktop SessionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.185Microsoft Network Client Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.186Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers is set to DisableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.187Microsoft Network Server Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.188Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.189Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.190Network Access Restrict Anonymous Access To Named Pipes And Shares is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.191Network Access Restrict Clients Allowed To Make Remote Calls To SAM is set to O:BAG:BAD:(A;;RC;;;BA)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.192Network Security Allow Local System To Use Computer Identity For NTLM is set to AllowCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.193Network Security Allow PKU2U Authentication Requests is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.194Network Security LAN Manager Authentication Level is set to Send LM and NTLMv2 responses only. Refuse LM and NTLMCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.195Network Security Minimum Session Security For NTLMSSP Based Clients is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.196Network Security Minimum Session Security For NTLMSSP Based Servers is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.197Network Security Restrict NTLM Audit Incoming NTLM Traffic is set to Enable auditing for all accountsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.198User Account Control Behavior Of The Elevation Prompt For Administrators is set to Prompt for consent or credentials on the secure desktopCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.199User Account Control Behavior Of The Elevation Prompt For Standard Users is set to Automatically deny elevation requestsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.200User Account Control Detect Application Installations And Prompt For Elevation is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.201User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations is set to Enabled: Application runs with UIAccess integrity only if it resides in secure location.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.202User Account Control Use Admin Approval Mode is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.203User Account Control Switch To The Secure Desktop When Prompting For Elevation is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.204User Account Control Run All Administrators In Admin Approval Mode is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.205User Account Control Virtualize File And Registry Write Failures To Per User Locations is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.206Configure Lsa Protected Process is set to Enabled with UEFI lock. LSA will run as protected process and this configuration is UEFI locked.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.207Allow apps from the Microsoft app store to auto update is set to Allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.208Allow Game DVR is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.209Block Non Admin User Install is set to AllowCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.210MSI Allow User Control Over Install is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.211MSI Always Install With Elevated Privileges is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.212Allow Input Personalization is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.213Let Apps Activate With Voice Above Lock is set to Force deny. Windows apps cannot be activated by voice while the screen is locked, and users cannot change it.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.214Allow Indexing Encrypted Stores Or Items is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.215Allow Search To Use Location is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.216Notify Malicious is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.217Notify Password Reuse is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.218Notify Unsafe App is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.219Service Enabled is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.220Enable Sudo is set to Sudo is disabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.221Allow Telemetry is set to BasicCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.222Enable One Settings Auditing is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.223Access Credential Manager As Trusted Caller is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.224Access From Network is set to *S-1-5-32-544, *S-1-5-32-555Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.225Act As Part Of The Operating System is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.226Allow Local Log On is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.227Backup Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.228Change System Time is set to *S-1-5-32-544, *S-1-5-19Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.229Create Global Objects is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.230Create Page File is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.231Create Permanent Shared Objects is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.232Create Symbolic Links is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.233Create Token is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.234Debug Programs is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.235Deny Access From Network includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.236Deny Local Log On includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.237Deny Log On As Batch Job includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.238Deny Log On As Service includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.239Deny Remote Desktop Services Log On includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.240Enable Delegation is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.241Generate Security Audits is set to *S-1-5-19, *S-1-5-20, *S-1-5-99Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.242Impersonate Client is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6, *S-1-5-99Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.243Increase Scheduling Priority is set to *S-1-5-32-544, *S-1-5-90-0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.244Load Unload Device Drivers is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.245Lock Memory is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.246Manage Auditing And Security Log is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.247Manage Volume is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.248Modify Firmware Environment is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.249Modify Object Label is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.250Profile Single Process is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.251Profile System Performance is set to *S-1-5-32-544, *S-1-5-80Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.252Remote Shutdown is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.253Replace Process Level Token is set to *S-1-5-19, *S-1-5-20Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.254Restore Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.255Shut Down The System is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.256Take Ownership is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.259Allow Auto Connect To Wi Fi Sense Hotspots is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.264Allow Windows Ink Workspace is set to Disabled, or enabled but not above the lock screenCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.265Allow Clipboard Redirection is set to Not allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.266Allow Networking is set to Not allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.267Allow Auto Update is not set to Turn off automatic updatesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.268Defer Feature Updates Period In Days is at least 180Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.269Manage Preview Builds is set to Disable Preview buildsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.270Scheduled Install Day is set to Every dayCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.271Block "Pause Updates" ability is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.272Require Pin For Pairing is set to Pairing ceremony for new devices will always require a PINCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.299Prevent enabling lock screen slide show is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.300Config refresh is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.301Require BitLocker is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.302Require Secure Boot to be enabled on the device is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.303Require code integrity is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.304Firewall is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.305Trusted Platform Module (TPM) is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.306Antivirus is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.307Antispyware is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.LPMS.1001Service principals hold only the Microsoft Graph permissions their activity requiresCommunity pack · LPMSEntra ID——Medium————Least Privileged MSGraphMP.LPMS.1004Service principals with Microsoft Graph permissions show activity in the analysis windowCommunity pack · LPMSEntra ID——Medium————Least Privileged MSGraphMP.RKS.IA.1003Windows devices are compliantCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.RKS.IA.1005The primary user of every Windows device is enabledCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.RKS.IA.1007Single-user Autopilot devices are used by one personCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.CLT.ADUA.1002All Active Directory users have a job title.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1003All Active Directory users have a department.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1005All Active Directory users have a company name.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1006All Active Directory users have a complete office address.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1007All Active Directory users have a business phone.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1008All Active Directory users have a mobile phone.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1010All Active Directory users have an office location.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1012Active Directory phone numbers use international E.164 format.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1013Active Directory name, job and location attributes have no stray spaces.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1014Active Directory country values use an approved spelling.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1015Active Directory departments are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1016Active Directory job titles are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1017Active Directory company names are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1018Active Directory street addresses are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1019Active Directory cities are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1020Active Directory states or provinces are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1021Active Directory postal codes are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1022Active Directory business phone numbers are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1023Active Directory user addresses match an approved office location.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1024All Active Directory users have the extension attributes your organisation requires.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1025Active Directory extension attribute values are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.UA.1003All member users have a job title.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1004All member users have a department.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1007All member users have a company name.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1008All member users have a complete office address.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1011User phone numbers use international E.164 format.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1012User name, job and location attributes have no stray spaces.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1013User country values use an approved spelling.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1014All member users have a business phone.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1015All member users have a mobile phone.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1017All member users have an office location.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1018User departments are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1019User job titles are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1020User company names are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1021User street addresses are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1022User cities are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1023User states or provinces are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1024User postal codes are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1025User business phone numbers are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1026User addresses match an approved office location.Community pack · CLT.UAEntra ID——Low————User AttributesMP.LPMS.1002All Microsoft Graph activity of service principals matches a known endpointCommunity pack · LPMSEntra ID——Low————Least Privileged MSGraphMP.LPMS.1003Service principals are not throttled at Warning or Critical level by Microsoft GraphCommunity pack · LPMSEntra ID——Low————Least Privileged MSGraphMP.RKS.IA.1004Windows devices have checked in with Intune recentlyCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.RKS.IA.1006Windows devices are registered in Windows AutopilotCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.RKS.IA.1008Settings Catalog policies use no deprecated settingsCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.CLT.ADUA.1009All Active Directory users have a fax number.Community pack · CLT.ADUAActive Directory——Info————AD User AttributesMP.CLT.UA.1016All member users have a fax number.Community pack · CLT.UAEntra ID——Info————User AttributesMP.JL.CISW11INT.L1.279Computer Browser (Browser) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.280IIS Admin Service (IISADMIN) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.281Infrared monitor service (irmon) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.282LxssManager (LxssManager) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.283Microsoft FTP Service (FTPSVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.284OpenSSH SSH Server (sshd) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.285Remote Procedure Call (RPC) Locator (RpcLocator) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.286Routing and Remote Access (RemoteAccess) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.287Simple TCP/IP Services (simptcp) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.288Special Administration Console Helper (sacsvr) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.289SSDP Discovery (SSDPSRV) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.290UPnP Device Host (upnphost) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.291Web Management Service (WMSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.292Windows Media Player Network Sharing Service (WMPNetworkSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.293Windows Mobile Hotspot Service (icssvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.294World Wide Web Publishing Service (W3SVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.295Xbox Accessory Management Service (XboxGipSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.296Xbox Live Auth Manager (XblAuthManager) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.297Xbox Live Game Save (XblGameSave) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.298Xbox Live Networking Service (XboxNetApiSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.LPMS.1005Least Privileged MSGraph permission analysis reportCommunity pack · LPMSEntra ID——Info————Least Privileged MSGraph
Active DirectoryGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-18No GPOs should contain a cpasswordActive DirectoryGroup PolicyAuthenticationCriticalLowMediumT1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-SPN-12No domain admin accounts should have SPNs configuredActive DirectoryService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-SPN-13No domain admin accounts should have SPNs configuredActive DirectoryService principal namesPrivileged accessCriticalLowMediumT1558.003nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5Active DirectoryAD-DC-02SMBv1 should be disabled on all domain controllersActive DirectoryDomain controllersInfrastructure hardeningHighLowMediumT1210nist-800-53-r5:CM-7Active DirectoryAD-DC-04SMB signing should be enabled on all domain controllersActive DirectoryDomain controllersInfrastructure hardeningHighLowLowT1557nist-800-53-r5:SC-8Active DirectoryAD-DCOMP-02Non-DC computers should not have unconstrained delegationActive DirectoryComputersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryAD-GPOREP-19No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-GPOREP-20No GPOs should contain a default passwordActive DirectoryGroup PolicyAuthenticationHighLowMediumT1552.001, T1552.006nist-800-53-r5:IA-5(1), nist-800-53-r5:SC-28Active DirectoryAD-TRUST-04No trusts should lack SID filtering (quarantine)Active DirectoryTrustsExternal access and sharingHighMediumMediumT1134.005nist-800-53-r5:AC-4, nist-800-53-r5:SC-7Active DirectoryAD-USER-29No users should be configured for unconstrained delegationActive DirectoryUsersAuthenticationHighLowMediumT1558, T1550.003nist-800-53-r5:AC-6Active DirectoryASD.ISM-1175Privileged user accounts (excluding those explicitly authorised to access online services) are prevented from accessing the internet, email and web services.New in 3.0Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1566essential-eight:ISM-1175, essential-eight:ISM-0445 +4ASD Essential EightASD.ISM-1504Multi-factor authentication is used to authenticate human users to their organisation's online services.New in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110essential-eight:ISM-1504, nist-800-53-r5:IA-2(2) +1ASD Essential EightASD.ISM-1649Just-in-time administration is used for the administration of systems and their resources.New in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003essential-eight:ISM-1649, nist-800-53-r5:AC-2(7) +2ASD Essential EightASD.ISM-1667Microsoft Office is blocked from creating child processes.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1566.001essential-eight:ISM-1667, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1668Microsoft Office is blocked from creating executable content.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1566.001essential-eight:ISM-1668, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1669Microsoft Office is blocked from injecting code into other processes.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1055, T1204.002essential-eight:ISM-1669, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1673Microsoft Office macros are blocked from making Win32 API calls.New in 3.0IntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1106essential-eight:ISM-1673, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release.New in 3.0IntuneDevice configurationDevices and endpointsHighMediumLowT1203, T1068essential-eight:ISM-1695, nist-800-53-r5:SI-2(3) +1ASD Essential EightASD.ISM-1872Multi-factor authentication used for authenticating human users of online services is phishing-resistant.New in 3.0Entra IDConditional AccessAuthenticationHighHighHighT1566.002essential-eight:ISM-1872, ism:ISM-1872ASD Essential EightAZDO.1000Azure DevOps OAuth apps can access resources in your organization through OAuth.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumLowT1528, T1671—MaesterAZDO.1001Identities can connect to your organization's Git repos through SSH.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumMediumT1552.004, T1098.001—MaesterAZDO.1002Log Audit Events.New in 3.0Azure DevOpsAuditingLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12, nist-800-53-r5:AU-2MaesterAZDO.1003Restrict public projects.New in 3.0Azure DevOpsSecurity policiesExternal access and sharingHighLowLowT1213.003, T1593.003nist-800-53-r5:AC-22, nist-800-53-r5:AC-3MaesterAZDO.1004Additional protections when using public package registries.New in 3.0Azure DevOpsSecurity policiesEngineering systemsHighLowLowT1195.001, T1204.005nist-800-53-r5:SR-3MaesterAZDO.1005IP Conditional Access policy validation.New in 3.0Azure DevOpsSecurity policiesAccess controlHighMediumLowT1078.004, T1550.001nist-800-53-r5:AC-17MaesterAZDO.1010Audit streaming.New in 3.0Azure DevOpsAuditingLogging and detectionHighLowMediumT1685.002, T1070nist-800-53-r5:AU-6, nist-800-53-r5:SI-4MaesterAZDO.1013Organization Owner should not be an individual.New in 3.0Azure DevOpsUsers and accessPrivileged accessHighLowLowT1078.004—MaesterAZDO.1015Limit variables that can be set at queue time.New in 3.0Azure DevOpsPipelinesEngineering systemsHighLowLowT1677nist-800-53-r5:SI-10MaesterAZDO.1016Limit job authorization scope to current project for non-release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6MaesterAZDO.1017Limit job authorization scope to current project for classic release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-6MaesterAZDO.1018Protect access to repositories in YAML pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumMediumT1550.001, T1213.003nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterAZDO.1022Limit building pull requests from forked GitHub repositories.New in 3.0Azure DevOpsPipelinesEngineering systemsHighLowLowT1677—MaesterAZDO.1023Disable Marketplace tasks.New in 3.0Azure DevOpsPipelinesEngineering systemsHighMediumHighT1195.001nist-800-53-r5:CM-7, nist-800-53-r5:CM-11MaesterAZDO.1025Enable shell tasks arguments validation.New in 3.0Azure DevOpsPipelinesEngineering systemsHighLowLowT1059, T1677nist-800-53-r5:SI-10MaesterAZDO.1030Project Collection Administrators.New in 3.0Azure DevOpsUsers and accessPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterAZDO.1031Validate SSH Key Expiration.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumLowT1552.004nist-800-53-r5:IA-5MaesterAZDO.1032(Tenant) Restrict creation of global Personal Access Tokens.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1033(Tenant) Enable automatic revocation of leaked Personal Access Tokens.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1552.001, T1593.003 +1nist-800-53-r5:IA-5MaesterAZDO.1035(Tenant) Restrict Personal Access Token lifespan.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumLowT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1036(Tenant) Restrict Personal Access Token full scope.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighLowLowT1528, T1550.001nist-800-53-r5:AC-6MaesterAZDO.1037(Organization) Restrict Personal Access Token creation.New in 3.0Azure DevOpsSecurity policiesAuthenticationHighMediumMediumT1528, T1550.001nist-800-53-r5:IA-5MaesterAZDO.1040(Organization) Secret Protection: existing repositories enrolled.New in 3.0Azure DevOpsRepositoriesEngineering systemsHighLowMediumT1552.001nist-800-53-r5:IA-5(7)MaesterAZDO.1041(Organization) Secret Protection: push protection blocks secret commits.New in 3.0Azure DevOpsRepositoriesEngineering systemsHighLowLowT1552.001nist-800-53-r5:IA-5(7)MaesterCIS.GH.1.2.3Ensure repository deletion is limited to specific usersGitHubOrganization settingsAccess controlHighLowLowT1485, T1070cis-github:1.2.3, nist-800-53-r5:AC-6CISCIS.GH.1.3.8Ensure strict base permissions are set for repositoriesGitHubOrganization settingsAccess controlHighMediumMediumT1677, T1195.002cis-github:1.3.8, nist-800-53-r5:AC-6 +1CISCIS.M365.1.1.1Ensure Administrative accounts are cloud-onlyMicrosoft 365Administrative accountsPrivileged accessHighLowMediumT1078.002, T1078.004 +1cis-m365:1.1.1, nist-800-53-r5:AC-6(5)CISCIS.M365.1.1.3Ensure that between two and four global admins are designatedMicrosoft 365Administrative accountsPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:1.1.3, nist-800-53-r5:AC-6(5)CISCIS.M365.2.1.4Ensure the highest-priority Safe Attachments policy is enabledDefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002cis-m365:2.1.4, nist-800-53-r5:SI-3CISCIS.M365.2.1.14Ensure inbound anti-spam policies do not contain allowed domainsNew in 3.0DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002cis-m365:2.1.14, nist-800-53-r5:SI-8CISCIS.M365.3.1.1Ensure Microsoft 365 audit log search is EnabledPurviewAuditLogging and detectionHighLowLowT1685.002cis-m365:3.1.1, nist-800-53-r5:AU-12CISCIS.M365.5.1.5.1Ensure user consent to apps accessing company data on their behalf is not allowedEntra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002cis-m365:5.1.5.1, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.2Ensure the admin consent workflow is enabledEntra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528cis-m365:5.1.5.2, nist-800-53-r5:CM-4CISCIS.M365.5.2.2.1Ensure multifactor authentication is enabled for all users in administrative rolesNew in 3.0Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110.003cis-m365:5.2.2.1, nist-800-53-r5:IA-2(1)CISCIS.M365.5.2.2.2Ensure multifactor authentication is enabled for all usersNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110cis-m365:5.2.2.2, nist-800-53-r5:IA-2(2)CISCIS.M365.5.2.2.3Enable Conditional Access policies to block legacy authenticationNew in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.2.3, nist-800-53-r5:CM-7CISCIS.M365.5.2.2.5Ensure 'Phishing-resistant MFA strength' is required for AdministratorsNew in 3.0Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1111cis-m365:5.2.2.5, nist-800-53-r5:IA-2(1) +1CISCIS.M365.5.2.2.12Ensure the device code sign-in flow is blockedNew in 3.0Entra IDConditional AccessAuthenticationHighLowMediumT1078.004, T1528 +1cis-m365:5.2.2.12, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.4Ensure all member users are 'MFA capable'New in 3.0Entra IDAuthentication methodsAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:5.2.3.4, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.5Ensure weak authentication methods are disabledEntra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cis-m365:5.2.3.5, nist-800-53-r5:CM-7 +1CISCIS.M365.5.3.1Ensure privileged role assignments are activated and not assignedNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003cis-m365:5.3.1, nist-800-53-r5:AC-6(5)CISCIS.M365.6.1.1Ensure 'AuditDisabled' organizationally is set to 'False'New in 3.0Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1685.002cis-m365:6.1.1, nist-800-53-r5:AU-12CISCIS.M365.6.2.1Ensure all forms of mail forwarding are blocked and/or disabledNew in 3.0Exchange OnlineMail flowExternal access and sharingHighMediumLowT1114.003cis-m365:6.2.1, nist-800-53-r5:AC-4CISCIS.M365.6.5.4Ensure SMTP AUTH is disabledNew in 3.0Exchange OnlineClient accessAuthenticationHighMediumMediumT1078.004, T1110.003cis-m365:6.5.4, nist-800-53-r5:CM-7CISCISA.MS.AAD.1.1Legacy authentication SHALL be blocked.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.1.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.1, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.Entra IDConditional AccessAccess controlHighLowLowT1078.004cisa-scuba:MS.AAD.2.3, nist-800-53-r5:AC-2(12) +1CISA SCuBACISA.MS.AAD.3.1Phishing-resistant MFA SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighHighHighT1566.002cisa-scuba:MS.AAD.3.1, nist-800-53-r5:IA-2(1) +4CISA SCuBACISA.MS.AAD.3.2If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1110, T1078.004cisa-scuba:MS.AAD.3.2, nist-800-53-r5:IA-2(1) +1CISA SCuBACISA.MS.AAD.3.5The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1cisa-scuba:MS.AAD.3.5, nist-800-53-r5:CM-7b +1CISA SCuBACISA.MS.AAD.3.6Phishing-resistant MFA SHALL be required for highly privileged roles.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1566.002cisa-scuba:MS.AAD.3.6, nist-800-53-r5:IA-2(1) +3CISA SCuBACISA.MS.AAD.4.1Security logs SHALL be sent to the agency's security operations center for monitoring.Entra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002cisa-scuba:MS.AAD.4.1, nist-800-53-r5:AU-4CISA SCuBACISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1098.001, T1098.003 +2cisa-scuba:MS.AAD.5.2, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.5.3An admin consent workflow SHALL be configured for applications.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.3, nist-800-53-r5:CM-4CISA SCuBACISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1078.004cisa-scuba:MS.AAD.7.1, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.2, nist-800-53-r5:AC-5CISA SCuBACISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1cisa-scuba:MS.AAD.7.3, nist-800-53-r5:AC-6(5)CISA SCuBACISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.4, nist-800-53-r5:AC-2CISA SCuBACISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003cisa-scuba:MS.AAD.7.5, nist-800-53-r5:AC-2CISA SCuBACISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.Exchange OnlineMail flowEmail and collaboration protectionHighMediumLowT1114.003, T1048 +1cisa-scuba:MS.EXO.1.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.Exchange OnlineEmail authenticationEmail and collaboration protectionHighMediumHighT1566, T1598 +1cisa-scuba:MS.EXO.4.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.Exchange OnlineClient accessAuthenticationHighMediumMedium—cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7CISA SCuBACISA.MS.EXO.8.1A DLP solution SHALL be used.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.1, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.4At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email.Exchange OnlineData loss preventionData protectionHighMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.4, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.9.3Disallowed file types SHALL be determined and enforced.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.5At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.5, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.1Emails SHALL be scanned for malware.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.10.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.Exchange OnlineAnti-malwareEmail and collaboration protectionHighLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.10.3, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.11.1Impersonation protection checks SHOULD be used.Exchange OnlineAnti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.Exchange OnlineMailbox auditingLogging and detectionHighLowLowT1070.008, T1098.002 +3cisa-scuba:MS.EXO.13.1, nist-800-53-r5:AU-12cCISA SCuBACISA.MS.EXO.14.1A spam filter SHALL be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionHighLowLowT1566cisa-scuba:MS.EXO.14.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.Exchange OnlineSafe LinksEmail and collaboration protectionHighLowLowT1204.001, T1566.002cisa-scuba:MS.EXO.15.2, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.16.1Alerts SHALL be enabled.Exchange OnlineAlert policiesLogging and detectionHighLowLowT1114.003, T1204.001cisa-scuba:MS.EXO.16.1, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.1Microsoft Purview Audit (Standard) logging SHALL be enabled.Exchange OnlineAudit loggingLogging and detectionHighLowLowT1685.002cisa-scuba:MS.EXO.17.1, nist-800-53-r5:AU-12CISA SCuBADISA.V-267334Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneTenant administrationLogging and detectionHighLowMediumT1685.002disa-stig-intune-desktop:V-267334, nist-800-53-r5:AU-4(1) +1DISA STIGsDISA.V-267341Microsoft Intune service must be configured to use multifactor authentication for network access to privileged and nonprivileged accounts.New in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110disa-stig-intune-desktop:V-267341, nist-800-53-r5:IA-2(1) +1DISA STIGsDISA.V-270227Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.New in 3.0Entra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002disa-stig-entra-id:V-270227, nist-800-53-r5:AU-4(1) +1DISA STIGsDISA.V-270233Microsoft Entra ID must be configured to use multifactor authentication (MFA).New in 3.0Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110disa-stig-entra-id:V-270233, nist-800-53-r5:IA-2(1) +1DISA STIGsDISA.V-270335Microsoft Entra ID must use Privileged Identity Management (PIM).New in 3.0Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003disa-stig-entra-id:V-270335, nist-800-53-r5:AC-2(2)DISA STIGsDISA.V-273868Microsoft Intune service must be configured to transfer Intune logs to another server for storage, analysis, and reporting at least every seven days.New in 3.0IntuneTenant administrationLogging and detectionHighLowMediumT1685.002disa-stig-intune-mdm:V-273868, nist-800-53-r5:AU-4(1) +1DISA STIGsEIDSCA.AF01Authentication Method - FIDO2 security key - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.Entra IDAuthentication methodsAuthenticationHighLowLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.Entra IDAuthentication methodsAuthenticationHighLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.Entra IDAuthentication methodsAuthenticationHighLowLowT1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)Entra ID SCA (EIDSCA)EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.Entra IDAuthentication methodsAuthenticationHighLowLowT1621nist-800-53-r5:IA-2(8), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.Entra IDUser and directory settingsPrivileged accessHighLowLowT1098nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.Entra IDApp consent and permissionsApplications and workload identitiesHighMediumLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AS04Authentication Method - SMS - Use for sign-in.Entra IDAuthentication methodsAuthenticationHighLowLowT1111, T1566.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AV01Authentication Method - Voice call - State.Entra IDAuthentication methodsAuthenticationHighMediumMediumT1621nist-800-53-r5:CM-7, nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.Entra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528, T1566.002nist-800-53-r5:CM-4Entra ID SCA (EIDSCA)EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.Entra IDPassword protectionAuthenticationHighLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)MT.1003At least one Conditional Access policy is configured with All Apps.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004—MaesterMT.1004At least one Conditional Access policy is configured with All Apps and All Users.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004—MaesterMT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.Entra IDConditional AccessPrivileged accessHighLowLow——MaesterMT.1006At least one Conditional Access policy is configured to require MFA for admins.Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1)MaesterMT.1007At least one Conditional Access policy is configured to require MFA for all users.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1008At least one Conditional Access policy is configured to require MFA for Azure management.Entra IDConditional AccessPrivileged accessHighLowLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1009At least one Conditional Access policy is configured to block other legacy authentication.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1010At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1098.005nist-800-53-r5:AC-17, nist-800-53-r5:IA-5MaesterMT.1014At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins.Entra IDConditional AccessPrivileged accessHighLowMediumT1078.004, T1539 +1nist-800-53-r5:IA-3, nist-800-53-r5:AC-2(11)MaesterMT.1016At least one Conditional Access policy is configured to require MFA for guest access.Entra IDConditional AccessAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-20MaesterMT.1021Security Defaults are enabled.Entra IDUser and directory settingsAuthenticationHighMediumLowT1078.004, T1110nist-800-53-r5:IA-2(1), nist-800-53-r5:IA-2(2)MaesterMT.1025No external user with permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)MaesterMT.1026No hybrid user with permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1556.007 +1nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2(7)MaesterMT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1552nist-800-53-r5:AC-6(5), nist-800-53-r5:IA-5MaesterMT.1028No user with mailbox and permanent role assignment on Control Plane.Entra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1566nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-6(2)MaesterMT.1029Stale accounts are not assigned to privileged roles.Entra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-2(3), nist-800-53-r5:AC-6(5)MaesterMT.1030Eligible role assignments on Control Plane are in use by administrators.Entra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1078.004nist-800-53-r5:AC-6, nist-800-53-r5:AC-2(3)MaesterMT.1031Privileged role on Control Plane are managed by PIM only.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-2(7), nist-800-53-r5:AC-6(5)MaesterMT.1032Limited number of Global Admins are assigned.Entra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1033Users should be blocked from using legacy authentication.Entra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110nist-800-53-r5:CM-7MaesterMT.1034Emergency access users should not be blocked.Entra IDConditional AccessPrivileged accessHighLowLow——MaesterMT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.Entra IDConditional AccessPrivileged accessHighLowMediumT1098, T1556.009nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.Entra IDConditional AccessAccess controlHighLowLowT1078.004nist-800-53-r5:AC-2(12)MaesterMT.1050Apps with high-risk permissions having a direct path to Global Administrator-IncludePreviewEntra IDApp consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1051Apps with high-risk permissions having an indirect path to Global Administrator-IncludePreviewEntra IDApp consent and permissionsApplications and workload identitiesHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.Entra IDConditional AccessAuthenticationHighLowLowT1078.004, T1528 +1nist-800-53-r5:CM-7, nist-800-53-r5:IA-2MaesterMT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scopeAzureAccess managementPrivileged accessHighLowLowT1078.004, T1098.003nist-800-53-r5:AC-6(5), nist-800-53-r5:AC-2MaesterMT.1063All App registration owners should have MFA registeredEntra IDAuthentication methodsAuthenticationHighLowLowT1078.004, T1098.001 +1nist-800-53-r5:IA-2(1), nist-800-53-r5:AC-6MaesterMT.1065Ensure all Recovery Services Vaults have soft delete enabledAzureBackupData protectionHighLowLowT1490, T1485nist-800-53-r5:CP-9MaesterMT.1072Conditional Access policies should not use the deprecated Approved Client App grant.Entra IDConditional AccessAccess controlHighMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3MaesterMT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.Entra IDHybrid identityAuthenticationHighMediumMediumT1110, T1558.002nist-800-53-r5:CM-7, nist-800-53-r5:IA-2MaesterMT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.DefenderExposure ManagementDevices and endpointsHighLowMediumT1190—Exposure management (XSPM)MT.1092Intune APNS certificate should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 daysIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1095Android Enterprise account connection should be healthyIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1097Ensure all Intune Certificate Connectors are healthy and running supported versionsIntuneTenant administrationDevices and endpointsHighLowMedium——MaesterMT.1098Mobile Threat Defense Connectors should be healthyIntuneTenant administrationDevices and endpointsHighLowLow——MaesterMT.1100Intune Diagnostic Settings should include Audit LogsIntuneTenant administrationLogging and detectionHighLowMediumT1685.002nist-800-53-r5:AU-12MaesterMT.1102Windows Feature Update Policy Settings should not reference end of support buildsIntuneDevice configurationDevices and endpointsHighMediumMedium—nist-800-53-r5:SI-2MaesterMT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groupsIntuneTenant administrationPrivileged accessHighLowMediumT1098.003nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1113AI agents should not be shared with broad access control policies.Copilot StudioAgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:AC-3MaesterMT.1114AI agents should require user authentication.Copilot StudioAgentsAI and agentsHighMediumMediumT1213nist-800-53-r5:IA-2MaesterMT.1116AI agents should not send email with AI-controlled inputs.Copilot StudioAgentsAI and agentsHighLowMediumT1048nist-800-53-r5:AC-4MaesterMT.1119AI agents should not have hard-coded credentials in topics.Copilot StudioAgentsAI and agentsHighLowMediumT1552nist-800-53-r5:IA-5(7)MaesterMT.1123Ensure BitLocker full disk encryption is configuredIntuneEndpoint securityDevices and endpointsHighLowMediumT1005nist-800-53-r5:SC-28(1)MaesterMT.1147Do not sync krbtgt_AzureAD to Entra ID.Entra IDHybrid identityInfrastructure hardeningHighLowLowT1558nist-800-53-r5:IA-5, nist-800-53-r5:AC-6MaesterMT.1149Behavior Monitoring should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1150Cloud Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1152Script Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1059nist-800-53-r5:SI-3MaesterMT.1153Real-time Monitoring should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1165Network Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.001, T1189 +1nist-800-53-r5:SI-3MaesterMT.1172Unified audit log ingestion is enabled.PurviewAuditLogging and detectionHighLowLowT1685.002nist-800-53-r5:AU-12MaesterMT.1178Ensure ASR Rules are configured correctly.IntuneEndpoint securityDevices and endpointsHighLowLowT1003.001, T1546.003 +1nist-800-53-r5:CM-7, nist-800-53-r5:SI-3MaesterMT.1179Ensure App Control for Business is enabled.IntuneEndpoint securityDevices and endpointsHighHighHighT1204.002nist-800-53-r5:CM-7(5)MaesterMT.1181Conditional Access policy is present that blocks high agent risk sign-ins.Entra IDConditional AccessAI and agentsHighLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:AC-2(13)MaesterMT.1207Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1199nist-800-53-r5:AC-6, nist-800-53-r5:AC-20MaesterMT.1209Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1210Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview).-IncludePreviewEntra IDAgent identitiesPrivileged accessHighLowMediumT1078.004, T1098.003nist-800-53-r5:AC-6(5)MaesterMT.1211Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowMediumT1078.004nist-800-53-r5:AC-6MaesterMT.1213Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowLowT1557nist-800-53-r5:SC-23, nist-800-53-r5:SC-8MaesterMT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.IntuneDevice enrollmentPrivileged accessHighLowLowT1078.003, T1021 +1nist-800-53-r5:IA-5MaesterMT.1223Agent Identities should not have high-risk Microsoft Graph permissions (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsHighLowMediumT1078.004, T1098.001 +1nist-800-53-r5:AC-6MaesterMT.1259Baseline scope sign-ins should be subject to Conditional Access.New in 3.0-IncludePreviewEntra IDConditional AccessAccess controlHighMediumMediumT1078.004, T1087.004nist-800-53-r5:AC-3MaesterORCA.104High Confidence Phish action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566nist-800-53-r5:SI-8ORCAORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.DefenderAnti-spamEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.124Safe attachments unknown malware response set to block messages.DefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.189.2Safe Links is not bypassed.DefenderMail flowEmail and collaboration protectionHighLowMediumT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.239No exclusions for the built-in protection policies.DefenderSafe LinksEmail and collaboration protectionHighLowLowT1566.001, T1566.002nist-800-53-r5:SI-3ORCAORCA.242Important protection alerts responsible for AIR activities are enabled.DefenderTenant settingsLogging and detectionHighLowLowT1566nist-800-53-r5:SI-4(5)ORCAZTA.21771Inactive applications don’t have highly privileged built-in rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21772Applications don't have client secrets configuredZTAEntra IDApplicationsApplications and workload identitiesHighLowMediumT1552, T1078.004—Microsoft Zero Trust AssessmentZTA.21774Microsoft services applications don't have credentials configuredZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21776User consent settings are restrictedZTAEntra IDApp consent and permissionsApplications and workload identitiesHighHighMediumT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21777App instance property lock is configured for all multitenant applicationsZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1098.001—Microsoft Zero Trust AssessmentZTA.21781Privileged users sign in with phishing-resistant methodsZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21782Privileged accounts have phishing-resistant methods registeredZTAEntra IDAuthentication methodsPrivileged accessHighLowMediumT1566.002, T1557—Microsoft Zero Trust AssessmentZTA.21783Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methodsZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21786User sign-in activity uses token protectionZTAEntra IDConditional AccessAuthenticationHighLowLowT1550.001, T1550.004—Microsoft Zero Trust AssessmentZTA.21787Permissions to create new tenants are limited to the Tenant Creator roleZTAEntra IDUser and directory settingsAccess controlHighMediumMedium——Microsoft Zero Trust AssessmentZTA.21788Global Administrators don't have standing access to Azure subscriptionsZTAAzureAccess managementPrivileged accessHighLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21790Outbound cross-tenant access settings are configuredZTAEntra IDExternal identitiesExternal access and sharingHighMediumHighT1537, T1199—Microsoft Zero Trust AssessmentZTA.21793Tenant restrictions v2 policy is configuredZTAEntra IDExternal identitiesExternal access and sharingHighLowMediumT1567, T1537—Microsoft Zero Trust AssessmentZTA.21797Restrict access to high risk usersZTAEntra IDConditional AccessAuthenticationHighHighMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21798ID Protection notifications are enabledZTAEntra IDIdentity ProtectionLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21799Restrict high risk sign-insZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1078.004, T1110—Microsoft Zero Trust AssessmentZTA.21803Migrate from legacy MFA and SSPR policiesZTAEntra IDAuthentication methodsAuthenticationHighMediumMedium——Microsoft Zero Trust AssessmentZTA.21804SMS and Voice Call authentication methods are disabledZTAEntra IDAuthentication methodsAuthenticationHighMediumMediumT1566.002, T1621 +1—Microsoft Zero Trust AssessmentZTA.21806Secure the MFA registration (My Security Info) pageZTAEntra IDConditional AccessAuthenticationHighLowMediumT1556.006, T1078.004—Microsoft Zero Trust AssessmentZTA.21808Restrict device code flowZTAEntra IDConditional AccessAuthenticationHighMediumLowT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21809Admin consent workflow is enabledZTAEntra IDApp consent and permissionsApplications and workload identitiesHighLowLowT1528—Microsoft Zero Trust AssessmentZTA.21814Privileged accounts are cloud native identitiesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1556.007, T1078.002 +1—Microsoft Zero Trust AssessmentZTA.21815All privileged role assignments are activated just in time and not permanently activeZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowHighT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21817Global Administrator role activation triggers an approval workflowZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1078.004, T1548.005—Microsoft Zero Trust AssessmentZTA.21818Privileged role activations have monitoring and alerting configuredZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowMediumT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21828Secure the MFA registration (My Security Info) pageZTAEntra IDConditional AccessAuthenticationHighLowLowT1550.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21829Use cloud authenticationZTAEntra IDHybrid identityAuthenticationHighHighHighT1606.002, T1484.002—Microsoft Zero Trust AssessmentZTA.21830Conditional Access policies for Privileged Access Workstations are configuredZTAEntra IDConditional AccessPrivileged accessHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21836Workload Identities are not assigned privileged rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21847Password protection for on-premises is enabledZTAEntra IDPassword protectionAuthenticationHighLowMediumT1110.003—Microsoft Zero Trust AssessmentZTA.21860Diagnostic settings are configured for all Microsoft Entra logsZTAEntra IDLogs and monitoringLogging and detectionHighLowMediumT1685.002—Microsoft Zero Trust AssessmentZTA.21861All high-risk users are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21863All high-risk sign-ins are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21864All risk detections are triagedZTAEntra IDIdentity ProtectionLogging and detectionHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21872Require multifactor authentication for device join and device registration using user actionZTAEntra IDConditional AccessAuthenticationHighMediumLowT1098.005—Microsoft Zero Trust AssessmentZTA.21881Azure subscriptions used by Identity Governance are secured consistently with Identity Governance rolesZTAAzureAccess managementPrivileged accessHighLowMediumT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21885App registrations use safe redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21888App registrations must not have dangling or abandoned domain redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowLowT1528, T1584.001—Microsoft Zero Trust AssessmentZTA.21891Require password reset notifications for administrator rolesZTAEntra IDAuthentication methodsPrivileged accessHighLowLowT1098, T1078.004—Microsoft Zero Trust AssessmentZTA.21912Azure resources used by Microsoft Entra only allow access from privileged rolesZTAAzureAccess managementPrivileged accessHighLowLowT1078.004, T1685.002—Microsoft Zero Trust AssessmentZTA.21992Application certificates must be rotated on a regular basisZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1552.004, T1078.004—Microsoft Zero Trust AssessmentZTA.22124High priority Microsoft Entra recommendations are addressedZTAEntra IDEntra recommendationsInfrastructure hardeningHighMediumMedium——Microsoft Zero Trust AssessmentZTA.22128Guests are not assigned high privileged directory rolesZTAEntra IDRoles and administratorsPrivileged accessHighLowMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.22659All risky workload identity sign ins are triagedZTAEntra IDIdentity ProtectionApplications and workload identitiesHighLowHighT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.23183Service principals use safe redirect URIsZTAEntra IDApplicationsApplications and workload identitiesHighLowHighT1528, T1557—Microsoft Zero Trust AssessmentZTA.24540Windows Firewall policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1021, T1210 +1—Microsoft Zero Trust AssessmentZTA.24541A compliance policy for Windows devices existsZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24542macOS Compliance policy is created and assignedZTAIntuneDevice complianceDevices and endpointsHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24543Compliance policy assignment for iOS/iPadOS devicesZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsZTAIntuneDevice enrollmentDevices and endpointsHighLowLow——Microsoft Zero Trust AssessmentZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedZTAIntuneDevice complianceDevices and endpointsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.24548App Protection Policy assigned on iOS/iPad devicesZTAIntuneApp protectionData protectionHighLowLowT1567.002, T1115—Microsoft Zero Trust AssessmentZTA.24549An App protection policy for Android platform exists in IntuneZTAIntuneApp protectionData protectionHighMediumLowT1567.002, T1115—Microsoft Zero Trust AssessmentZTA.24550Windows - BitLocker Policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowHighT1005, T1006—Microsoft Zero Trust AssessmentZTA.24551Windows Hello for Business Policy is Configured and AssignedZTAIntuneDevice enrollmentAuthenticationHighMediumMediumT1110, T1078—Microsoft Zero Trust AssessmentZTA.24553Windows Update policy is assigned and enforced.ZTAIntuneDevice configurationDevices and endpointsHighMediumMediumT1203, T1068 +1—Microsoft Zero Trust AssessmentZTA.24554iOS - Update policy is configured and assignedZTAIntuneDevice configurationDevices and endpointsHighLowHighT1203, T1068—Microsoft Zero Trust AssessmentZTA.24555Intune Scope Tags are Configured for Delegated AdministrationZTAIntuneTenant administrationPrivileged accessHighLowHighT1072—Microsoft Zero Trust AssessmentZTA.24560Windows Cloud LAPS policy is created and assignedZTAIntuneEndpoint securityPrivileged accessHighLowLowT1078.003, T1021—Microsoft Zero Trust AssessmentZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSZTAIntuneDevice enrollmentPrivileged accessHighLowLowT1078.003, T1021 +1—Microsoft Zero Trust AssessmentZTA.24564Windows - Local Account Protection policy is configured and assignedZTAIntuneEndpoint securityPrivileged accessHighLowHighT1078.003, T1136.001—Microsoft Zero Trust AssessmentZTA.24568macOS - Platform SSO is configured and assignedZTAIntuneDevice configurationAuthenticationHighLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.24569Intune macOS FileVault policy is created and AssignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1005, T1006—Microsoft Zero Trust AssessmentZTA.24570Entra Connect Sync is configured with Service Principal CredentialsZTAEntra IDHybrid identityAuthenticationHighLowMediumT1078.004, T1110—Microsoft Zero Trust AssessmentZTA.24572Device enrollment notification is configured and assignedZTAIntuneDevice enrollmentDevices and endpointsHighLowHighT1098.005—Microsoft Zero Trust AssessmentZTA.24573Windows - A security baseline is configured and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowHighT1003, T1068—Microsoft Zero Trust AssessmentZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1027, T1106 +1—Microsoft Zero Trust AssessmentZTA.24575A Windows Defender Antivirus policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1685—Microsoft Zero Trust AssessmentZTA.24690macOS - Update policy is configured and assignedZTAIntuneDevice configurationDevices and endpointsHighLowHighT1203, T1068—Microsoft Zero Trust AssessmentZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSZTAIntuneEndpoint securityDevices and endpointsHighLowLowT1204.002, T1685—Microsoft Zero Trust AssessmentZTA.24794Intune Terms and Conditions Policy is configured and assignedZTAIntuneTenant administrationAccess controlHighLowHigh——Microsoft Zero Trust AssessmentZTA.24802Device Clean-up Rule is CreatedZTAIntuneTenant administrationDevices and endpointsHighLowHigh——Microsoft Zero Trust AssessmentZTA.24824Conditional Access policies block access from noncompliant devicesZTAEntra IDConditional AccessAccess controlHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24827Conditional Access policies block access from unmanaged appsZTAEntra IDConditional AccessAccess controlHighMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowMediumT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowLowT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessZTAIntuneDevice configurationDevices and endpointsHighLowLowT1557.004, T1040—Microsoft Zero Trust AssessmentZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsZTAIntuneTenant administrationDevices and endpointsHighLowLowT1566—Microsoft Zero Trust AssessmentZTA.25371Network validation is configured through Universal Continuous Access EvaluationZTAEntra IDGlobal Secure AccessAuthenticationHighLowLowT1550.001—Microsoft Zero Trust AssessmentZTA.25372Global Secure Access client is deployed on all managed endpointsZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25375The tenant holds the licenses required to operate Global Secure AccessZTAEntra IDGlobal Secure AccessInfrastructure hardeningHighLowLow——Microsoft Zero Trust AssessmentZTA.25376Microsoft 365 traffic is actively flowing through Global Secure AccessZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25377Universal tenant restrictions block unauthorized external tenant accessZTAEntra IDGlobal Secure AccessExternal access and sharingHighLowMediumT1567.002, T1078.004—Microsoft Zero Trust AssessmentZTA.25381Network traffic is routed through Global Secure Access for security policy enforcementZTAEntra IDGlobal Secure AccessAccess controlHighLowMedium——Microsoft Zero Trust AssessmentZTA.25382Traffic forwarding profiles are scoped to appropriate users and groups for controlled deploymentZTAEntra IDGlobal Secure AccessAccess controlHighLowLow——Microsoft Zero Trust AssessmentZTA.25383Administrative privileges are tightly limited to prevent compromiseZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.25384Application admin rights are constrained to specific Private Access appsZTAEntra IDRoles and administratorsPrivileged accessHighLowLowT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.25393Quick Access is enabled and bound to a connectorZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1078.004, T1133—Microsoft Zero Trust AssessmentZTA.25394Quick Access is bound to a Conditional Access policyZTAEntra IDGlobal Secure AccessAccess controlHighMediumLowT1078.004, T1133—Microsoft Zero Trust AssessmentZTA.25395Entra Private Access Application segments are defined to enforce least-privilege accessZTAEntra IDGlobal Secure AccessAccess controlHighMediumHighT1046, T1021—Microsoft Zero Trust AssessmentZTA.25396Conditional Access policies enforce strong authentication for private appsZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1110.003, T1110.004 +1—Microsoft Zero Trust AssessmentZTA.25398Domain controller RDP access is protected by phishing-resistant authentication through Global Secure AccessZTAEntra IDConditional AccessPrivileged accessHighLowMediumT1021.001, T1557 +1—Microsoft Zero Trust AssessmentZTA.25401Application Proxy applications require preauthentication to block anonymous accessZTAEntra IDApplicationsApplications and workload identitiesHighMediumMediumT1190—Microsoft Zero Trust AssessmentZTA.25403Private Access sensors are enforcing strong authentication policies on domain controllersZTAEntra IDGlobal Secure AccessAuthenticationHighMediumMediumT1558, T1078.002—Microsoft Zero Trust AssessmentZTA.25406Internet access forwarding profile is enabledZTAEntra IDGlobal Secure AccessAccess controlHighMediumLowT1071.001, T1567 +1—Microsoft Zero Trust AssessmentZTA.25407Web content filtering integrates with Conditional AccessZTAEntra IDGlobal Secure AccessAccess controlHighLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.25411TLS inspection is enabled and correctly configured for outbound trafficZTAEntra IDGlobal Secure AccessAccess controlHighMediumHighT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.25412Internet traffic is protected against threats using Global Secure Access threat intelligence filteringZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1204.001, T1566.002 +1—Microsoft Zero Trust AssessmentZTA.25413File transfer policies are configured to prevent data exfiltrationZTAEntra IDGlobal Secure AccessData protectionHighMediumHighT1567—Microsoft Zero Trust AssessmentZTA.25415AI Gateway protects enterprise generative AI applications from prompt injection attacksZTAEntra IDGlobal Secure AccessAI and agentsHighLowMedium——Microsoft Zero Trust AssessmentZTA.25416Global Secure Access cloud firewall protects branch office internet trafficZTAEntra IDGlobal Secure AccessAccess controlHighLowMediumT1071, T1041 +1—Microsoft Zero Trust AssessmentZTA.25420Network access logs are retained for security analysis and compliance requirementsZTAEntra IDLogs and monitoringLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.25466At least two Private Access connectors are active and healthy per connector groupZTAEntra IDGlobal Secure AccessInfrastructure hardeningHighMediumLow——Microsoft Zero Trust AssessmentZTA.25481All Private Access apps have user or group assignmentsZTAEntra IDGlobal Secure AccessAccess controlHighMediumLow——Microsoft Zero Trust AssessmentZTA.25533DDoS Protection is enabled for all Public IP Addresses in VNETsZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1498, T1499—Microsoft Zero Trust AssessmentZTA.25535Outbound traffic from VNET integrated workloads is routed through Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1071, T1041—Microsoft Zero Trust AssessmentZTA.25537Threat intelligence is Enabled in Deny Mode on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1071, T1041—Microsoft Zero Trust AssessmentZTA.25539IDPS Inspection is Enabled in Deny Mode on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190, T1210 +1—Microsoft Zero Trust AssessmentZTA.25541Application Gateway WAF is Enabled in Prevention modeZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.25543Azure Front Door WAF is Enabled in Prevention ModeZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.25550Inspection of Outbound TLS Traffic is Enabled on Azure FirewallZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.26879Request Body Inspection is enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26880Request Body Inspection is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26881Default Ruleset is enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26882Bot protection ruleset is enabled and assigned in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.26883Default rule set is assigned in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26884Bot protection rule set is enabled and assigned in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.26887Diagnostic logging is enabled in Azure FirewallZTAAzureNetwork securityLogging and detectionHighLowLowT1021, T1071—Microsoft Zero Trust AssessmentZTA.26888Diagnostic logging is enabled in Application Gateway WAFZTAAzureNetwork securityLogging and detectionHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.26889Diagnostic logging is enabled in Azure Front Door WAFZTAAzureNetwork securityLogging and detectionHighLowLowT1190—Microsoft Zero Trust AssessmentZTA.27000Web content filtering blocks high-risk categoriesZTAEntra IDGlobal Secure AccessAccess controlHighLowLowT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.27002TLS inspection certificates have a sufficient validity periodZTAEntra IDGlobal Secure AccessAccess controlHighHighLowT1573, T1071.001—Microsoft Zero Trust AssessmentZTA.27003TLS inspection failure rate is below 1%ZTAEntra IDGlobal Secure AccessAccess controlHighMediumMediumT1573—Microsoft Zero Trust AssessmentZTA.27015HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1499.002, T1499.003—Microsoft Zero Trust AssessmentZTA.27016Rate Limiting is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1110, T1499.003—Microsoft Zero Trust AssessmentZTA.27018Rate Limiting is Enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowMediumT1110, T1499.003—Microsoft Zero Trust AssessmentZTA.27024HTTP DDoS protection rule set is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningHighLowLowT1499.002, T1499.003—Microsoft Zero Trust AssessmentZTA.27028A web content filtering policy governs Copilot Studio agent traffic through the baseline profileZTAEntra IDGlobal Secure AccessAI and agentsHighMediumMediumT1567, T1071.001—Microsoft Zero Trust AssessmentZTA.35001Conditional Access policies don't exclude Rights Management workloadsZTAEntra IDConditional AccessAccess controlHighLowLow——Microsoft Zero Trust AssessmentZTA.35003Sensitivity labels are configuredZTAPurviewInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35005Sensitivity labels are enabled for SharePoint and OneDriveZTAPurviewInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35013Sensitivity labels with encryption are configuredZTAPurviewInformation protectionData protectionHighHighMediumT1213.002, T1530—Microsoft Zero Trust AssessmentZTA.35016Mandatory labeling is enabled in sensitivity label policiesZTAPurviewInformation protectionData protectionHighHighMedium——Microsoft Zero Trust AssessmentZTA.35019Auto-labeling policies are configured for all Microsoft 365 workloadsZTAPurviewInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35020Auto-labeling policies are in enforcement modeZTAPurviewInformation protectionData protectionHighLowLow——Microsoft Zero Trust AssessmentZTA.35021Auto-labeling policies are enabled for SharePoint and OneDriveZTAPurviewInformation protectionData protectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.35024Azure Rights Management service is activatedZTAPurviewInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35025Internal Rights Management licensing is enabledZTAPurviewInformation protectionData protectionHighHighLow——Microsoft Zero Trust AssessmentZTA.35030Data loss prevention policies are enabledZTAPurviewData loss preventionData protectionHighMediumMediumT1213, T1530 +1—Microsoft Zero Trust AssessmentZTA.35033Custom sensitive information types are configuredZTAPurviewData classificationData protectionHighMediumHigh——Microsoft Zero Trust AssessmentZTA.35034Exact Data Match is configured for sensitive information detectionZTAPurviewData classificationData protectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35035Named entity sensitive information types are used in auto-labeling and data loss prevention policiesZTAPurviewData classificationData protectionHighMediumLow——Microsoft Zero Trust AssessmentZTA.35038Insider Risk Management policies are enabled for risky AI usageZTAPurviewInsider risk managementLogging and detectionHighMediumMediumT1213—Microsoft Zero Trust AssessmentZTA.35039Communication compliance monitoring is configured for Microsoft CopilotZTAPurviewInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.35040Communication compliance monitoring is configured for enterprise AI toolsZTAPurviewInsider risk managementLogging and detectionHighMediumMedium——Microsoft Zero Trust AssessmentZTA.41002Microsoft Defender for Identity sensor is installed and healthy on every domain controllerZTADefenderDefender for IdentityLogging and detectionHighLowMediumT1558.003, T1550.002 +2—Microsoft Zero Trust AssessmentZTA.41003Microsoft Defender for Identity sensors are installed and healthy on AD FS, AD CS, and Microsoft Entra Connect serversZTADefenderDefender for IdentityLogging and detectionHighLowMediumT1606.002, T1649 +1—Microsoft Zero Trust AssessmentZTA.41004Privileged accounts in Active Directory have the "Account is sensitive and cannot be delegated" flag setZTAActive DirectoryUsersPrivileged accessHighLowLowT1558, T1550.003—Microsoft Zero Trust AssessmentZTA.41008Local administrator passwords on identity assets are protected and managed with Microsoft LAPSZTAActive DirectoryComputersPrivileged accessHighLowMediumT1078.003, T1550.002—Microsoft Zero Trust AssessmentZTA.41009Dormant accounts have been removed from sensitive Active Directory groupsZTAActive DirectoryGroupsPrivileged accessHighLowLowT1078.002—Microsoft Zero Trust AssessmentZTA.41011Non-administrative accounts do not have DC-Sync (Directory Replication) permissionsZTAActive DirectoryPermissions and delegationPrivileged accessHighLowLowT1003.006—Microsoft Zero Trust AssessmentZTA.41012Microsoft Entra Connect synchronization account does not hold unnecessary replication permissionsZTAActive DirectoryPermissions and delegationPrivileged accessHighLowMediumT1003.006—Microsoft Zero Trust AssessmentZTA.41018No open Microsoft Defender for Identity health issues are present in the tenantZTADefenderDefender for IdentityLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41019Compromised identities surfaced by Microsoft Defender for Identity have been remediatedZTADefenderDefender for IdentityLogging and detectionHighMediumLowT1078.002, T1550.002 +1—Microsoft Zero Trust AssessmentZTA.41029Anti-malware policies are configured according to recommended settingsZTADefenderAnti-malwareEmail and collaboration protectionHighLowLowT1566.001, T1204.002—Microsoft Zero Trust AssessmentZTA.41031Safe Attachments policies in Microsoft Defender for Office 365 are configured to detonate and blockZTADefenderSafe AttachmentsEmail and collaboration protectionHighLowLowT1566.001, T1204.002—Microsoft Zero Trust AssessmentZTA.41032Safe Links policies in Microsoft Defender for Office 365 are configured to scan and block malicious URLsZTADefenderSafe LinksEmail and collaboration protectionHighLowLowT1566.002, T1204.001—Microsoft Zero Trust AssessmentZTA.41033Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protectionZTADefenderAnti-phishingEmail and collaboration protectionHighLowLowT1566, T1684.001 +1—Microsoft Zero Trust AssessmentZTA.41039Zero-hour auto purge (ZAP) is enabled for malware, phishing, and spam in emailZTADefenderZero-hour auto purgeEmail and collaboration protectionHighLowLowT1566—Microsoft Zero Trust AssessmentZTA.41040Tenant Allow/Block List allow entries are reviewed for expiration, justification, and stalenessZTADefenderAnti-spamEmail and collaboration protectionHighLowLowT1566, T1684.002—Microsoft Zero Trust AssessmentZTA.41041Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderTenant settingsLogging and detectionHighLowMediumT1566—Microsoft Zero Trust AssessmentZTA.41045All eligible endpoints are onboarded to Microsoft Defender for EndpointZTADefenderEndpoint antivirusDevices and endpointsHighLowMediumT1685, T1003 +1—Microsoft Zero Trust AssessmentZTA.41050Attack surface reduction (ASR) rules are enabled in block modeZTAIntuneEndpoint securityDevices and endpointsHighMediumMediumT1204.002, T1059 +1—Microsoft Zero Trust AssessmentZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneZTAIntuneEndpoint securityDevices and endpointsHighMediumHighT1204.002—Microsoft Zero Trust AssessmentZTA.41053Network protection is enabled in block modeZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.001, T1189 +1—Microsoft Zero Trust AssessmentZTA.41054Controlled folder access is enabled in block modeZTADefenderEndpoint antivirusDevices and endpointsHighMediumLowT1486, T1485—Microsoft Zero Trust AssessmentZTA.41055Real-time, behavioral, and heuristic protection are enabled on Microsoft Defender AntivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002, T1059—Microsoft Zero Trust AssessmentZTA.41059EDR in block mode is enabled when Microsoft Defender Antivirus is not the primary antivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002—Microsoft Zero Trust AssessmentZTA.41060Cloud-delivered protection is enabled in Microsoft Defender AntivirusZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1204.002—Microsoft Zero Trust AssessmentZTA.41061All active Microsoft Defender XDR incidents are triaged and remediatedZTADefenderTenant settingsLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.41062Automated Investigation and Response (AIR) recommendations are reviewed and actionedZTADefenderTenant settingsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41080Conditional Access App Control session policies are enforced for sensitive cloud appsZTAEntra IDConditional AccessAccess controlHighMediumMediumT1550.004, T1530—Microsoft Zero Trust AssessmentZTA.41081At least one Microsoft Defender for Cloud Apps anomaly detection policy is generating alertsZTADefenderTenant settingsLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.41083Step-up authentication is required upon risky in-session actionZTAEntra IDConditional AccessAuthenticationHighMediumMediumT1557, T1550.004 +1—Microsoft Zero Trust AssessmentZTA.41114Microsoft Teams protection policies are configured to block malicious messages, links, and attachmentsZTADefenderSafe LinksEmail and collaboration protectionHighLowLowT1566, T1204.001 +1—Microsoft Zero Trust AssessmentZTA.41119Local modification of Microsoft Defender Antivirus policy is blockedZTADefenderEndpoint antivirusDevices and endpointsHighLowLowT1685, T1564.012—Microsoft Zero Trust AssessmentZTA.41121Every open Microsoft Defender XDR alert is triaged across all Defender services, with no high-severity alert left unassigned or unworked past its triage windowZTADefenderTenant settingsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41201At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.41207Active analytics rules are configured in Microsoft Sentinel to detect threatsZTAAzureMicrosoft SentinelLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.50001Microsoft Defender for Cloud RecommendationsZTAAzureSubscriptionsInfrastructure hardeningHighMediumMedium——Microsoft Zero Trust AssessmentZTA.51001Windows Endpoint Privilege Management is configured and assignedZTAIntuneEndpoint securityPrivileged accessHighMediumMediumT1078.003, T1548.002 +2—Microsoft Zero Trust AssessmentZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)ZTAIntuneApp protectionAccess controlHighLowLowT1078.004, T1550.001—Microsoft Zero Trust AssessmentZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesZTAIntuneApp protectionDevices and endpointsHighLowLowT1068, T1553.006—Microsoft Zero Trust AssessmentZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesZTAIntuneTenant administrationPrivileged accessHighLowMediumT1072, T1078.004—Microsoft Zero Trust AssessmentZTA.51016Privileged Identity Management is enforced for Intune Administrator role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessHighLowLowT1098.003, T1078.004—Microsoft Zero Trust AssessmentZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneZTAIntuneEndpoint securityDevices and endpointsHighMediumMediumT1204.002—Microsoft Zero Trust AssessmentZTA.61002Microsoft Sentinel is onboarded on at least one Log Analytics workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.61004Microsoft Defender for Cloud CSPM plan is enabled on all Azure subscriptionsZTAAzureSubscriptionsLogging and detectionHighLowMedium——Microsoft Zero Trust AssessmentZTA.61005Agents deployed to Microsoft 365 Copilot are discoverable in the Agent RegistryZTAMicrosoft 365Organization settingsAI and agentsHighLowLow——Microsoft Zero Trust AssessmentZTA.61006AI administrative roles have assigned principalsZTAEntra IDRoles and administratorsPrivileged accessHighLowLow——Microsoft Zero Trust AssessmentZTA.61009Conditional Access policies cover both agent identities and agent usersZTAEntra IDConditional AccessAI and agentsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61011Require users to use Microsoft Entra ID auth to interact with agentsZTAEntra IDAgent identitiesAI and agentsHighMediumMediumT1213—Microsoft Zero Trust AssessmentZTA.61012Risk-based Conditional Access blocks risky agent identitiesZTAEntra IDConditional AccessAI and agentsHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61014Agent identities and blueprint principals have assigned technical owners and no disabled agents remain in the directoryZTAEntra IDAgent identitiesAI and agentsHighMediumMedium——Microsoft Zero Trust AssessmentZTA.61016Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.61017Microsoft Defender for AI Services alerts are flowing to the Microsoft Sentinel workspace via a single connector pathZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61021Microsoft 365 Copilot data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61022Microsoft Defender for AI Services is enabled on every Azure subscription that hosts Azure OpenAI or Azure AI Services accountsZTAAzureSubscriptionsLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61023Agent 365 data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentZTA.61024Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionHighLowLow——Microsoft Zero Trust AssessmentAD-DCOMP-06No enabled computers should be stale beyond the configured thresholdActive DirectoryComputersIdentity lifecycle and hygieneMediumLowMediumT1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-GPOL-05GPO blocked inheritance count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-01No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-02No GPOs should be missing permissionsActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-03GPOs without authenticated users count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-04GPOs without authenticated users details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-05GPOs without enterprise domain controllers count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-07GPOs with deny ACE count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-08GPOs with deny ACE details should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-09GPO inherited permissions count should be retrievableActive DirectoryGroup PolicyAccess controlMediumLowMedium——Active DirectoryAD-GPOREP-15No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-GPOREP-16No GPOs should have version mismatchesActive DirectoryGroup PolicyInfrastructure hardeningMediumLowMedium——Active DirectoryAD-KRBTGT-01KRBTGT password age should not exceed the configured maximumActive DirectoryAccount securityAuthenticationMediumLowLowT1558.001nist-800-53-r5:IA-5Active DirectoryAD-KRBTGT-03KRBTGT should have standard UAC settings (disabled account)Active DirectoryAccount securityAuthenticationMediumLowLowT1098nist-800-53-r5:CM-6Active DirectoryAD-PWDPOL-04Password complexity should be enabledActive DirectoryPassword policyAuthenticationMediumMediumLowT1110—Active DirectoryAD-PWDPOL-05Password reversible encryption should be disabledActive DirectoryPassword policyAuthenticationMediumMediumMediumT1556.005—Active DirectoryAD-SCH-05LAPS should be installed in Active DirectoryActive DirectorySchemaPrivileged accessMediumLowMediumT1078.003, T1550.002nist-800-53-r5:IA-5, nist-800-53-r5:AC-6(2)Active DirectoryASD.ISM-1403User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003ism:ISM-1403, nist-800-53-r5:AC-7ASD Essential EightASD.ISM-1488Microsoft Office macros in files originating from the internet are blocked.New in 3.0IntuneDevice configurationDevices and endpointsMediumMediumLowT1204.002, T1566.001essential-eight:ISM-1488, nist-800-53-r5:CM-7 +1ASD Essential EightASD.ISM-1648Privileged access to systems and their resources is disabled after 45 days of inactivity.New in 3.0Entra IDRoles and administratorsPrivileged accessMediumLowMediumT1078.004essential-eight:ISM-1648, nist-800-53-r5:AC-2(3) +1ASD Essential EightASD.ISM-1672Microsoft Office macro antivirus scanning is enabled.New in 3.0IntuneDevice configurationDevices and endpointsMediumLowLowT1204.002essential-eight:ISM-1672, nist-800-53-r5:SI-3 +1ASD Essential EightAZDO.1006External Users access.New in 3.0Azure DevOpsUsers and accessExternal access and sharingMediumMediumLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-21MaesterAZDO.1007Team and project administrator are allowed to invite new users.New in 3.0Azure DevOpsUsers and accessAccess controlMediumLowLowT1136.003—MaesterAZDO.1014Anonymous access to pipeline badges.New in 3.0Azure DevOpsPipelinesExternal access and sharingMediumLowLowT1593.003—MaesterAZDO.1019Stage chooser.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1020Creation of classic build pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1021Creation of classic release pipelines.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumMediumLow——MaesterAZDO.1024Disable Node 6 tasks.New in 3.0Azure DevOpsPipelinesEngineering systemsMediumLowLow—nist-800-53-r5:SI-2MaesterAZDO.1026Enable automatic enrollment to Advanced Security for Azure DevOps.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1552.001, T1195.001 +1nist-800-53-r5:SA-11, nist-800-53-r5:IA-5(7)MaesterAZDO.1028Disable creation of TFVC repositories.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowLow——MaesterAZDO.1034(Tenant) Restrict creation of new Azure DevOps organizations.New in 3.0Azure DevOpsOrganization policiesAccess controlMediumLowLow——MaesterAZDO.1038(Organization) Disallow extensions from accessing resources on the local network.New in 3.0Azure DevOpsSecurity policiesApplications and workload identitiesMediumLowLowT1190—MaesterAZDO.1039(Organization) Secret Protection: new repositories enrolled automatically.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1552.001nist-800-53-r5:IA-5(7)MaesterAZDO.1042(Organization) Code Security: new repositories enrolled automatically.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11MaesterAZDO.1043(Organization) Code Security: existing repositories enrolled.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowMediumT1195.001, T1190nist-800-53-r5:SA-11MaesterAZDO.1044(Organization) Code Security: dependency and CodeQL alerts enabled.New in 3.0Azure DevOpsRepositoriesEngineering systemsMediumLowLowT1195.001, T1190nist-800-53-r5:SA-11, nist-800-53-r5:SI-2MaesterCIS.GH.1.2.2Ensure repository creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLowT1567.001cis-github:1.2.2, nist-800-53-r5:AC-6CISCIS.GH.1.2.4Ensure issue deletion is limited to specific usersGitHubOrganization settingsAccess controlMediumLowLowT1070, T1485cis-github:1.2.4, nist-800-53-r5:AC-6CISCIS.GH.1.3.2Ensure team creation is limited to specific membersGitHubOrganization settingsAccess controlMediumMediumLow—cis-github:1.3.2, nist-800-53-r5:AC-6CISCIS.M365.1.1.4Ensure administrative accounts use licenses with a reduced application footprintNew in 3.0Microsoft 365Administrative accountsPrivileged accessMediumLowMediumT1566cis-m365:1.1.4, nist-800-53-r5:AC-6(5)CISCIS.M365.1.2.1Ensure that only organizationally managed/approved public groups existMicrosoft 365Teams and groupsAccess controlMediumLowMediumT1213.002cis-m365:1.2.1, nist-800-53-r5:AC-3CISCIS.M365.1.2.2Ensure sign-in to shared mailboxes is blockedMicrosoft 365Teams and groupsAccess controlMediumLowLowT1078.004cis-m365:1.2.2, nist-800-53-r5:AC-2CISCIS.M365.1.3.1Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'Microsoft 365Organization settingsAuthenticationMediumLowLow—cis-m365:1.3.1, nist-800-53-r5:IA-5(1)CISCIS.M365.1.3.2Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesNew in 3.0Microsoft 365Organization settingsAuthenticationMediumMediumMediumT1550.004cis-m365:1.3.2, nist-800-53-r5:AC-12CISCIS.M365.1.3.3Ensure 'External sharing' of calendars is not availableMicrosoft 365Organization settingsExternal access and sharingMediumLowLowT1591cis-m365:1.3.3, nist-800-53-r5:AC-3 +1CISCIS.M365.1.3.4Ensure 'User owned apps and services' is restrictedMicrosoft 365Organization settingsApplications and workload identitiesMediumMediumLowT1137.006cis-m365:1.3.4, nist-800-53-r5:CM-7 +1CISCIS.M365.1.3.5Ensure internal phishing protection for Forms is enabledMicrosoft 365Organization settingsEmail and collaboration protectionMediumLowLowT1534, T1598cis-m365:1.3.5, nist-800-53-r5:SI-8CISCIS.M365.1.3.6Ensure the customer lockbox feature is enabledMicrosoft 365Organization settingsAccess controlMediumLowLowT1199cis-m365:1.3.6CISCIS.M365.1.3.7Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'Microsoft 365Organization settingsExternal access and sharingMediumLowLowT1567.002cis-m365:1.3.7, nist-800-53-r5:AC-20 +1CISCIS.M365.2.1.1Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cis-m365:2.1.1, nist-800-53-r5:SI-3CISCIS.M365.2.1.2Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)DefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cis-m365:2.1.2, nist-800-53-r5:SI-3CISCIS.M365.2.1.3Ensure notifications for internal users sending malware is EnabledDefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.3, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.5Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is EnabledDefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:2.1.5, nist-800-53-r5:SI-3CISCIS.M365.2.1.6Ensure Exchange Online Spam Policies are set to notify administratorsDefenderAnti-spamEmail and collaboration protectionMediumLowLowT1078.004cis-m365:2.1.6, nist-800-53-r5:SI-4(5)CISCIS.M365.2.1.7Ensure that an anti-phishing policy has been createdDefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001 +1cis-m365:2.1.7, nist-800-53-r5:SI-8CISCIS.M365.2.1.8Ensure that SPF records are published for all Exchange DomainsNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.8, nist-800-53-r5:SI-8CISCIS.M365.2.1.9Ensure that DKIM is enabled for all Exchange Online DomainsDefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.9, nist-800-53-r5:SC-8CISCIS.M365.2.1.10Ensure DMARC records for all Exchange Online domains are publishedNew in 3.0DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.10, nist-800-53-r5:SI-8CISCIS.M365.2.1.11Ensure comprehensive attachment filtering is appliedDefenderAnti-malwareEmail and collaboration protectionMediumMediumMediumT1566.001, T1204.002cis-m365:2.1.11, nist-800-53-r5:SI-3CISCIS.M365.2.1.12Ensure the connection filter IP allow list is not used (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cis-m365:2.1.12, nist-800-53-r5:AC-4CISCIS.M365.2.1.13Ensure the connection filter safe list is off (Only Checks Default Policy)DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:2.1.13, nist-800-53-r5:AC-4CISCIS.M365.2.1.15Ensure outbound anti-spam message limits are in place (Default policy only)New in 3.0DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1534cis-m365:2.1.15, nist-800-53-r5:AC-4CISCIS.M365.2.4.1Ensure Priority account protection is enabled and configuredNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowMediumT1566cis-m365:2.4.1, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.2Ensure Priority accounts have 'Strict protection' presets appliedNew in 3.0DefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.2, nist-800-53-r5:SI-4(5)CISCIS.M365.2.4.4Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566cis-m365:2.4.4, nist-800-53-r5:SI-3CISCIS.M365.3.2.1Ensure DLP policies are enabledNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.1, nist-800-53-r5:AC-4CISCIS.M365.3.2.2Ensure DLP policies are enabled for Microsoft TeamsNew in 3.0PurviewData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cis-m365:3.2.2, nist-800-53-r5:AC-4CISCIS.M365.3.2.3Ensure DLP policies are published for Copilot usersNew in 3.0PurviewData loss preventionData protectionMediumLowMediumT1213.002, T1530cis-m365:3.2.3, nist-800-53-r5:AC-4CISCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'IntuneDevice complianceDevices and endpointsMediumMediumMediumT1078.004cis-m365:4.1, nist-800-53-r5:AC-19 +1CISCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0IntuneDevice enrollmentDevices and endpointsMediumMediumLowT1098.005cis-m365:4.2, nist-800-53-r5:AC-19CISCIS.M365.5.1.2.2Ensure users cannot register applicationsEntra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528cis-m365:5.1.2.2, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.2.3Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'Entra IDUser and directory settingsAccess controlMediumLowLow—cis-m365:5.1.2.3, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.4.1Ensure the ability to join devices to Entra is restrictedNew in 3.0Entra IDDevice identityDevices and endpointsMediumLowLowT1098.005cis-m365:5.1.4.1, nist-800-53-r5:IA-3CISCIS.M365.5.1.4.3Ensure the GA role is not added as a local administrator during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.004cis-m365:5.1.4.3, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.4Ensure local administrator assignment is limited during Entra joinNew in 3.0Entra IDDevice identityPrivileged accessMediumMediumLowT1685, T1003cis-m365:5.1.4.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.5Ensure Local Administrator Password Solution is enabledNew in 3.0Entra IDDevice identityPrivileged accessMediumLowLowT1078.003cis-m365:5.1.4.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.4.6Ensure users are restricted from recovering BitLocker keysEntra IDDevice identityAccess controlMediumLowLowT1552cis-m365:5.1.4.6, nist-800-53-r5:AC-6(10) +1CISCIS.M365.5.1.5.3Ensure password addition is blocked for applicationsNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.3, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.4Ensure password lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.4, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.5Ensure new application passwords are system-generatedNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1110.001, T1110.003cis-m365:5.1.5.5, nist-800-53-r5:IA-5CISCIS.M365.5.1.5.6Ensure maximum certificate lifetime for applications does not exceed 180 daysNew in 3.0Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001cis-m365:5.1.5.6, nist-800-53-r5:IA-5CISCIS.M365.5.1.6.1Ensure that collaboration invitations are sent to allowed domains onlyNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1136.003cis-m365:5.1.6.1, nist-800-53-r5:AC-20CISCIS.M365.5.1.6.2Ensure that guest user access is restrictedEntra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003cis-m365:5.1.6.2, nist-800-53-r5:AC-6CISCIS.M365.5.1.6.3Ensure guest user invitations are limitedNew in 3.0Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003cis-m365:5.1.6.3, nist-800-53-r5:AC-2CISCIS.M365.5.1.8.1Ensure that password hash sync is enabled for hybrid deploymentsNew in 3.0Entra IDHybrid identityAuthenticationMediumLowLowT1078.004cis-m365:5.1.8.1, nist-800-53-r5:IA-5CISCIS.M365.5.2.2.4Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative usersNew in 3.0Entra IDConditional AccessPrivileged accessMediumLowMediumT1550.004cis-m365:5.2.2.4, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.6Enable Identity Protection user risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.6, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.7Enable Identity Protection sign-in risk policiesNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004cis-m365:5.2.2.7, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.8Ensure 'sign-in risk' is blocked for medium and high riskNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.8, nist-800-53-r5:AC-2(12)CISCIS.M365.5.2.2.9Ensure a managed device is required for authenticationNew in 3.0Entra IDConditional AccessAccess controlMediumHighHighT1078.004cis-m365:5.2.2.9, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.10Ensure a managed device is required to register security informationNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cis-m365:5.2.2.10, nist-800-53-r5:IA-3CISCIS.M365.5.2.2.11Ensure sign-in frequency for Intune Enrollment is set to 'Every time'New in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1098.005cis-m365:5.2.2.11, nist-800-53-r5:IA-11CISCIS.M365.5.2.2.13Ensure that periodic reauthentication is required for all usersNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.13, nist-800-53-r5:AC-12CISCIS.M365.5.2.2.15Ensure exclusionary geographic access controls are utilizedNew in 3.0Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004cis-m365:5.2.2.15, nist-800-53-r5:AC-3CISCIS.M365.5.2.2.16Ensure Token Protection is enforced for session tokensNew in 3.0Entra IDConditional AccessAuthenticationMediumMediumMediumT1550.004cis-m365:5.2.2.16, nist-800-53-r5:SC-23CISCIS.M365.5.2.2.17Ensure authentication transfer is blockedNew in 3.0Entra IDConditional AccessAuthenticationMediumLowMediumT1078.004cis-m365:5.2.2.17, nist-800-53-r5:CM-7CISCIS.M365.5.2.3.1Ensure Microsoft Authenticator is configured to protect against MFA fatigueNew in 3.0Entra IDAuthentication methodsAuthenticationMediumLowLowT1621cis-m365:5.2.3.1, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.2Ensure custom banned passwords lists are usedNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.003cis-m365:5.2.3.2, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.3Ensure password protection is enabled for on-prem Active DirectoryNew in 3.0Entra IDPassword protectionAuthenticationMediumLowMediumT1110.003cis-m365:5.2.3.3, nist-800-53-r5:IA-5(1)CISCIS.M365.5.2.3.7Ensure the email OTP authentication method is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationMediumMediumLowT1078.004, T1111cis-m365:5.2.3.7, nist-800-53-r5:CM-7 +1CISCIS.M365.5.2.3.8Ensure that Account 'Lockout threshold' is '10' or lessNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003cis-m365:5.2.3.8, nist-800-53-r5:AC-7CISCIS.M365.5.2.3.9Ensure that Account 'Lockout duration in seconds' is at least 60 secondsNew in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001cis-m365:5.2.3.9, nist-800-53-r5:AC-7CISCIS.M365.5.3.2Ensure 'Access reviews' for guest users are configuredNew in 3.0Entra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004cis-m365:5.3.2, nist-800-53-r5:AC-2CISCIS.M365.5.3.3Ensure 'Access reviews' for privileged roles are configuredNew in 3.0Entra IDIdentity GovernancePrivileged accessMediumLowMediumT1078.004cis-m365:5.3.3, nist-800-53-r5:AC-6(7)CISCIS.M365.5.3.4Ensure approval is required for Global Administrator role activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1548.005cis-m365:5.3.4, nist-800-53-r5:AC-5CISCIS.M365.5.3.5Ensure approval is required for Privileged Role Administrator activationNew in 3.0Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1078.004, T1098.003cis-m365:5.3.5, nist-800-53-r5:AC-5CISCIS.M365.6.1.2Ensure mailbox audit actions are configuredNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.2, nist-800-53-r5:AU-12CISCIS.M365.6.1.3Ensure 'AuditBypassEnabled' is not enabled on mailboxesNew in 3.0Exchange OnlineMailbox auditingLogging and detectionMediumLowLowT1685.002cis-m365:6.1.3, nist-800-53-r5:AU-12CISCIS.M365.6.2.2Ensure mail transport rules do not whitelist specific domainsNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566, T1684.002cis-m365:6.2.2, nist-800-53-r5:SI-8CISCIS.M365.6.2.3Ensure email from external senders is identifiedNew in 3.0Exchange OnlineOutlookEmail and collaboration protectionMediumLowLowT1566cis-m365:6.2.3, nist-800-53-r5:SI-8CISCIS.M365.6.3.1Ensure users installing Outlook add-ins is not allowedNew in 3.0Exchange OnlineOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002cis-m365:6.3.1, nist-800-53-r5:CM-7CISCIS.M365.6.5.3Ensure additional storage providers are restricted in Outlook on the webExchange OnlineOutlookExternal access and sharingMediumLowLowT1567.002, T1204.002cis-m365:6.5.3, nist-800-53-r5:AC-20 +1CISCIS.M365.6.5.5Ensure Direct Send submissions are rejectedNew in 3.0Exchange OnlineMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002cis-m365:6.5.5, nist-800-53-r5:SI-8CISCIS.M365.7.2.1Ensure modern authentication for SharePoint applications is requiredNew in 3.0SharePointAccess controlAuthenticationMediumMediumLowT1110cis-m365:7.2.1, nist-800-53-r5:IA-2CISCIS.M365.7.2.2Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledSharePointExternal sharingExternal access and sharingMediumLowLowT1078.004, T1213.002cis-m365:7.2.2CISCIS.M365.7.2.3Ensure external content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.3, nist-800-53-r5:AC-21CISCIS.M365.7.2.4Ensure OneDrive content sharing is restrictedNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.4, nist-800-53-r5:AC-21CISCIS.M365.7.2.5Ensure that SharePoint guest users cannot share items they don't ownSharePointExternal sharingExternal access and sharingMediumLowLowT1213.002, T1530cis-m365:7.2.5, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.6Ensure SharePoint external sharing is managed through domain whitelist/blacklistsNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530 +1cis-m365:7.2.6, nist-800-53-r5:AC-21CISCIS.M365.7.2.7Ensure link sharing is restricted in SharePoint and OneDriveSharePointSharing linksAccess controlMediumLowLowT1213.002cis-m365:7.2.7, nist-800-53-r5:AC-3 +1CISCIS.M365.7.2.8Ensure external sharing is restricted by security groupNew in 3.0SharePointExternal sharingExternal access and sharingMediumMediumMediumT1213.002, T1530cis-m365:7.2.8, nist-800-53-r5:AC-21CISCIS.M365.7.2.9Ensure guest access to a site or OneDrive will expire automaticallySharePointExternal sharingExternal access and sharingMediumMediumLowT1213.002, T1530cis-m365:7.2.9, nist-800-53-r5:AC-2(2)CISCIS.M365.7.2.10Ensure reauthentication with verification code is restrictedNew in 3.0SharePointExternal sharingAuthenticationMediumLowLowT1078.004cis-m365:7.2.10, nist-800-53-r5:IA-5CISCIS.M365.7.2.11Ensure the SharePoint default sharing link permission is setSharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cis-m365:7.2.11, nist-800-53-r5:AC-6CISCIS.M365.7.3.1Ensure Office 365 SharePoint infected files are disallowed for downloadSharePointAccess controlEmail and collaboration protectionMediumLowLowT1080, T1204.002cis-m365:7.3.1, nist-800-53-r5:SI-3CISCIS.M365.8.1.1Ensure external file sharing in Teams is enabled for only approved cloud storage servicesTeamsFile sharingExternal access and sharingMediumLowLowT1567.002cis-m365:8.1.1, nist-800-53-r5:AC-20 +1CISCIS.M365.8.1.2Ensure users can't send emails to a channel email addressNew in 3.0TeamsMessagingExternal access and sharingMediumMediumLowT1566cis-m365:8.1.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.1Ensure external domains are restricted in the Teams admin centerNew in 3.0TeamsExternal accessExternal access and sharingMediumMediumLowT1566cis-m365:8.2.1, nist-800-53-r5:AC-20CISCIS.M365.8.2.2Ensure communication with unmanaged Teams users is disabledTeamsExternal accessExternal access and sharingMediumMediumLowT1566, T1204.001 +1cis-m365:8.2.2, nist-800-53-r5:AC-20CISCIS.M365.8.2.3Ensure external Teams users cannot initiate conversationsTeamsExternal accessExternal access and sharingMediumLowLowT1566, T1204.001 +1cis-m365:8.2.3, nist-800-53-r5:AC-20CISCIS.M365.8.2.4Ensure the organization cannot communicate with accounts in trial Teams tenantsNew in 3.0TeamsExternal accessExternal access and sharingMediumLowLowT1566cis-m365:8.2.4, nist-800-53-r5:AC-20CISCIS.M365.8.4.1Ensure app permission policies are configuredTeamsAppsApplications and workload identitiesMediumMediumMediumT1195, T1671cis-m365:8.4.1, nist-800-53-r5:CM-7CISCIS.M365.8.5.1Ensure anonymous users can't join a meetingNew in 3.0TeamsMeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.1, nist-800-53-r5:AC-3CISCIS.M365.8.5.2Ensure anonymous users and dial-in callers can't start a meetingNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.2, nist-800-53-r5:AC-3CISCIS.M365.8.5.3Ensure only people in my org can bypass the lobbyTeamsMeetingsExternal access and sharingMediumMediumLow—cis-m365:8.5.3, nist-800-53-r5:AC-3CISCIS.M365.8.5.4Ensure users dialing in can't bypass the lobbyNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLow—cis-m365:8.5.4, nist-800-53-r5:AC-3CISCIS.M365.8.5.5Ensure meeting chat does not allow anonymous usersNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1566cis-m365:8.5.5, nist-800-53-r5:AC-3CISCIS.M365.8.5.7Ensure external participants can't give or request controlNew in 3.0TeamsMeetingsExternal access and sharingMediumLowLowT1219cis-m365:8.5.7, nist-800-53-r5:AC-3CISCIS.M365.8.5.8Ensure external meeting chat is offNew in 3.0TeamsMeetingsExternal access and sharingMediumMediumLowT1566cis-m365:8.5.8, nist-800-53-r5:AC-3CISCIS.M365.8.6.1Ensure users can report security concerns in TeamsTeamsMessagingEmail and collaboration protectionMediumLowLowT1566cis-m365:8.6.1CISCIS.M365.9.1.1Restrict guest access to FabricNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1078.004cis-m365:9.1.1, nist-800-53-r5:AC-3CISCIS.M365.9.1.2Restrict external guest invitations through FabricNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1136.003cis-m365:9.1.2, nist-800-53-r5:AC-2CISCIS.M365.9.1.4Restrict public publishing of Fabric reportsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.4, nist-800-53-r5:AC-22CISCIS.M365.9.1.5Disable R and Python visuals in FabricNew in 3.0Microsoft FabricTenant settingsInfrastructure hardeningMediumMediumMediumT1059cis-m365:9.1.5, nist-800-53-r5:CM-7CISCIS.M365.9.1.6Enable sensitivity labels for Fabric contentNew in 3.0Microsoft FabricInformation protectionData protectionMediumLowMedium—cis-m365:9.1.6, nist-800-53-r5:AC-16CISCIS.M365.9.1.8Restrict external sharing of semantic modelsNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingMediumMediumLowT1567cis-m365:9.1.8, nist-800-53-r5:AC-21CISCIS.M365.9.1.9Block resource-key authentication for Fabric datasetsNew in 3.0Microsoft FabricDeveloper settingsAuthenticationMediumMediumMedium—cis-m365:9.1.9, nist-800-53-r5:IA-5CISCIS.M365.9.1.10Restrict service principal access to Fabric public APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.10, nist-800-53-r5:AC-3CISCIS.M365.9.1.11Restrict service principal profiles in FabricNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.11, nist-800-53-r5:AC-3CISCIS.M365.9.1.12Restrict service principal access to Fabric global APIsNew in 3.0Microsoft FabricDeveloper settingsApplications and workload identitiesMediumLowLowT1078.004cis-m365:9.1.12, nist-800-53-r5:AC-3CISCISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.Entra IDIdentity ProtectionLogging and detectionMediumLowLowT1078.004cisa-scuba:MS.AAD.2.2, nist-800-53-r5:AC-2(12)CISA SCuBACISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1110, T1621cisa-scuba:MS.AAD.3.3, nist-800-53-r5:IA-2(1) +5CISA SCuBACISA.MS.AAD.3.7Managed devices SHOULD be required for authentication.Entra IDConditional AccessAccess controlMediumHighHighT1078.004cisa-scuba:MS.AAD.3.7, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.3.8Managed Devices SHOULD be required to register MFA.Entra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1098.005cisa-scuba:MS.AAD.3.8, nist-800-53-r5:AC-20b +1CISA SCuBACISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1098.003 +1cisa-scuba:MS.AAD.5.1, nist-800-53-r5:AC-6(10) +1CISA SCuBACISA.MS.AAD.6.1User passwords SHALL NOT expire.Entra IDPassword protectionAuthenticationMediumLowLow—cisa-scuba:MS.AAD.6.1, nist-800-53-r5:IA-5(1)CISA SCuBACISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.6, nist-800-53-r5:AC-6(1)CISA SCuBACISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003cisa-scuba:MS.AAD.7.7, nist-800-53-r5:AC-2(1)CISA SCuBACISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005cisa-scuba:MS.AAD.7.8, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.Entra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1136.003 +1cisa-scuba:MS.AAD.7.9, nist-800-53-r5:AC-6(9)CISA SCuBACISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.003, T1087.004 +2cisa-scuba:MS.AAD.8.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.AAD.8.2Only users with the Guest Inviter role SHOULD be able to invite guest users.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1098.003, T1136.003cisa-scuba:MS.AAD.8.2, nist-800-53-r5:AC-6(10)CISA SCuBACISA.MS.AAD.8.3Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.Entra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004cisa-scuba:MS.AAD.8.3, nist-800-53-r5:AC-3CISA SCuBACISA.MS.EXO.2.2An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.2.2, nist-800-53-r5:AC-2dCISA SCuBACISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1598 +1cisa-scuba:MS.EXO.3.1, nist-800-53-r5:SC-8CISA SCuBACISA.MS.EXO.4.1A DMARC policy SHALL be published for every second-level domain.Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1566, T1598 +1cisa-scuba:MS.EXO.4.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.4.3The DMARC point of contact for aggregate reports SHALL include [email protected].Exchange OnlineEmail authenticationEmail and collaboration protectionMediumLowLowT1684.002cisa-scuba:MS.EXO.4.3, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.Exchange OnlineCalendar and contact sharingExternal access and sharingMediumLowLowT1048, T1567 +1cisa-scuba:MS.EXO.6.2, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.EXO.7.1External sender warnings SHALL be implemented.Exchange OnlineMail flowEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.2, nist-800-53-r5:SC-7(10)CISA SCuBACISA.MS.EXO.8.3The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft.Exchange OnlineData loss preventionData protectionMediumMediumMediumT1213, T1530 +1cisa-scuba:MS.EXO.8.3CISA SCuBACISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002cisa-scuba:MS.EXO.9.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.9.2The attachment filter SHOULD attempt to determine the true file type and assess the file extension.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1036.008, T1204.002 +1cisa-scuba:MS.EXO.9.2CISA SCuBACISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.Exchange OnlineAnti-malwareEmail and collaboration protectionMediumLowLowT1204.002, T1566.001cisa-scuba:MS.EXO.9.4CISA SCuBACISA.MS.EXO.11.2User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001cisa-scuba:MS.EXO.11.2, nist-800-53-r5:AT-2b +1CISA SCuBACISA.MS.EXO.11.3The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.Exchange OnlineAnti-phishingEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.11.3CISA SCuBACISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.12.1, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566, T1684.002cisa-scuba:MS.EXO.12.2, nist-800-53-r5:AC-4CISA SCuBACISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.2, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002cisa-scuba:MS.EXO.14.3, nist-800-53-r5:SI-8CISA SCuBACISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.Exchange OnlineAnti-spamEmail and collaboration protectionMediumLowLowT1566cisa-scuba:MS.EXO.14.4CISA SCuBACISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.1, nist-800-53-r5:SI-3CISA SCuBACISA.MS.EXO.15.3User click tracking SHOULD be enabled.Exchange OnlineSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001cisa-scuba:MS.EXO.15.3, nist-800-53-r5:SI-3 +1CISA SCuBACISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.Exchange OnlineAlert policiesLogging and detectionMediumLowMedium—cisa-scuba:MS.EXO.16.2, nist-800-53-r5:SI-4(5)CISA SCuBACISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).Exchange OnlineAudit loggingLogging and detectionMediumLowLowT1070cisa-scuba:MS.EXO.17.3, nist-800-53-r5:AU-11CISA SCuBACISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.SharePointExternal sharingExternal access and sharingMediumHighMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2 +2CISA SCuBACISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.SharePointExternal sharingExternal access and sharingMediumMediumMediumT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.SharePointSharing linksAccess controlMediumLowLowT1048, T1213.002cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.SharePointSharing linksAccess controlMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.SharePointSharing linksExternal access and sharingMediumLowLowT1048, T1213.002 +1cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3 +1CISA SCuBACISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.SharePointSharing linksExternal access and sharingMediumLowLowT1080, T1565.001cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6CISA SCuBACISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.SharePointExternal sharingAuthenticationMediumLowLowT1213.002, T1530cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11CISA SCuBADISA.V-267303Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-intune-desktop:V-267303, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-267309Microsoft Intune service must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumLowMediumT1078.004disa-stig-intune-desktop:V-267309, nist-800-53-r5:AC-2(3)DISA STIGsDISA.V-267314Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003disa-stig-intune-desktop:V-267314, nist-800-53-r5:AC-7DISA STIGsDISA.V-270200Microsoft Entra ID must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-entra-id:V-270200, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-270204Microsoft Entra ID must automatically disable accounts after a 35-day period of account inactivity.New in 3.0-IncludePreviewEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumLowMediumT1078.004disa-stig-entra-id:V-270204, nist-800-53-r5:AC-2(3)DISA STIGsDISA.V-270208Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003disa-stig-entra-id:V-270208, nist-800-53-r5:AC-7DISA STIGsDISA.V-270255Microsoft Entra ID must notify system administrators (SAs) and the information system security officer (ISSO) when privileges are being requested.New in 3.0-IncludePreviewEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005disa-stig-entra-id:V-270255, nist-800-53-r5:AC-2(1)DISA STIGsDISA.V-270475Microsoft Entra ID must, for password-based authentication, verify when users create or update passwords that the passwords are not found on the list of commonly used, expected, or compromised passwords.New in 3.0Entra IDPassword protectionAuthenticationMediumLowLowT1110.003disa-stig-entra-id:V-270475, nist-800-53-r5:IA-5(1)DISA STIGsDISA.V-273867Microsoft Intune service must initiate a session lock after a 15-minute period of inactivity.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationMediumMediumLowT1550.004disa-stig-intune-mdm:V-273867, nist-800-53-r5:AC-11 +1DISA STIGsDISA.V-285327The Intune service must be configured to implement Multi-Admin Approval (MAA) for wiping managed devices.New in 3.0IntuneTenant administrationPrivileged accessMediumLowLowT1072, T1078.004disa-stig-intune-mdm:V-285327, nist-800-53-r5:CM-6DISA STIGsEIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.Entra IDAuthentication methodsAuthenticationMediumLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004nist-800-53-r5:SI-4(5)Entra ID SCA (EIDSCA)EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621, T1078.004—Entra ID SCA (EIDSCA)EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.Entra IDAuthentication methodsAuthenticationMediumMediumLowT1566.002—Entra ID SCA (EIDSCA)EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.Entra IDAuthentication methodsAuthenticationMediumLowLowT1621nist-800-53-r5:IA-2(13), nist-800-53-r5:IA-2(1)Entra ID SCA (EIDSCA)EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.Entra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003nist-800-53-r5:AC-6(10)Entra ID SCA (EIDSCA)EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.Entra IDUser and directory settingsAccess controlMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.Entra IDUser and directory settingsAccess controlMediumLowLowT1136.003nist-800-53-r5:AC-2Entra ID SCA (EIDSCA)EIDSCA.AP07Default Authorization Settings - Guest user access.Entra IDExternal identitiesExternal access and sharingMediumLowLowT1087.004, T1069.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.Entra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528nist-800-53-r5:AC-6(10), nist-800-53-r5:CM-5Entra ID SCA (EIDSCA)EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.New in 3.0Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.New in 3.0Entra IDAgent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)EIDSCA.AT01Authentication Method - Temporary Access Pass - State.Entra IDAuthentication methodsAuthenticationMediumLowLow——Entra ID SCA (EIDSCA)EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.Entra IDAuthentication methodsAuthenticationMediumLowLowT1078.004nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:IA-5(1)Entra ID SCA (EIDSCA)EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.Entra IDPassword protectionAuthenticationMediumLowLowT1110nist-800-53-r5:AC-7Entra ID SCA (EIDSCA)EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.Entra IDGroupsExternal access and sharingMediumLowLowT1098nist-800-53-r5:AC-6Entra ID SCA (EIDSCA)MT.1001At least one Conditional Access policy is configured with device compliance.Entra IDConditional AccessAccess controlMediumMediumMediumT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:IA-3MaesterMT.1002App management restrictions on applications and service principals is configured and enabled.Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1078.004, T1098.001 +1—MaesterMT.1012At least one Conditional Access policy is configured to require MFA for risky sign-ins.Entra IDConditional AccessAuthenticationMediumLowLowT1078.004, T1110nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-2(1)MaesterMT.1013At least one Conditional Access policy is configured to require new password when user risk is high.Entra IDConditional AccessAuthenticationMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IA-5MaesterMT.1015At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms.Entra IDConditional AccessAccess controlMediumMediumLowT1078.004nist-800-53-r5:AC-2(11), nist-800-53-r5:CM-7MaesterMT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.Entra IDConditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:AC-19, nist-800-53-r5:AC-12MaesterMT.1018At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices.Entra IDConditional AccessAuthenticationMediumMediumLowT1539, T1550.004nist-800-53-r5:IA-11, nist-800-53-r5:AC-12MaesterMT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.Entra IDConditional AccessAccess controlMediumMediumMediumT1213.002, T1530—MaesterMT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.Entra IDConditional AccessAccess controlMediumLowLow——MaesterMT.1024Entra recommendations should be completed.Entra IDEntra recommendationsInfrastructure hardeningMediumLowMedium——MaesterMT.1036All excluded objects should have a fallback include in another policy.Entra IDConditional AccessAccess controlMediumLowMediumT1078.004—MaesterMT.1038Conditional Access policies should not include or exclude deleted groups.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1041Ensure users installing Outlook add-ins is not allowedExchange OnlineOutlookApplications and workload identitiesMediumMediumLowT1137.006, T1114.002nist-800-53-r5:CM-7, nist-800-53-r5:CM-11MaesterMT.1042Restrict dial-in users from bypassing a meeting lobbyTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3MaesterMT.1043Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domainsExchange OnlineMail flowEmail and collaboration protectionMediumLowMediumT1566nist-800-53-r5:SI-8MaesterMT.1045Only invited users should be automatically admitted to Teams meetingsTeamsMeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3MaesterMT.1046Restrict anonymous users from joining meetingsTeamsMeetingsExternal access and sharingMediumMediumLow—nist-800-53-r5:AC-3MaesterMT.1047Restrict anonymous users from starting Teams meetingsTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-3MaesterMT.1048Limit external participants from having control in a Teams meetingTeamsMeetingsExternal access and sharingMediumLowLow—nist-800-53-r5:AC-6MaesterMT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'IntuneDevice complianceDevices and endpointsMediumMediumMediumT1078.004nist-800-53-r5:AC-19, nist-800-53-r5:CM-6MaesterMT.1057App registrations should no longer use secrets.Entra IDApplicationsApplications and workload identitiesMediumLowHighT1078.004, T1552nist-800-53-r5:IA-5MaesterMT.1058Exchange application access policies must be configured.Entra IDApp consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1059Microsoft Defender for Identity health issues should be resolvedDefenderDefender for IdentityLogging and detectionMediumLowMedium——MaesterMT.1060Drift folders should match their baseline.New in 3.0Microsoft 365Configuration driftInfrastructure hardeningMediumLowLow——MaesterMT.1061Device registration MFA control conflicts with Conditional Access policies.Entra IDConditional AccessAuthenticationMediumLowLowT1098.005—MaesterMT.1062Ensure Direct Send is set to be rejectedExchange OnlineMail flowEmail and collaboration protectionMediumMediumMediumT1566, T1684.002nist-800-53-r5:CM-7MaesterMT.1064Ensure that write permissions are required to create new management groupsAzureManagement groupsAccess controlMediumLowLowT1666nist-800-53-r5:AC-6MaesterMT.1066Conditional Access policies should not reference non-existent users, groups, or roles.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1068Restrict non-admin users from creating tenants.Entra IDUser and directory settingsAccess controlMediumLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7MaesterMT.1070Restrict device join to selected users/groups or none.Entra IDDevice identityDevices and endpointsMediumLowLowT1098.005nist-800-53-r5:AC-6, nist-800-53-r5:IA-3MaesterMT.1071At least one Conditional Access policy explicitly includes Azure DevOps.Entra IDConditional AccessAccess controlMediumLowLowT1078.004nist-800-53-r5:AC-3MaesterMT.1073Soft- and hard-matching of synchronized objects should be blocked.Entra IDHybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098nist-800-53-r5:IA-4, nist-800-53-r5:CM-6MaesterMT.1075Require explicit assignment of Third Party Entra Apps.Entra IDApplicationsApplications and workload identitiesMediumMediumHighT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1077App registrations with privileged API permissions should not have owners.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1078App registrations with highly privileged directory roles should not have owners.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1098.001nist-800-53-r5:AC-6Exposure management (XSPM)MT.1079Privileged API permissions on service principals should not remain unused.DefenderExposure ManagementApplications and workload identitiesMediumLowMediumT1078.004nist-800-53-r5:AC-6Exposure management (XSPM)MT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.DefenderExposure ManagementPrivileged accessMediumLowMediumT1539, T1528—Exposure management (XSPM)MT.1081Hybrid users should not be assigned Entra ID role assignments.DefenderExposure ManagementPrivileged accessMediumLowMediumT1078.002, T1078.004 +1nist-800-53-r5:AC-6(5)Exposure management (XSPM)MT.1088Devices with critical credentials should be protected by TPM.DefenderExposure ManagementDevices and endpointsMediumLowMediumT1552.004—Exposure management (XSPM)MT.1089Devices with critical credentials should be protected by Credential Guard.DefenderExposure ManagementDevices and endpointsMediumLowMediumT1003.001—Exposure management (XSPM)MT.1090Global Administrator role should not be added as local administrator on the device during Microsoft Entra joinEntra IDDevice identityPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-6MaesterMT.1091Registering user should not be added as local administrator on the device during Microsoft Entra joinEntra IDDevice identityPrivileged accessMediumMediumLowT1078.004nist-800-53-r5:AC-6MaesterMT.1096Ensure at least one Intune Multi Admin Approval policy is configuredIntuneTenant administrationPrivileged accessMediumLowLowT1072, T1078.004nist-800-53-r5:AC-3(2), nist-800-53-r5:CM-5(4)MaesterMT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.-IncludePreviewDefenderExposure ManagementPrivileged accessMediumLowLowT1078.004nist-800-53-r5:AC-2Exposure management (XSPM)MT.1115AI agents should not have risky HTTP configurations.Copilot StudioAgentsAI and agentsMediumLowMediumT1571, T1048 +1nist-800-53-r5:SC-7MaesterMT.1118AI agents should not use author (maker) authentication for connections.Copilot StudioAgentsAI and agentsMediumMediumMediumT1550.001, T1213nist-800-53-r5:AC-6MaesterMT.1120AI agents should not use MCP server tools without review.Copilot StudioAgentsAI and agentsMediumLowMediumT1195, T1199—MaesterMT.1121AI agents with generative orchestration should have custom instructions.Copilot StudioAgentsAI and agentsMediumLowMedium——MaesterMT.1122AI agents should not have orphaned ownership.Copilot StudioAgentsAI and agentsMediumLowMedium——MaesterMT.1148Archive Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1027.015, T1204.002nist-800-53-r5:SI-3MaesterMT.1151Email Scanning should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1566.001nist-800-53-r5:SI-3MaesterMT.1154Full Scan Removable Drives should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1091nist-800-53-r5:SI-3MaesterMT.1156Scanning Network Files should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1080nist-800-53-r5:SI-3MaesterMT.1161Cloud Block Level should be High or higher.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1164PUA Protection should be enabled.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1166Local Admin Merge should be disabled.DefenderEndpoint antivirusDevices and endpointsMediumLowMediumT1685, T1564.012nist-800-53-r5:CM-6MaesterMT.1167Real-Time Scan Direction should cover both directions.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1171Sample Submission should send safe samples automatically.DefenderEndpoint antivirusDevices and endpointsMediumLowLowT1204.002—MaesterMT.1174Insider Risk Management policy for Risky AI usage is enabled.PurviewInsider risk managementLogging and detectionMediumLowMediumT1213nist-800-53-r5:SI-4MaesterMT.1175DLP policy is configured for the Microsoft 365 Copilot location.PurviewData loss preventionData protectionMediumLowMediumT1213.002, T1530nist-800-53-r5:SC-7(10)MaesterMT.1176Retention policy is configured for the Microsoft Copilot location.PurviewData lifecycle managementData protectionMediumLowLow—nist-800-53-r5:SI-12MaesterMT.1177Ensure LAPS Configuration Policy is properly set.IntuneEndpoint securityPrivileged accessMediumLowMediumT1078.003, T1021nist-800-53-r5:IA-5MaesterMT.1180Ensure Managed Installer Rules are configured correctly.IntuneEndpoint securityDevices and endpointsMediumLowLow—nist-800-53-r5:CM-7(5)MaesterMT.1182Mature DMARC policy SHALL be published for every Entra managed and verified domain.Entra IDUser and directory settingsEmail and collaboration protectionMediumMediumHighT1566, T1684.002nist-800-53-r5:SI-8MaesterMT.1183Temporary bypass for onPremisesObjectIdentifier updates should be disabled.Entra IDHybrid identityInfrastructure hardeningMediumLowLowT1078.004, T1098—MaesterMT.1184Conditional Access policy without any target resources configured.Entra IDConditional AccessAccess controlMediumLowLowT1078.004—MaesterMT.1185Block legacy MSOnline (MSOL) PowerShell module.Entra IDUser and directory settingsAccess controlMediumLowLowT1059.009, T1078.004nist-800-53-r5:CM-7MaesterMT.1186Require explicit assignment of high-privilege first-party Entra Apps.Entra IDApplicationsApplications and workload identitiesMediumMediumMediumT1059.009, T1087.004 +1nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1187The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowMedium——MaesterMT.1188Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1078.004, T1133nist-800-53-r5:AC-17, nist-800-53-r5:IA-3MaesterMT.1189Groups assigned to Global Secure Access traffic forwarding profiles should not be nested.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowLow——MaesterMT.1191Break-glass accounts should be excluded from the Compliant Network Conditional Access policy.-IncludePreviewEntra IDGlobal Secure AccessPrivileged accessMediumLowLow——MaesterMT.1193Entra Private Access application segments should avoid broad or risky destinations.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1021, T1046nist-800-53-r5:SC-7, nist-800-53-r5:AC-17MaesterMT.1194The baseline Global Secure Access security profile should enforce a threat-intelligence floor.-IncludePreviewEntra IDGlobal Secure AccessAccess controlMediumLowLowT1204.001, T1566.002—MaesterMT.1196Review who can change attributes used by dynamic group rules.Entra IDGroupsAccess controlMediumLowMediumT1098—MaesterMT.1197Remove memberOf rules.Entra IDGroupsIdentity lifecycle and hygieneMediumLowMedium——MaesterMT.1198App registration certificates should not have excessive validity periods.Entra IDApplicationsApplications and workload identitiesMediumLowMediumT1649nist-800-53-r5:IA-5MaesterMT.1200Agent Identities should have an active Agent Identity Blueprint Principal (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1201Agent Users should have an existing parent Agent Identity (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1203Agent Identity Blueprint Principals should have an existing Blueprint (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004—MaesterMT.1204Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2MaesterMT.1205Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLow—nist-800-53-r5:AC-2MaesterMT.1206Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-2(3)MaesterMT.1208Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowMediumT1078.004, T1098.001 +1nist-800-53-r5:IA-5MaesterMT.1212Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview).-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1078.004nist-800-53-r5:AC-3, nist-800-53-r5:AC-6MaesterMT.1214Ensure macOS compliance policy requires System Integrity Protection.IntuneDevice complianceDevices and endpointsMediumLowLowT1553.006, T1547.006 +1nist-800-53-r5:SI-7, nist-800-53-r5:CM-6MaesterMT.1215Ensure Gatekeeper restricts macOS app download locations.IntuneDevice complianceDevices and endpointsMediumLowLowT1553.001, T1204.002nist-800-53-r5:CM-11, nist-800-53-r5:CM-7(5)MaesterMT.1216Ensure macOS compliance policy requires a Defender machine risk score level.IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1225Users should not be able to create Agent Identity Blueprints.New in 3.0-IncludePreviewEntra IDAgent identitiesAI and agentsMediumLowLowT1136.003nist-800-53-r5:AC-6MaesterMT.1226GitHub and GitLab federated identity credentials should use immutable subject identifiers.New in 3.0-IncludePreviewEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1199nist-800-53-r5:IA-4MaesterMT.1227Subscriptions should be blocked from leaving and entering the tenantNew in 3.0AzureSubscriptionsInfrastructure hardeningMediumLowLowT1537nist-800-53-r5:AC-4MaesterMT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11MaesterMT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6MaesterMT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowLowT1068, T1553.006nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1233Ensure Android compliance policy requires a strong device password.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumLowT1110, T1111nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11MaesterMT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0IntuneDevice complianceDevices and endpointsMediumMediumMediumT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:CM-6MaesterMT.1235Ensure Android compliance policy requires device threat protection.New in 3.0IntuneDevice complianceDevices and endpointsMediumLowMediumT1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0IntuneApp protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19MaesterMT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0IntuneApp protectionData protectionMediumMediumLowT1567.002, T1115nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterMT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0IntuneApp protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19MaesterMT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0IntuneApp protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0IntuneApp protectionAccess controlMediumMediumLowT1110.001nist-800-53-r5:IA-5, nist-800-53-r5:AC-19MaesterMT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0IntuneApp protectionData protectionMediumMediumLowT1115, T1567.002nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterMT.1246Ensure Android app protection policy encrypts organization data.New in 3.0IntuneApp protectionData protectionMediumLowLowT1005nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19MaesterMT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0IntuneApp protectionAccess controlMediumLowMediumT1068, T1078.004nist-800-53-r5:SI-4, nist-800-53-r5:AC-19MaesterMT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0IntuneApp protectionDevices and endpointsMediumMediumLowT1068nist-800-53-r5:SI-7, nist-800-53-r5:AC-19MaesterMT.1252Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesMediumLowMediumT1114.002nist-800-53-r5:AC-6, nist-800-53-r5:AC-3MaesterMT.1260High-risk users should not be left unremediated in Entra ID Protection.New in 3.0-IncludePreviewEntra IDIdentity ProtectionLogging and detectionMediumLowLowT1078.004nist-800-53-r5:AC-2(12), nist-800-53-r5:IR-4MaesterMT.1265Fix dynamic groups whose rule processing failed.New in 3.0Entra IDGroupsIdentity lifecycle and hygieneMediumLowLow——MaesterORCA.103Outbound spam filter policy settings configured.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1078.004, T1534nist-800-53-r5:SI-8ORCAORCA.105Safe Links Synchronous URL detonation is enabled.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002nist-800-53-r5:SI-3ORCAORCA.108DKIM signing is set up for all your custom domains.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.108.1DNS Records have been set up to support DKIM.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.109Senders are not being allow listed in an unsafe manner.DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.111Anti-phishing policy exists and EnableUnauthenticatedSender is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.112Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.113AllowClickThrough is disabled in Safe Links policies.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.114No IP Allow Lists have been configured.DefenderAnti-spamEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:AC-4ORCAORCA.115Mailbox intelligence based impersonation protection is enabled in anti-phishing policies.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.116Mailbox intelligence based impersonation protection action set to move message to junk mail folder.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.120.1Zero Hour Autopurge Enabled for Phish.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.120.2Zero Hour Autopurge Enabled for Malware.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566.001nist-800-53-r5:SI-3ORCAORCA.120.3Zero Hour Autopurge Enabled for Spam.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.121Supported filter policy action used.DefenderZero-hour auto purgeEmail and collaboration protectionMediumLowLowT1566—ORCAORCA.140High Confidence Spam action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.142Phish action set to Quarantine message.DefenderAnti-spamEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.156Safe Links Policies are tracking when user clicks on safe links.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3, nist-800-53-r5:AU-12ORCAORCA.158Safe Attachments is enabled for SharePoint and Teams.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1080, T1204.002nist-800-53-r5:SI-3ORCAORCA.179Safe Links is enabled intra-organization.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1534, T1204.001nist-800-53-r5:SI-3ORCAORCA.180Anti-phishing policy exists and EnableSpoofIntelligence is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.189Safe Attachments is not bypassed.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.205Common attachment type filter is enabled.DefenderAnti-malwareEmail and collaboration protectionMediumLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.220Advanced Phish filter Threshold level is adequate.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.221Mailbox intelligence is enabled in anti-phishing policies.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.222Domain Impersonation action is set to move to Quarantine.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.223User impersonation action is set to move to Quarantine.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.225Safe Documents is enabled for Office clients.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1204.002nist-800-53-r5:SI-3ORCAORCA.226Each domain has a Safe Link policy applied to it.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.227Each domain has a Safe Attachments policy applied to it.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1566.001, T1204.002nist-800-53-r5:SI-3ORCAORCA.228No trusted senders in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowMediumT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.229No trusted domains in Anti-phishing policy.DefenderAnti-phishingEmail and collaboration protectionMediumLowMediumT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.233Domains are pointed directly at EOP or enhanced filtering is used.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566—ORCAORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.DefenderMail flowEmail and collaboration protectionMediumLowMediumT1566—ORCAORCA.234Click through is disabled for Safe Documents.DefenderSafe AttachmentsEmail and collaboration protectionMediumLowLowT1204.002nist-800-53-r5:SI-3ORCAORCA.235SPF records is set up for all your custom domains.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SI-8ORCAORCA.236Safe Links is enabled for emails.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1566.002, T1204.001nist-800-53-r5:SI-3ORCAORCA.237Safe Links is enabled for teams messages.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1204.001nist-800-53-r5:SI-3ORCAORCA.238Safe Links is enabled for office documents.DefenderSafe LinksEmail and collaboration protectionMediumLowLowT1204.001nist-800-53-r5:SI-3ORCAORCA.240Outlook is configured to display external tags for external emails.DefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566nist-800-53-r5:SI-8ORCAORCA.241Anti-phishing policy exists and EnableFirstContactSafetyTips is true.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.243Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO.DefenderEmail authenticationEmail and collaboration protectionMediumLowMediumT1566, T1684.002nist-800-53-r5:SC-8ORCAORCA.244Policies are configured to honor sending domains DMARC.DefenderAnti-phishingEmail and collaboration protectionMediumLowLowT1566, T1684.002nist-800-53-r5:SI-8ORCAZTA.21770Inactive applications don’t have highly privileged Microsoft Graph API permissionsZTAEntra IDApp consent and permissionsApplications and workload identitiesMediumHighLowT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21773Applications don't have certificates with expiration longer than 180 daysZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1649, T1078.004—Microsoft Zero Trust AssessmentZTA.21778Line-of-business and partner apps use MSALZTAEntra IDApplicationsApplications and workload identitiesMediumLowHigh——Microsoft Zero Trust AssessmentZTA.21779Use recent versions of Microsoft ApplicationsZTAEntra IDApplicationsApplications and workload identitiesMediumLowMedium——Microsoft Zero Trust AssessmentZTA.21780No usage of ADAL in the tenantZTAEntra IDApplicationsApplications and workload identitiesMediumLowHighT1078.004—Microsoft Zero Trust AssessmentZTA.21784All user sign in activity uses phishing-resistant authentication methodsZTAEntra IDConditional AccessAuthenticationMediumLowMediumT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21789Tenant creation events are triagedZTAEntra IDLogs and monitoringLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.21791Guests can’t invite other guestsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumLowT1136.003—Microsoft Zero Trust AssessmentZTA.21792Guests have restricted access to directory objectsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumLowT1087.004, T1069.003—Microsoft Zero Trust AssessmentZTA.21795No legacy authentication sign-in activityZTAEntra IDConditional AccessAuthenticationMediumHighLowT1110.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21796Block legacy authentication policy is configuredZTAEntra IDConditional AccessAuthenticationMediumHighLowT1110.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21800All user sign-in activity uses strong authentication methodsZTAEntra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1111 +1—Microsoft Zero Trust AssessmentZTA.21801Users have strong authentication methods configuredZTAEntra IDAuthentication methodsAuthenticationMediumMediumMediumT1078.004, T1111—Microsoft Zero Trust AssessmentZTA.21802Authenticator app shows sign-in contextZTAEntra IDAuthentication methodsAuthenticationMediumLowLowT1621—Microsoft Zero Trust AssessmentZTA.21807Creating new applications and service principals is restricted to privileged usersZTAEntra IDUser and directory settingsApplications and workload identitiesMediumLowLowT1098.001, T1528—Microsoft Zero Trust AssessmentZTA.21810Resource-specific consent is restrictedZTAEntra IDApp consent and permissionsApplications and workload identitiesMediumMediumMediumT1528, T1566.002—Microsoft Zero Trust AssessmentZTA.21811Password expiration is disabledZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110—Microsoft Zero Trust AssessmentZTA.21819Activation alert for Global Administrator role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21821Guest access is restrictedZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1087.004, T1069.003—Microsoft Zero Trust AssessmentZTA.21822Guest access is limited to approved tenantsZTAEntra IDExternal identitiesExternal access and sharingMediumMediumHighT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21823Guest self-service sign-up via user flow is disabledZTAEntra IDExternal identitiesExternal access and sharingMediumLowLowT1136.003—Microsoft Zero Trust AssessmentZTA.21824Guests don't have long lived sign-in sessionsZTAEntra IDConditional AccessAuthenticationMediumMediumLowT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21825Privileged user sessions don't have long lived sign-in sessionsZTAEntra IDConditional AccessPrivileged accessMediumMediumLowT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21831Conditional Access protected actions are enabledZTAEntra IDRoles and administratorsPrivileged accessMediumLowLowT1556.009, T1484.002—Microsoft Zero Trust AssessmentZTA.21832All groups in Conditional Access policies belong to a restricted management administrative unitZTAEntra IDConditional AccessPrivileged accessMediumLowLowT1098, T1556.009—Microsoft Zero Trust AssessmentZTA.21849Smart lockout duration is set to a minimum of 60ZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110.003, T1110.004—Microsoft Zero Trust AssessmentZTA.21850Smart lockout threshold isn't greater than 10ZTAEntra IDPassword protectionAuthenticationMediumLowLowT1110.001, T1110.003—Microsoft Zero Trust AssessmentZTA.21851Guest access is protected by strong authentication methodsZTAEntra IDConditional AccessAuthenticationMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21854Privileged roles aren't assigned to stale identitiesZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21855Privileged roles have access reviewsZTAEntra IDIdentity GovernancePrivileged accessMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21857Guest identities are lifecycle managed with access reviewsZTAEntra IDIdentity GovernanceExternal access and sharingMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21858Inactive guest identities are disabled or removed from the tenantZTAEntra IDExternal identitiesExternal access and sharingMediumLowMediumT1078.004, T1110.003—Microsoft Zero Trust AssessmentZTA.21859GDAP admin least privilegeZTAEntra IDRoles and administratorsPrivileged accessMediumLowMediumT1199, T1078.004—Microsoft Zero Trust AssessmentZTA.21862All risky workload identities are triagedZTAEntra IDIdentity ProtectionApplications and workload identitiesMediumLowHighT1078.004, T1098.001—Microsoft Zero Trust AssessmentZTA.21865Named locations are configuredZTAEntra IDConditional AccessAccess controlMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21866All Microsoft Entra recommendations are addressedZTAEntra IDEntra recommendationsInfrastructure hardeningMediumLowMedium——Microsoft Zero Trust AssessmentZTA.21868Guests do not own apps in the tenantZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001, T1199—Microsoft Zero Trust AssessmentZTA.21869Enterprise applications must require explicit assignment or scoped provisioningZTAEntra IDApplicationsApplications and workload identitiesMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21874Allow/Deny lists of domains to restrict external collaboration are configuredZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21875Tenant has all External organizations allowed to collaborate as Connected OrganizationZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1199, T1078.004—Microsoft Zero Trust AssessmentZTA.21876Use PIM for Microsoft Entra privileged rolesZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003, T1078.004—Microsoft Zero Trust AssessmentZTA.21877All guests have a sponsorZTAEntra IDExternal identitiesExternal access and sharingMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21878All entitlement management policies have an expiration dateZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21879All entitlement management policies that apply to External users require approvalZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004, T1199—Microsoft Zero Trust AssessmentZTA.21882No nested groups in PIM for groupsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowMediumT1098—Microsoft Zero Trust AssessmentZTA.21883Workload Identities are configured with risk-based policiesZTAEntra IDConditional AccessApplications and workload identitiesMediumHighLowT1078.004—Microsoft Zero Trust AssessmentZTA.21884Workload identities based on known networks are configuredZTAEntra IDConditional AccessApplications and workload identitiesMediumLowMediumT1078.004, T1552.001—Microsoft Zero Trust AssessmentZTA.21886Applications that use Microsoft Entra for authentication and support provisioning are configuredZTAEntra IDApplicationsIdentity lifecycle and hygieneMediumLowMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21887All registered redirect URIs must have proper DNS records and ownershipsZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1528, T1584.001—Microsoft Zero Trust AssessmentZTA.21890Require password reset notifications for user rolesZTAEntra IDAuthentication methodsLogging and detectionMediumMediumLowT1098—Microsoft Zero Trust AssessmentZTA.21892All sign-in activity comes from managed devicesZTAEntra IDConditional AccessAccess controlMediumHighHighT1078.004—Microsoft Zero Trust AssessmentZTA.21896Service principals don't have certificates or credentials associated with themZTAEntra IDApplicationsApplications and workload identitiesMediumLowMediumT1098.001—Microsoft Zero Trust AssessmentZTA.21897All app assignment and group membership is governedZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumHighHighT1078.004—Microsoft Zero Trust AssessmentZTA.21898All supported access lifecycle resources are managed with entitlement management packagesZTAEntra IDIdentity GovernanceIdentity lifecycle and hygieneMediumMediumHighT1078.004—Microsoft Zero Trust AssessmentZTA.21899All privileged role assignments have a recipient that can receive notificationsZTAEntra IDPrivileged Identity ManagementPrivileged accessMediumLowLowT1098.003—Microsoft Zero Trust AssessmentZTA.21929All entitlement management packages that apply to guests have expirations or access reviews configured in their assignment policiesZTAEntra IDIdentity GovernanceExternal access and sharingMediumMediumMediumT1078.004—Microsoft Zero Trust AssessmentZTA.21941Token protection policies are configuredZTAEntra IDConditional AccessAuthenticationMediumLowMediumT1550.004, T1539—Microsoft Zero Trust AssessmentZTA.21983No Active Medium priority Entra recommendations foundZTAEntra IDEntra recommendationsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.21985Turn off Seamless SSO if there is no usageZTAEntra IDHybrid identityAuthenticationMediumLowLowT1110, T1558.002—Microsoft Zero Trust AssessmentZTA.22072Self-Service Password Reset does not use Q & AZTAEntra IDAuthentication methodsAuthenticationMediumMediumMediumT1110.001, T1078.004—Microsoft Zero Trust AssessmentZTA.24518Enterprise applications have ownersZTAEntra IDApplicationsApplications and workload identitiesMediumLowMedium——Microsoft Zero Trust AssessmentZTA.24552macOS - Firewall policy is created and assignedZTAIntuneEndpoint securityDevices and endpointsMediumHighHighT1021, T1210—Microsoft Zero Trust AssessmentZTA.24823Company Portal branding and support settings enhance user experience and trustZTAIntuneTenant administrationDevices and endpointsMediumLowLow——Microsoft Zero Trust AssessmentZTA.25370Source IP restoration is enabledZTAEntra IDGlobal Secure AccessAccess controlMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.25379Conditional Access policies use compliant network controlsZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1078.004, T1550.001—Microsoft Zero Trust AssessmentZTA.25380Global Secure Access signaling for Conditional Access is enabledZTAEntra IDGlobal Secure AccessAccess controlMediumHighLowT1078.004—Microsoft Zero Trust AssessmentZTA.25391Private network connectors are active and healthy to maintain Zero Trust access to internal resourcesZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumMediumLow——Microsoft Zero Trust AssessmentZTA.25392Private network connectors are running the latest versionZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumLowLowT1190—Microsoft Zero Trust AssessmentZTA.25399Private DNS is configured for internal name resolutionZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumLowMediumT1557.001—Microsoft Zero Trust AssessmentZTA.25405Intelligent Local Access is enabled and configuredZTAEntra IDGlobal Secure AccessInfrastructure hardeningMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.25408Web content filtering policies are configuredZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1189, T1204.001 +1—Microsoft Zero Trust AssessmentZTA.25409Web content filtering uses category-based rulesZTAEntra IDGlobal Secure AccessAccess controlMediumMediumMediumT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.25410Web content filtering policies are linked to security profilesZTAEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1189, T1204.001—Microsoft Zero Trust AssessmentZTA.25419Network access activity is visible to security operations for threat detection and responseZTAEntra IDLogs and monitoringLogging and detectionMediumLowLowT1046, T1021 +1—Microsoft Zero Trust AssessmentZTA.25422Global Secure Access deployment logs are populated and reviewedZTAEntra IDGlobal Secure AccessLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.25480Quick Access has user or group assignmentsZTAEntra IDGlobal Secure AccessAccess controlMediumLowLow——Microsoft Zero Trust AssessmentZTA.26885Metrics are enabled for DDoS-protected public IPsZTAAzureNetwork securityLogging and detectionMediumLowLowT1498—Microsoft Zero Trust AssessmentZTA.26886Diagnostic logging is enabled for DDoS-protected public IPsZTAAzureNetwork securityLogging and detectionMediumLowLowT1498—Microsoft Zero Trust AssessmentZTA.27001TLS inspection bypass rules are regularly reviewedZTAEntra IDGlobal Secure AccessAccess controlMediumLowMediumT1573, T1071.001 +1—Microsoft Zero Trust AssessmentZTA.27017JavaScript Challenge is Enabled in Application Gateway WAFZTAAzureNetwork securityInfrastructure hardeningMediumLowLowT1110.004, T1499.003—Microsoft Zero Trust AssessmentZTA.27019JavaScript Challenge is Enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningMediumLowLowT1110.004—Microsoft Zero Trust AssessmentZTA.27020CAPTCHA challenge is enabled in Azure Front Door WAFZTAAzureNetwork securityInfrastructure hardeningMediumMediumLowT1110.004—Microsoft Zero Trust AssessmentZTA.35006PDF labeling is enabled in SharePointZTAPurviewInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35008Default sensitivity labels are configured for SharePoint document librariesZTAPurviewInformation protectionData protectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.35011Super user membership is configured for Microsoft Purview Information ProtectionZTAPurviewInformation protectionData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35012Container labels are configured for collaborative workspacesZTAPurviewInformation protectionData protectionMediumHighMediumT1213.002—Microsoft Zero Trust AssessmentZTA.35014Email label policies inherit sensitivity from attachmentsZTAPurviewInformation protectionData protectionMediumHighLow——Microsoft Zero Trust AssessmentZTA.35015Globally published sensitivity labels don't exceed the recommended maximumZTAPurviewInformation protectionData protectionMediumHighMedium——Microsoft Zero Trust AssessmentZTA.35017A default sensitivity label is configured in label policiesZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35018Users must provide justification to downgrade sensitivity labelsZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35022On-demand scans are configured for sensitive information discoveryZTAPurviewData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35023OCR is enabled for sensitive information detectionZTAPurviewData classificationData protectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.35026Microsoft Purview Message Encryption is configured with simplified client accessZTAPurviewInformation protectionData protectionMediumMediumLow——Microsoft Zero Trust AssessmentZTA.35028Email retention policies are configuredZTAPurviewData lifecycle managementData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.35029Mail flow rules apply rights protection to sensitive messagesZTAExchange OnlineMail flowData protectionMediumMediumMedium——Microsoft Zero Trust AssessmentZTA.35032Adaptive Protection is enabled in data loss prevention policiesZTAPurviewInsider risk managementData protectionMediumMediumLowT1567—Microsoft Zero Trust AssessmentZTA.35036Trainable classifiers are used in data loss prevention and auto-labeling policiesZTAPurviewData classificationData protectionMediumMediumHigh——Microsoft Zero Trust AssessmentZTA.35041Browser data loss prevention is enabled for AI apps via Edge for BusinessZTAPurviewData loss preventionData protectionMediumMediumHighT1567—Microsoft Zero Trust AssessmentZTA.41020Microsoft Defender for Identity sensor deployment is validated by reviewing the Health Issues pageZTADefenderDefender for IdentityLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41022Microsoft Defender for Identity security alerts have been triaged and tunedZTADefenderDefender for IdentityLogging and detectionMediumLowLowT1558.003, T1003.006 +1—Microsoft Zero Trust AssessmentZTA.41034Anti-spam (hosted content filter) policies are configured with recommended thresholds and actionsZTADefenderAnti-spamEmail and collaboration protectionMediumMediumLowT1566—Microsoft Zero Trust AssessmentZTA.41035User reporting for phishing and spam is enabled and routed to a reviewed mailboxZTADefenderTenant settingsEmail and collaboration protectionMediumLowLowT1566—Microsoft Zero Trust AssessmentZTA.41036Attack Simulation Training is configured and a baseline simulation has been run in the last 12 monthsZTADefenderTenant settingsEmail and collaboration protectionMediumMediumMediumT1566—Microsoft Zero Trust AssessmentZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersZTAIntuneEndpoint securityDevices and endpointsMediumMediumLowT1685—Microsoft Zero Trust AssessmentZTA.41051Removable storage and device control policies are enforced via IntuneZTAIntuneEndpoint securityDevices and endpointsMediumMediumMediumT1052.001, T1091 +1—Microsoft Zero Trust AssessmentZTA.41116Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operationalZTADefenderTenant settingsLogging and detectionMediumLowMediumT1566—Microsoft Zero Trust AssessmentZTA.41202Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scopeZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41204Interactive and long-term retention duration meets the security baseline on every Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41205Data collection rules (DCRs) are used to control ingestion into Microsoft Sentinel workspacesZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41209User and Entity Behavior Analytics (UEBA) is enabled in Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.41210Microsoft Threat Intelligence feeds are integrated into Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1071, T1566—Microsoft Zero Trust AssessmentZTA.41211Auditing and health monitoring is enabled for Microsoft SentinelZTAAzureMicrosoft SentinelLogging and detectionMediumLowLowT1685—Microsoft Zero Trust AssessmentZTA.41212Hunting capabilities are operationalized in Microsoft Sentinel via saved hunting queries or bookmarksZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41213At least one automation rule is configured in Microsoft Sentinel to manage incident responseZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.41214At least one Microsoft Sentinel automation rule executes a playbook for automated threat responseZTAAzureMicrosoft SentinelLogging and detectionMediumLowMedium——Microsoft Zero Trust AssessmentZTA.41215Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenantZTAAzureSubscriptionsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.41216Microsoft Security Copilot SCU consumption is monitored and alerted on through Cost ManagementZTAAzureSubscriptionsInfrastructure hardeningMediumLowLow——Microsoft Zero Trust AssessmentZTA.41217Security tables are provisioned on the appropriate Log Analytics storage plan (Analytics, Basic, or Auxiliary)ZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentZTA.51019MAM app access timeout and re-authentication are enforced after idle periodZTAIntuneApp protectionAuthenticationMediumMediumLowT1078.004—Microsoft Zero Trust AssessmentZTA.61008Agent identity lifecycle tagging (customSecurityAttributes present)ZTAEntra IDAgent identitiesAI and agentsMediumLowMedium——Microsoft Zero Trust AssessmentZTA.61013Identity governance for agents — sponsors assigned, entitlement-management channel exists, and lifecycle automation in placeZTAEntra IDAgent identitiesAI and agentsMediumLowLow——Microsoft Zero Trust AssessmentZTA.61018Microsoft Purview Information Protection data connector is enabled on the Microsoft Sentinel workspaceZTAAzureMicrosoft SentinelLogging and detectionMediumLowLow——Microsoft Zero Trust AssessmentAD-DFSR-01All domain controllers should have DFS-R subscriptionsActive DirectoryReplicationInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-04Unlinked GPO count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPO-05GPO unlinked details should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOL-03GPO unlinked target count should be compliantActive DirectoryGroup PolicyInfrastructure hardeningLowLowMedium——Active DirectoryAD-GPOREP-06GPOs without domain computers count should be retrievableActive DirectoryGroup PolicyAccess controlLowLowMedium——Active DirectoryAD-REPL-01No replication connections should be disabledActive DirectoryReplicationInfrastructure hardeningLowLowLow——Active DirectoryAD-ROOTDSE-03Root DSE should be synchronizedActive DirectoryReplicationInfrastructure hardeningLowLowMedium——Active DirectoryASD.ISM-1654Internet Explorer 11 is disabled or removed.New in 3.0IntuneDevice configurationDevices and endpointsLowLowLowT1189essential-eight:ISM-1654, nist-800-53-r5:CM-7 +1ASD Essential EightAZDO.1008Request access to Azure DevOps by e-mail notifications to administrators.New in 3.0Azure DevOpsUsers and accessAccess controlLowLowLow——MaesterAZDO.1027Disable showing Gravatar images for users outside of your enterprise.New in 3.0Azure DevOpsRepositoriesEngineering systemsLowLowLowT1589.002—MaesterCIS.M365.1.3.9Ensure shared bookings pages are restricted to select usersNew in 3.0Microsoft 365Organization settingsExternal access and sharingLowLowLowT1566cis-m365:1.3.9, nist-800-53-r5:AC-3CISCIS.M365.3.3.1Ensure Information Protection sensitivity label policies are publishedNew in 3.0PurviewInformation protectionData protectionLowMediumMedium—cis-m365:3.3.1, nist-800-53-r5:AC-4CISCIS.M365.5.1.3.1Ensure users cannot create security groupsNew in 3.0Entra IDGroupsAccess controlLowMediumLowT1098cis-m365:5.1.3.1, nist-800-53-r5:AC-6CISCIS.M365.5.1.3.4Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'New in 3.0Entra IDGroupsAccess controlLowMediumLow—cis-m365:5.1.3.4, nist-800-53-r5:AC-6CISCIS.M365.5.1.4.2Ensure the maximum number of devices per user is limitedNew in 3.0Entra IDDevice identityDevices and endpointsLowLowLowT1098.005cis-m365:5.1.4.2, nist-800-53-r5:CM-8CISCIS.M365.5.2.2.14Ensure trusted 'named locations' are definedNew in 3.0Entra IDConditional AccessAccess controlLowLowLow—cis-m365:5.2.2.14, nist-800-53-r5:AC-3CISCIS.M365.5.2.3.6Ensure system-preferred multifactor authentication is enabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowLowLowT1111cis-m365:5.2.3.6, nist-800-53-r5:IA-2CISCIS.M365.5.2.3.10Ensure Microsoft Authenticator on companion applications is disabledNew in 3.0Entra IDAuthentication methodsAuthenticationLowMediumLowT1111cis-m365:5.2.3.10, nist-800-53-r5:IA-2CISCIS.M365.6.3.2Ensure the ability to add personal email accounts and calendars is disabledNew in 3.0Exchange OnlineOutlookExternal access and sharingLowLowLowT1566cis-m365:6.3.2, nist-800-53-r5:AC-20CISCIS.M365.6.5.1Ensure modern authentication for Exchange Online is enabledNew in 3.0Exchange OnlineClient accessAuthenticationLowLowLow—cis-m365:6.5.1, nist-800-53-r5:IA-2CISCIS.M365.6.5.2Ensure MailTips are enabled for end usersNew in 3.0Exchange OnlineOutlookEmail and collaboration protectionLowLowLow—cis-m365:6.5.2, nist-800-53-r5:AC-4CISCIS.M365.8.5.6Ensure only organizers and co-organizers can presentNew in 3.0TeamsMeetingsEmail and collaboration protectionLowMediumLowT1566.003cis-m365:8.5.6, nist-800-53-r5:AC-3CISCIS.M365.8.5.9Ensure meeting recording is off by defaultNew in 3.0TeamsMeetingsData protectionLowMediumLow—cis-m365:8.5.9, nist-800-53-r5:CM-7CISCIS.M365.9.1.3Restrict guest browsing of Fabric contentNew in 3.0Microsoft FabricExport and sharing settingsExternal access and sharingLowMediumLowT1213cis-m365:9.1.3, nist-800-53-r5:AC-3CISCIS.M365.9.1.7Restrict organization-wide Fabric linksNew in 3.0Microsoft FabricExport and sharing settingsAccess controlLowMediumLow—cis-m365:9.1.7, nist-800-53-r5:AC-3CISCISA.MS.AAD.3.4The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.Entra IDAuthentication methodsAuthenticationLowLowMedium—cisa-scuba:MS.AAD.3.4, nist-800-53-r5:CM-7CISA SCuBADISA.V-267355Microsoft Intune service must enforce a 60-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationLowMediumLowT1078.004disa-stig-intune-desktop:V-267355, nist-800-53-r5:IA-5(1)DISA STIGsDISA.V-270209Microsoft Entra ID must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the application.New in 3.0-IncludePreviewEntra IDUser and directory settingsAccess controlLowLowLow—disa-stig-entra-id:V-270209, nist-800-53-r5:AC-8DISA STIGsDISA.V-270239Microsoft Entra ID must enforce a 180-day maximum password lifetime restriction.New in 3.0-IncludePreviewMicrosoft 365Organization settingsAuthenticationLowMediumLowT1078.004disa-stig-entra-id:V-270239, nist-800-53-r5:IA-5(1)DISA STIGsEIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.Entra IDAuthentication methodsAuthenticationLowLowLowT1098.005nist-800-53-r5:IA-5Entra ID SCA (EIDSCA)EIDSCA.AG01Authentication Method - General Settings - Manage migration.Entra IDAuthentication methodsAuthenticationLowLowMedium—nist-800-53-r5:CM-7Entra ID SCA (EIDSCA)EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.New in 3.0Entra IDApp consent and permissionsApplications and workload identitiesLowLowLow——Entra ID SCA (EIDSCA)EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.Entra IDGroupsExternal access and sharingLowLowLow—nist-800-53-r5:AC-6, nist-800-53-r5:AC-21Entra ID SCA (EIDSCA)MT.1022All users utilizing a P1 license should be licensed.Entra IDConditional AccessInfrastructure hardeningLowLowMedium——MaesterMT.1023All users utilizing a P2 license should be licensed.Entra IDConditional AccessInfrastructure hardeningLowLowMedium——MaesterMT.1037Only users with Presenter role are allowed to present in Teams meetingsTeamsMeetingsEmail and collaboration protectionLowMediumLow—nist-800-53-r5:AC-6MaesterMT.1039Ensure MailTips are enabled for end usersExchange OnlineOutlookEmail and collaboration protectionLowLowLow——MaesterMT.1044Ensure modern authentication for Exchange Online is enabledExchange OnlineClient accessAuthenticationLowLowLowT1110—MaesterMT.1053Ensure intune device clean-up rule is configuredIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.Entra IDGroupsAccess controlLowMediumLow—nist-800-53-r5:AC-6, nist-800-53-r5:CM-7MaesterMT.1067Authentication method policies should not reference non-existent groups.Entra IDAuthentication methodsAuthenticationLowLowLow——MaesterMT.1069Restrict non-admin users from creating security groups.Entra IDUser and directory settingsAccess controlLowLowLow—nist-800-53-r5:AC-6MaesterMT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domainExchange OnlineMailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1076MOERA SHOULD NOT be used for sent mailExchange OnlineMailboxesEmail and collaboration protectionLowLowMedium——MaesterMT.1083Ensure Delicensing Resiliency is enabledExchange OnlineMailboxesInfrastructure hardeningLowLowLow——MaesterMT.1085Pending approvals for Critical Asset Management should not be present.DefenderExposure ManagementLogging and detectionLowLowLow——Exposure management (XSPM)MT.1086Devices should not share both critical and non-critical user credentials.DefenderExposure ManagementDevices and endpointsLowLowHighT1003—Exposure management (XSPM)MT.1099Windows Diagnostic Data Processing should be enabledIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1101Default Branding Profile should be customizedIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1105Ensure MDM Authority is set to IntuneIntuneTenant administrationDevices and endpointsLowLowLow——MaesterMT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1107Access packages and catalogs should not reference deleted groups.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1108Access packages should not reference inactive or orphaned assignment policies.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1109Access package approval workflows must have valid approvers.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1110No catalog should contain resources without any associated access packages.Entra IDIdentity GovernanceIdentity lifecycle and hygieneLowLowMedium——MaesterMT.1111High privileged user should be linked to an identity.-IncludePreviewDefenderExposure ManagementPrivileged accessLowLowLow—nist-800-53-r5:AC-2Exposure management (XSPM)MT.1117Published AI agents should not be dormant.Copilot StudioAgentsAI and agentsLowLowMedium——MaesterMT.1155Full Scan Mapped Drives should be disabled for performance.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1157CPU Load Factor should be optimized (20-30%).DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1158Scan should be scheduled.DefenderEndpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3MaesterMT.1160Signatures should be checked before scan.DefenderEndpoint antivirusDevices and endpointsLowLowLow—nist-800-53-r5:SI-3MaesterMT.1162Cloud Extended Timeout should be 30-50 seconds.DefenderEndpoint antivirusDevices and endpointsLowLowLowT1204.002—MaesterMT.1163Signature Update Interval should be 1-4 hours.DefenderEndpoint antivirusDevices and endpointsLowLowLowT1204.002nist-800-53-r5:SI-3MaesterMT.1168Cleaned Malware should be retained for at least 30 days.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1169Catch-up Full Scan should be disabled.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1170Catch-up Quick Scan should be disabled.DefenderEndpoint antivirusDevices and endpointsLowLowLow——MaesterMT.1173Sensitivity labels are published for files used by Microsoft 365 Copilot.PurviewInformation protectionData protectionLowMediumMedium—nist-800-53-r5:AC-16MaesterMT.1190Entra Private Access applications should not use the Default connector group.-IncludePreviewEntra IDGlobal Secure AccessInfrastructure hardeningLowLowLow——MaesterMT.1192Groups assigned to Entra Private Access applications should not be nested.-IncludePreviewEntra IDGlobal Secure AccessAccess controlLowLowLow——MaesterMT.1195The Quick Access app should not be subject to a sign-in frequency Conditional Access control.-IncludePreviewEntra IDGlobal Secure AccessAuthenticationLowLowLow——MaesterMT.1199App registration credentials should not be expired or expiring soon.Entra IDApplicationsApplications and workload identitiesLowLowMediumT1098.001—MaesterMT.1224Microsoft-managed Conditional Access policies should not be left in report-only mode.New in 3.0Entra IDConditional AccessAccess controlLowLowLow—nist-800-53-r5:CM-3MaesterMT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0IntuneDevice complianceDevices and endpointsLowLowLowT1005, T1052.001nist-800-53-r5:SC-41, nist-800-53-r5:CM-7MaesterMT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0IntuneDevice complianceDevices and endpointsLowMediumMedium—nist-800-53-r5:AC-19, nist-800-53-r5:CM-6MaesterMT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0IntuneApp protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19MaesterMT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0IntuneApp protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19MaesterMT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0IntuneApp protectionDevices and endpointsLowMediumLowT1203, T1068nist-800-53-r5:SI-2, nist-800-53-r5:AC-19MaesterMT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0IntuneApp protectionAccess controlLowMediumLowT1078.004nist-800-53-r5:AC-12, nist-800-53-r5:AC-19MaesterMT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0IntuneApp protectionData protectionLowMediumLowT1113nist-800-53-r5:AC-4, nist-800-53-r5:AC-19MaesterORCA.100Bulk Complaint Level threshold is between 4 and 6.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.101Bulk is marked as spam.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.102Advanced Spam filter options are turned off.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.106Quarantine retention period is 30 days.DefenderAnti-spamEmail and collaboration protectionLowLowLow——ORCAORCA.107End-user spam notification is enabled.DefenderQuarantineEmail and collaboration protectionLowLowLow——ORCAORCA.110Internal Sender notifications are disabled.DefenderAnti-malwareEmail and collaboration protectionLowLowLow——ORCAORCA.139Spam action set to move message to junk mail folder or quarantine.DefenderAnti-spamEmail and collaboration protectionLowLowLowT1566nist-800-53-r5:SI-8ORCAORCA.141Bulk action set to Move message to Junk Email Folder.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.230Each domain has a Anti-phishing policy applied to it, or the default policy is being used.DefenderAnti-phishingEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.231Each domain has a anti-spam policy applied to it, or the default policy is being used.DefenderAnti-spamEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-8ORCAORCA.232Each domain has a malware filter policy applied to it, or the default policy is being used.DefenderAnti-malwareEmail and collaboration protectionLowLowLow—nist-800-53-r5:SI-3ORCAZTA.21775Tenant app management policy is configuredZTAEntra IDApplicationsApplications and workload identitiesLowMediumLowT1098.001, T1552—Microsoft Zero Trust AssessmentZTA.21812Maximum number of Global Administrators doesn't exceed eight usersZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21813High Global Administrator to privileged user ratioZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1078.004, T1098.003—Microsoft Zero Trust AssessmentZTA.21816All privileged role assignments are managed with PIMZTAEntra IDPrivileged Identity ManagementPrivileged accessLowLowLowT1098.003—Microsoft Zero Trust AssessmentZTA.21820Activation alert for all privileged role assignmentsZTAEntra IDPrivileged Identity ManagementPrivileged accessLowLowMediumT1098.003, T1548.005—Microsoft Zero Trust AssessmentZTA.21833Directory Sync account credentials haven't been rotated recentlyZTAEntra IDHybrid identityPrivileged accessLowLowHighT1078.004, T1556.007—Microsoft Zero Trust AssessmentZTA.21834Directory sync account is locked down to specific named locationZTAEntra IDConditional AccessPrivileged accessLowLowLowT1078.004—Microsoft Zero Trust AssessmentZTA.21835Emergency account existsZTAEntra IDRoles and administratorsPrivileged accessLowLowLow——Microsoft Zero Trust AssessmentZTA.21837Limit the maximum number of devices per user to 10ZTAEntra IDDevice identityDevices and endpointsLowLowLowT1098.005—Microsoft Zero Trust AssessmentZTA.21838Security key authentication method enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1566.002—Microsoft Zero Trust AssessmentZTA.21839Passkey authentication method enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1566.002, T1557 +1—Microsoft Zero Trust AssessmentZTA.21840Security key attestation is enforcedZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1098.005—Microsoft Zero Trust AssessmentZTA.21841Authenticator app report suspicious activity is enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1621, T1078.004—Microsoft Zero Trust AssessmentZTA.21842Block administrators from using SSPRZTAEntra IDUser and directory settingsPrivileged accessLowLowLowT1078.004, T1531—Microsoft Zero Trust AssessmentZTA.21843Block legacy Microsoft Online PowerShell moduleZTAEntra IDUser and directory settingsAccess controlLowLowHighT1059.009, T1078.004—Microsoft Zero Trust AssessmentZTA.21844Block legacy Azure AD PowerShell moduleZTAEntra IDApplicationsApplications and workload identitiesLowLowHighT1059.009, T1078.004—Microsoft Zero Trust AssessmentZTA.21845Temporary access pass is enabledZTAEntra IDAuthentication methodsAuthenticationLowLowLow——Microsoft Zero Trust AssessmentZTA.21846Temporary access pass restricted to one-time useZTAEntra IDAuthentication methodsAuthenticationLowLowLowT1078.004, T1098.005—Microsoft Zero Trust AssessmentZTA.21848Enable custom banned passwordsZTAEntra IDPassword protectionAuthenticationLowLowLowT1110.003—Microsoft Zero Trust AssessmentZTA.21867All enterprise applications have ownersZTAEntra IDApplicationsApplications and workload identitiesLowLowMediumT1098.001, T1078.004—Microsoft Zero Trust AssessmentZTA.21870Enable SSPRZTAEntra IDAuthentication methodsAuthenticationLowLowLow——Microsoft Zero Trust AssessmentZTA.21889Reduce the user-visible password surface areaZTAEntra IDAuthentication methodsAuthenticationLowMediumMediumT1110.003, T1110.004 +1—Microsoft Zero Trust AssessmentZTA.21893Enable Microsoft Entra ID Protection policy to enforce multifactor authentication registrationZTAEntra IDIdentity ProtectionAuthenticationLowMediumMediumT1078.004, T1098.005—Microsoft Zero Trust AssessmentZTA.21894All certificates Microsoft Entra Application Registrations and Service Principals must be issued by an approved certification authorityZTAEntra IDApplicationsApplications and workload identitiesLowLowMediumT1649, T1098.001—Microsoft Zero Trust AssessmentZTA.21895Application Certificate Credentials are managed using HSMZTAEntra IDApplicationsApplications and workload identitiesLowLowHighT1552.004—Microsoft Zero Trust AssessmentZTA.21953Local Admin Password Solution is deployedZTAEntra IDDevice identityPrivileged accessLowLowLowT1078.003, T1021—Microsoft Zero Trust AssessmentZTA.21954Restrict nonadministrator users from recovering the BitLocker keys for their owned devicesZTAEntra IDDevice identityAccess controlLowLowLowT1552—Microsoft Zero Trust AssessmentZTA.21955Manage the local administrators on Microsoft Entra joined devicesZTAEntra IDDevice identityPrivileged accessLowLowLowT1531, T1078.004—Microsoft Zero Trust AssessmentZTA.21964Enable protected actions to secure Conditional Access policy creation and changesZTAEntra IDRoles and administratorsPrivileged accessLowLowLowT1556.009—Microsoft Zero Trust AssessmentZTA.21984No Active low priority Entra recommendations foundZTAEntra IDEntra recommendationsInfrastructure hardeningLowLowLow——Microsoft Zero Trust AssessmentZTA.24576Intune Endpoint Analytics policy is created and AssignedZTAIntuneTenant administrationDevices and endpointsLowLowLow——Microsoft Zero Trust AssessmentZTA.25400DNS traffic for internal domains is routed through Private AccessZTAEntra IDGlobal Secure AccessInfrastructure hardeningLowLowLowT1557.001—Microsoft Zero Trust AssessmentZTA.27004TLS inspection custom bypass rules don't duplicate system bypass destinationsZTAEntra IDGlobal Secure AccessAccess controlLowLowLow——Microsoft Zero Trust AssessmentZTA.35004Sensitivity label policies are published to usersZTAPurviewInformation protectionData protectionLowMediumLow——Microsoft Zero Trust AssessmentZTA.35007Information Rights Management is enabled in SharePoint OnlineZTAPurviewInformation protectionData protectionLowLowLow——Microsoft Zero Trust AssessmentZTA.35009Co-authoring is enabled for files encrypted with sensitivity labelsZTAPurviewInformation protectionData protectionLowHighLow——Microsoft Zero Trust AssessmentZTA.35010Double Key Encryption labels are configuredZTAPurviewInformation protectionData protectionLowHighMedium——Microsoft Zero Trust AssessmentZTA.35027Custom branding templates are configured for Microsoft Purview Message EncryptionZTAPurviewInformation protectionData protectionLowLowLow——Microsoft Zero Trust AssessmentZTA.41203Custom data connectors are configured in Microsoft Sentinel for in-scope sources without a built-in connectorZTAAzureMicrosoft SentinelLogging and detectionLowLowHigh——Microsoft Zero Trust AssessmentZTA.41206At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reportingZTAAzureMicrosoft SentinelLogging and detectionLowLowLow——Microsoft Zero Trust AssessmentZTA.41208At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entitiesZTAAzureMicrosoft SentinelLogging and detectionLowLowLow——Microsoft Zero Trust AssessmentAD-CFG-01Tombstone lifetime configuration should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-02dSHeuristics count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-03SPN mappings should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-04Optional features count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-05Recycle bin enabled paths should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-06LDAP query policy count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-07Default query policy should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-08AuthN policy container count should be retrievableActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-CFG-09AD activation objects count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-10Well-known security principals count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-11Registered DHCP servers count should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-12Enterprise CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-13Certificate templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-14Enrollment templates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-15Enrollment CA certificate details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-16Trusted root CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-17Trusted root CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-18Intermediate CA count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-19Intermediate CA details should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-20CRL distribution points count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-21NTAuth certificates count should be retrievableActive DirectoryCertificate ServicesInfrastructure hardeningInfo————Active DirectoryAD-CFG-22KDS root key count should be acceptableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-CFG-23SMTP site links count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-CFG-24IP site links count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-COMP-01Computer disabled count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-02Computer dormant count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1078.002—Active DirectoryAD-COMP-03Computer CreatorSid count should be retrievableActive DirectoryComputersAccess controlInfo————Active DirectoryAD-COMP-04Computer non-standard primary group count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo————Active DirectoryAD-COMP-05Computer SID History count should be retrievableActive DirectoryComputersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-COMP-06Computer default container count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-07Computer OU count should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-08Computer per OU average should be retrievableActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-COMP-09Computer delegation count should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-COMP-10Computer delegation details should be retrievableActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DACL-01Distinct DACL object count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-02OU DACL entry count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-03Conflict object count should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-04Conflict object details should be investigatedActive DirectoryPermissions and delegationInfrastructure hardeningInfo————Active DirectoryAD-DACL-05Deny ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-06Deny ACE details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-07Distinct DACL identity count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-08DACL ACE distribution per identity should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-09Privileged allow ACE count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-10Privileged allow ACE details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1098, T1222.001—Active DirectoryAD-DACL-11Privileged extended right count should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-12Privileged extended right details should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-13Privileged extended right identities should be investigatedActive DirectoryPermissions and delegationPrivileged accessInfo——T1003.006, T1098—Active DirectoryAD-DACL-14Non-inherited ACE count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-15Unresolved SID count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-16Unresolved SID details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-17Inherited object type count should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DACL-18Inherited object type details should be investigatedActive DirectoryPermissions and delegationAccess controlInfo————Active DirectoryAD-DC-01DC site coverage count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-03SMBv3.1.1 enabled count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-05DCs with all FSMO roles count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-06FSMO role holder details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-07DC operating system count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DC-08DC operating system details should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-01DC non-standard LDAP port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-02DC non-standard LDAPS port count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-03Read-only domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCD-04Non-Global Catalog DC count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-01Computers with unconstrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-03Non-DC computers with constrained delegation count should be investigatedActive DirectoryComputersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-DCOMP-04Computer operating system count should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-05Computer operating system details should be investigatedActive DirectoryComputersDevices and endpointsInfo———nist-800-53-r5:CM-8Active DirectoryAD-DCOMP-07Computer DNS host name count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-08Computer DNS zone count should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DCOMP-09Computer DNS zone details should be investigatedActive DirectoryComputersInfrastructure hardeningInfo————Active DirectoryAD-DNS-01DNS zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-02Zones with only SOA/NS records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-03Root servers with incorrect IPs should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-04Root server incorrect IP details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-05Dynamic DNS record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-06Zones with non-default records should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-07Zone record count details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-08Zone delegation count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-09Zone delegation details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-10SOA record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-11AD DS SRV record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-12AD DS SRV record details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-13DNSSEC record count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-14Empty zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-15Duplicate zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-16Reverse lookup zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-17Non-standard zone count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-18Reverse zone network count should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DNS-19Reverse zone network details should be retrievableActive DirectoryDNSInfrastructure hardeningInfo————Active DirectoryAD-DOM-01Domain functional level should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-02Machine account quota should be retrievableActive DirectoryDomain and forestAccess controlInfo——T1136.002—Active DirectoryAD-DOM-03Domain controller count should be retrievableActive DirectoryDomain controllersInfrastructure hardeningInfo————Active DirectoryAD-DOM-04RIDs remaining should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-05Domain name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-06Domain name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-07NetBIOS name standard compliance should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOM-08NetBIOS name non-standard details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-DOMS-01Allowed DNS suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FEAT-01Optional feature count should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FEAT-02Optional feature enabled details should be investigatedActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FGPP-01Fine-grained password policy count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-02Fine-grained password policy value count should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-03Fine-grained password policy setting counts should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FGPP-04Fine-grained password policy application targets should be retrievableActive DirectoryPassword policyAuthenticationInfo————Active DirectoryAD-FOR-01Forest functional level should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-02Forest domain count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FOR-03Tombstone lifetime should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FOR-04Recycle Bin status should be retrievableActive DirectoryDirectory configurationInfrastructure hardeningInfo————Active DirectoryAD-FORS-01UPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-02UPN suffixes details should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-03SPN suffixes count should be retrievableActive DirectoryDomain and forestInfrastructure hardeningInfo————Active DirectoryAD-FORS-04Cross-forest references count should be retrievableActive DirectoryDomain and forestExternal access and sharingInfo————Active DirectoryAD-GCHG-01Average group membership changes per year should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-01Distinct groups with members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-02Distinct account types of members count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-03Member account types breakdown should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-04Trust members count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-05Trust members details by group should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-06Foreign SID principals count should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-07Foreign SID details by domain should be investigatedActive DirectoryGroupsExternal access and sharingInfo————Active DirectoryAD-GMC-08Empty non-privileged group count should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-09Empty non-privileged group details should be investigatedActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GMC-10Privileged groups with members count should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GMC-11Privileged groups with members details should be investigatedActive DirectoryGroupsPrivileged accessInfo——T1098.007, T1078.002—Active DirectoryAD-GPO-01GPO total count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-02GPO created before 2020 count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPO-03GPO stale-before-2020 count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-01GPO linked count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-02Disabled GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-04Enforced GPO link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOL-06GPO linked OU count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-10GPO no-apply Group Policy ACE count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-11GPO no-apply Group Policy ACE details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOREP-12GPO disabled link count should be retrievableActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-13GPO disabled link details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOREP-14GPO enforcement count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-01GPO state total count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-02WMI filter count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-03WMI filter details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-04Disabled GPO settings count should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-05Computer disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-06User disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-07All disabled GPO settings details should be investigatedActive DirectoryGroup PolicyInfrastructure hardeningInfo————Active DirectoryAD-GPOS-08GPO owner distinct count should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GPOS-09GPO owner details should be investigatedActive DirectoryGroup PolicyAccess controlInfo————Active DirectoryAD-GRP-01Group AdminCount should be retrievableActive DirectoryGroupsPrivileged accessInfo————Active DirectoryAD-GRP-02Groups in container objects count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-03Stale groups count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-04Groups with manager count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo————Active DirectoryAD-GRP-05Group SID History count should be retrievableActive DirectoryGroupsIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-GRP-06Distribution group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-07Security group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-08Domain local group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-09Global group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-GRP-10Universal group count should be retrievableActive DirectoryGroupsInfrastructure hardeningInfo————Active DirectoryAD-KRBTGT-02KRBTGT last logon should be investigatedActive DirectoryAccount securityAuthenticationInfo——T1078.001—Active DirectoryAD-MSA-01Managed service account count should be investigatedActive DirectoryAccount securityApplications and workload identitiesInfo————Active DirectoryAD-OU-01OU overlapping name count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-02OU at domain root count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-03OU stale count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-04OU empty count should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-OU-05OU empty details should be retrievableActive DirectoryOrganizational unitsInfrastructure hardeningInfo————Active DirectoryAD-PRINT-01Printer total count should be retrievableActive DirectoryPrintersInfrastructure hardeningInfo————Active DirectoryAD-PWDPOL-01Password history count should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.004—Active DirectoryAD-PWDPOL-02Password maximum age should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110.002, T1078.002—Active DirectoryAD-PWDPOL-03Password minimum length should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-06Account lockout duration should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-PWDPOL-07Account lockout threshold should be retrievableActive DirectoryPassword policyAuthenticationInfo——T1110—Active DirectoryAD-REPL-02Non-auto replication connection count should be investigatedActive DirectoryReplicationInfrastructure hardeningInfo————Active DirectoryAD-ROOTDSE-01Supported SASL mechanism count should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-ROOTDSE-02Supported SASL mechanism details should be investigatedActive DirectoryDirectory configurationAuthenticationInfo————Active DirectoryAD-SCH-01Schema modification year count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-02Schema modification year details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-03Schema version entry count should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SCH-04Schema version details should be retrievableActive DirectorySchemaInfrastructure hardeningInfo————Active DirectoryAD-SITE-01Site total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-02Sites without domain controllers count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-03Sites without domain controllers details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-04Sites without subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SITE-05Sites without subnet associations details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SPN-01Computer SPN service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-02Computer SPN service class usage should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-03Computer SPN unknown service class count should be retrievableActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-04Computer SPN unknown service class details should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-05Computer SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesInfrastructure hardeningInfo————Active DirectoryAD-SPN-06User SPN total count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-07User SPN service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-08User SPN service class usage should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-09User SPN unknown service class count should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-10User SPN unknown service class details should be investigatedActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-SPN-11User SPN non-FQDN hosts should be investigatedActive DirectoryService principal namesAuthenticationInfo————Active DirectoryAD-SUB-01Subnet total count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-02Sites with subnet associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-03Catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-04IPv6 subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-05IPv6 catch-all subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-06Non-RFC1918 (public IP) subnets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-07Non-RFC1918 (public IP) subnets details should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-08Distinct first octets count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-09Distinct first two octets (/16 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-10Distinct first three octets (/24 networks) count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-SUB-11Subnets without site associations count should be retrievableActive DirectorySites and subnetsInfrastructure hardeningInfo————Active DirectoryAD-TRUST-01Trust total count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-02Trust inter-forest count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-03Trust quarantined count should be investigatedActive DirectoryTrustsExternal access and sharingInfo——T1134.005—Active DirectoryAD-TRUST-05Trust configuration details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-06Trust stale count should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-TRUST-07Trust stale details should be investigatedActive DirectoryTrustsExternal access and sharingInfo————Active DirectoryAD-USER-01Disabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-02Dormant enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1078.002nist-800-53-r5:AC-2(3)Active DirectoryAD-USER-03Non-expiring password user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-04Reversible encryption user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1556.005—Active DirectoryAD-USER-05Delegation-enabled user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAD-USER-06DES-only Kerberos user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558—Active DirectoryAD-USER-07No pre-authentication user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1558.004—Active DirectoryAD-USER-08Never-logged-in enabled user count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-09Password-not-required user count should be retrievableActive DirectoryUsersAuthenticationInfo——T1078.002—Active DirectoryAD-USER-10Workstation-restricted user count should be retrievableActive DirectoryUsersAccess controlInfo————Active DirectoryAD-USER-11User AdminCount count should be retrievableActive DirectoryUsersPrivileged accessInfo————Active DirectoryAD-USER-12User non-standard primary group count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-13User SID History count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo——T1134.005—Active DirectoryAD-USER-14User SPN count should be retrievableActive DirectoryService principal namesAuthenticationInfo——T1558.003—Active DirectoryAD-USER-15User manager count should be retrievableActive DirectoryUsersIdentity lifecycle and hygieneInfo————Active DirectoryAD-USER-16User home directory count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-17User profile path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-18User script path count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo——T1037.003—Active DirectoryAD-USER-19User in container count should be retrievableActive DirectoryUsersInfrastructure hardeningInfo————Active DirectoryAD-USER-20Known service account count should be retrievableActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-21Known service account details should be investigatedActive DirectoryUsersApplications and workload identitiesInfo————Active DirectoryAD-USER-22Built-in administrator account count should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-23Enabled built-in administrator details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-24Built-in administrator last logon details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001—Active DirectoryAD-USER-25Built-in administrator password age details should be investigatedActive DirectoryUsersPrivileged accessInfo——T1078.001, T1110.003—Active DirectoryAD-USER-26Honey pot user count should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-27Honey pot user details should be investigatedActive DirectoryUsersLogging and detectionInfo————Active DirectoryAD-USER-28User delegation configured count should be investigatedActive DirectoryUsersAuthenticationInfo——T1558, T1550.003—Active DirectoryAZDO.1009Feedback Collection.New in 3.0Azure DevOpsOrganization policiesEngineering systemsInfo————MaesterAZDO.1011Project Resource Limits.New in 3.0Azure DevOpsResource usage and limitsEngineering systemsInfo————MaesterAZDO.1012Work Items Tags Limits.New in 3.0Azure DevOpsResource usage and limitsEngineering systemsInfo————MaesterAZDO.1029Storage Usage Limit.New in 3.0Azure DevOpsResource usage and limitsEngineering systemsInfo————MaesterAZDO.1045(Organization) Copilot code review: allowed for repositories.New in 3.0-IncludePreviewAzure DevOpsRepositoriesAI and agentsInfo————MaesterEIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.Entra IDUser and directory settingsAccess controlInfo———nist-800-53-r5:AC-3Entra ID SCA (EIDSCA)MT.1159Quick Scan Time configuration is not required.DefenderEndpoint antivirusDevices and endpointsInfo————MaesterORCA.119Similar Domains Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.123Unusual Characters Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAORCA.143Safety Tips are enabled.DefenderAnti-spamEmail and collaboration protectionInfo——T1566nist-800-53-r5:SI-8ORCAORCA.224Similar Users Safety Tips is enabled.DefenderAnti-phishingEmail and collaboration protectionInfo——T1566, T1684.001nist-800-53-r5:SI-8ORCAMP.CLT.UA.1001All member users have a usage location.Community pack · CLT.UAEntra ID——High————User AttributesMP.JL.CISDEFINT.L1.014ASR: Block abuse of exploited vulnerable signed drivers is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.015ASR: Block Adobe Reader from creating child processes is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.016ASR: Block all Office applications from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.017ASR: Block credential stealing from the Windows local security authority subsystem is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.018ASR: Block executable content from email client and webmail is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.019ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.020ASR: Block execution of potentially obfuscated scripts is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.021ASR: Block JavaScript or VBScript from launching downloaded executable content is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.022ASR: Block Office applications from creating executable content is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.023ASR: Block Office applications from injecting code into other processes is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.024ASR: Block Office communication application from creating child processes is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.025ASR: Block persistence through WMI event subscription is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.026ASR: Block process creations originating from PSExec and WMI commands is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.027ASR: Block rebooting machine in Safe Mode is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.028ASR: Block untrusted and unsigned processes that run from USB is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.029ASR: Block Win32 API calls from Office macros is set to BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.030ASR: Use advanced protection against ransomware is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.031Check For Signatures Before Running Scan is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——High————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISIOSINT.L1.001Block viewing corporate documents in unmanaged apps is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.008Force encrypted backup is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.009Block managed apps from storing data in iCloud is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.012Block iCloud Photos sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.013Block iCloud Photo Library is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.014Block My Photo Stream is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.016Block iCloud backup is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.017Block iCloud document and data sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.018Block iCloud Keychain sync is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.029Block users from erasing all content and settings on device is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.030Block modification of device name is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.031Block configuration profile changes is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.032Allow activation lock is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.038Require password is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.039Block simple passwords is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.040Minimum password length is at least 6Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.041Maximum minutes after screen lock before password is required is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.042Maximum minutes of inactivity until screen locks is at most 2Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.043Block password proximity requests is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.044Block password sharing is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.045Require Touch ID or Face ID authentication for AutoFill of password or credit card information is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.047Lock Screen Message is configuredCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.048Locked enrollment is set to YesCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.049Sync with computers is set to Deny AllCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.050Jailbroken devices is set to BlockCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.051Minimum OS version is configuredCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.052Mark device noncompliant is set to ImmediatelyCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.053Device compliance status is set to CompliantCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.054Mark devices with no compliance policy assigned as is set to Not compliantCommunity pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.055Compliance status validity period (days) is at most 7Community pack · JL.CISIOSINT.L1Intune——High————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISMACINT.L1.024Require Passcode on Device is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.026Enforce Latest Software Update Version is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.027Allow Standard User OS Updates is set to AllowedCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.028Download is set to AlwaysOnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.029Install OS Updates is set to Always OnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.030Install Security Update is set to AlwaysOnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.033Defer is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.034Defer Force At User Login Max Bypass Attempts is set to 0Community pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.035Enable is set to OnCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.036Force Enable In Setup Assistant is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.037Show Recovery Key is set to DisabledCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.038User Enters Missing Info is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.039Prevent FileVault From Being Disabled is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.042Enable Firewall is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.043Enable Stealth Mode is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.083Destroy FV Key On Standby is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.084Ask For Password is set to TrueCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.089Removal Password is configuredCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.090Locked enrollment is set to YesCommunity pack · JL.CISMACINT.L1Intune——High————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISOFFINT.L1.003Add-on Management is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.013Restrict ActiveX Install is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.017Enable Automatic Updates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.019Access: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.022Access: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.031Default file format is set to Enabled: Excel Workbook (*.xlsx)Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.039Excel: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.040Excel: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.041Prevent Excel from running XLM macros is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.042Excel: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.051Excel 2 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.052Excel 2 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.053Excel 3 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.054Excel 3 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.055Excel 4 macrosheets and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.056Excel 4 workbooks is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.057Excel 4 worksheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.058Excel 95 workbooks is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.059Excel 95-97 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.060Excel 97-2003 workbooks and templates is set to Enabled: Open/Save Blocked, Use Open PolicyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.061Excel: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.062Web pages and Excel 2003 XML spreadsheets is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.064Excel: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.065Excel: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.069Excel: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.077Block signing into Office is set to Enabled: Org ID onlyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.162Junk E-mail protection level is set to Enabled: HighCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.163Minimum encryption settings is set to Enabled: 256Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.175Default file format is set to Enabled: PowerPoint Presentation (*pptx)Community pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.181PowerPoint: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.182PowerPoint: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.185PowerPoint: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.186PowerPoint 97-2003 presentations, shows, templates and add-in files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.193PowerPoint: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.195Publisher: Block macros from running in Office files from the internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.196Publisher: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.198Publisher: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.204Word: Block macros from running in Office files from the Internet is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.206Word: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.210Word: VBA Macro Notification Settings is set to Enabled: Disable all except digitally signed macrosCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.211Word: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.212Word 2 and earlier binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.213Word 2000 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.214Word 2003 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.215Word 2007 and later binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.216Word 6.0 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.217Word 95 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.218Word 97 binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.219Word XP binary documents and templates is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.220Word: Do not open files from the internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.221Word: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.225Word: Allow Trusted Locations on the network is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——High————CIS Microsoft Intune for Office BenchmarkMP.JL.CISW11INT.BL.001Require Device Encryption is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.004Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for operating system drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.005Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for fixed data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.006Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later): Select the encryption method for removable data drives is set to Enabled: XTS-AES 128-bit or XTS-AES 256-bitCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.025Choose how BitLocker-protected operating system drives can be recovered: Save BitLocker recovery information to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.026Enforce drive encryption type on operating system drives: Select the encryption type is set to Enabled: Full encryption or Used Space Only encryptionCommunity pack · JL.CISW11INT.BLIntune——High————CIS Windows 11 Intune BLMP.JL.CISW11INT.L1.131Configure System Guard Launch is set to Unmanaged Enables Secure Launch if supported by hardwareCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.132Credential Guard is set to (Enabled with UEFI lock) Turns on Credential Guard with UEFI lock.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.133Enable Virtualization Based Security is set to enable virtualization based security.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.134Require Platform Security Features is set to Turns on VBS with Secure Boot, with or without DMACommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.139Enable Domain Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.140Enable Domain Network Firewall: Default Inbound Action for Domain Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.141Enable Domain Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.142Enable Domain Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.143Enable Domain Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.144Enable Domain Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\domainfw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.145Enable Domain Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.146Enable Private Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.147Enable Private Network Firewall: Default Inbound Action for Private Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.148Enable Private Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.149Enable Private Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.150Enable Private Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.151Enable Private Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\privatefw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.152Enable Private Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.153Enable Public Network Firewall is set to TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.154Enable Public Network Firewall: Allow Local Ipsec Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.155Enable Public Network Firewall: Allow Local Policy Merge is set to True: FalseCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.156Enable Public Network Firewall: Default Inbound Action for Public Profile is set to True: BlockCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.157Enable Public Network Firewall: Disable Inbound Notifications is set to True: TrueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.158Enable Public Network Firewall: Enable Log Dropped Packets is set to True: Enable Logging Of Dropped PacketsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.159Enable Public Network Firewall: Enable Log Success Connections is set to True: Enable Logging Of Successful ConnectionsCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.160Enable Public Network Firewall: Log File Path is set to True: %SystemRoot%\System32\logfiles\firewall\publicfw.logCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.161Enable Public Network Firewall: Log Max File Size is set to True: 16,384 KB or moreCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.257Hypervisor Enforced Code Integrity is set to (Enabled with UEFI lock) Turns on Hypervisor-Protected Code Integrity with UEFI lock.Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.258Require UEFI Memory Attributes Table is set to Require UEFI Memory Attributes TableCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.260Enable ESS with Supported Peripherals is set to Enhanced sign-in security will be enabled on systems with capable software and hardware, following the existing default behavior in Windows. For system…Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.261Facial Features Use Enhanced Anti Spoofing is set to trueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.262Minimum PIN Length is set to 6Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.263Require Security Device is set to trueCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.273Backup Directory is set to Backup the password to Microsoft Entra ID onlyCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.274Password Age Days is at most 30Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.275Password Complexity is set to Large letters + small letters + numbers + special characters or strongerCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.276Password Length is at least 15Community pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.277Post Authentication Actions is set to Reset the password and logoff, or reset and rebootCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.278Post Authentication Reset Delay is set to 1 to 8 hoursCommunity pack · JL.CISW11INT.L1Intune——High————CIS Windows 11 Intune L1MP.RKS.IA.1001Windows devices are BitLocker-encrypted and their recovery key is in Entra IDCommunity pack · RKS.IAIntune——High————RKSolutions Intune AnomaliesMP.RKS.IA.1002Windows devices back up their local administrator password to Entra IDCommunity pack · RKS.IAIntune——High————RKSolutions Intune AnomaliesMP.CLT.ADUA.1001All Active Directory users have a manager.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.ADUA.1004All Active Directory users have an employee ID.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.ADUA.1011Every Active Directory employee ID belongs to only one user.Community pack · CLT.ADUAActive Directory——Medium————AD User AttributesMP.CLT.UA.1002All member users have a manager.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1005All member users have an employee ID.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1006All member users have an employee hire date.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1009All guest users have a sponsor.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.CLT.UA.1010Every employee ID belongs to only one user.Community pack · CLT.UAEntra ID——Medium————User AttributesMP.JL.CISDEFINT.L1.001Configure local setting override for reporting to Microsoft MAPS is set to DisabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.002Configure the 'Block at First Sight' feature is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.003Turn on process scanning whenever real-time protection is enabled is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.004Turn off routine remediation is set to DisabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.005Allow Archive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.006Allow Behavior Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.007Allow Cloud Protection is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.008Allow Email Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.009Allow Full Scan Removable Drive Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.010Allow On Access Protection is set to AllowCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.011Allow Realtime Monitoring is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.012Allow scanning of all downloaded files and attachments is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.013Allow Script Scanning is set to AllowedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.032Cloud Block Level is set to High or higherCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.033Cloud Extended Timeout is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.034Days Until Aggressive Catchup Quick Scan is set to 7Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.035Enable Dynamic Signature Dropped Event Reporting is set to Dynamic Security intelligence update events will be reportedCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.036Enable File Hash Computation is set to EnableCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.037Enable Network Protection is set to Enabled (block mode)Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.038Hide Exclusions From Local Users is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.039Oobe Enable Rtp And Sig Update is set to EnabledCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.040PUA Protection is set to PUA Protection onCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.041Quick Scan Include Exclusions is set to 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.042Real Time Scan Direction is set to Monitor all files bi-directionalCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.043Remote Encryption Protection Configured State is set to Audit or BlockCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.044Scan Parameter is set to Quick scan or Full scanCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.045Schedule Quick Scan Time is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.046Schedule Scan Time is at least 1Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.047Schedule Scan Day is not set to No scheduled scanCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.048Signature Update Interval is set to 1 to 4Community pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.049Submit Samples Consent is set to Send safe samples or all samples automaticallyCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.050Remediation action for Moderate severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.051Remediation action for High severity threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISDEFINT.L1.052Remediation action for Severe threats is set to Quarantine or RemoveCommunity pack · JL.CISDEFINT.L1Intune——Medium————CIS Intune for Microsoft Defender Antivirus BenchmarkMP.JL.CISEDGEINT.L1.001Enable Google Cast is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.002Allow users to manage installed CA certificates is set to Enabled: Disallow users from managing certificatesCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.003Control use of insecure content exceptions is set to Enabled: Do not allow any site to load blockable mixed contentCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.004Control use of the File System API for writing is set to Enabled: Don't allow any site to request write access to files and directoriesCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.005Default automatic downloads setting is set to Enabled: Don't allow any website to perform automatic downloadsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.006Default geolocation setting is set to Enabled: Don't allow any site to track users' physical locationCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.007Enable insecure download warnings is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.008Configure Edge Website Typo Protection is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.009Configure users ability to override feature flags is set to Enabled: Prevent users from overriding feature flagsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.010Blocks external extensions from being installed is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.011Enable Gamer Mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.012Allow Basic authentication for HTTP is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.013Allow cross-origin HTTP Basic Auth prompts is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.014Guided Switch Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.015Specifies whether to block requests from public websites to devices on a user's local network is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.016Enable saving passwords to the password manager is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.017Enable startup boost is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.018Configure Microsoft Defender SmartScreen is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.019Configure Microsoft Defender SmartScreen to block potentially unwanted apps is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.020Enable Microsoft Defender SmartScreen DNS requests is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.021Force Microsoft Defender SmartScreen checks on downloads from trusted sources is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.022Prevent bypassing Microsoft Defender SmartScreen prompts for sites is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.023Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.024Disable Bing chat entry-points on Microsoft Edge Enterprise new tab page is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.025Ads setting for sites with intrusive ads is set to Enabled: Block ads on sites with intrusive adsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.026Allow download restrictions is set to Enabled: Block malicious downloadsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.027Allow Google Cast to connect to Cast devices on all IP addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.028Allow import of data from other browsers on each Microsoft Edge launch is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.029Allow importing of autofill form data is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.030Allow importing of browser settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.031Allow importing of home page settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.032Allow importing of payment info is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.033Allow importing of saved passwords is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.034Allow importing of search engine settings is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.035Allow managed extensions to use the Enterprise Hardware Platform API is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.036Allow personalization of ads, search and news by sending browsing history to Microsoft is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.037Allow queries to a Browser Network Time service is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.038Allow remote debugging is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.039Allow the audio sandbox to run is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.040Allow user feedback is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.041Allow Web Authentication requests on sites with broken TLS certificates is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.042Allow websites to query for available payment methods is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.043Automatically import another browser's data and settings at first run is set to Enabled: Disables automatic import, and the import section of the first-run experience is skippedCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.044Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.045Block tracking of users' web-browsing activity is set to Enabled: Balanced or StrictCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.046Clear browsing data when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.047Clear cached images and files when Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.048Clear history for IE and IE mode every time you exit is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.049Configure browser process code integrity guard setting is set to Enabled: Enable code integrity guard enforcement in the browser processCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.050Configure InPrivate mode availability is set to Enabled: InPrivate mode disabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.051Configure the list of names that will bypass the HSTS policy check is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.052Configure the list of types that are excluded from synchronization is set to Enabled and includes passwordsCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.053Configure the Share experience is set to Enabled: Don't allow using the Share experienceCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.054Continue running background apps after Microsoft Edge closes is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.055Control communication with the Experimentation and Configuration Service is set to Enabled: Disable communication with the Experimentation and Configuration ServiceCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.056Control where security restrictions on insecure origins apply is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.057Delete old browser data on migration is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.058Disable saving browser history is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.059Disable synchronization of data using Microsoft sync services is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.060DNS interception checks enabled is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.061Dynamic Code Settings is set to Enabled: Prevent the browser process from creating dynamic codeCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.062Edge 3P SERP Telemetry Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.063Edge Wallet E-Tree Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.064Enable Application Bound Encryption is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.065Enable AutoFill for addresses is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.066Enable AutoFill for payment instruments is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.067Enable browser legacy extension point blocking is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.068Enable component updates in Microsoft Edge is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.069Enable deleting browser and download history is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.070Enable globally scoped HTTP auth cache is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.071Enable network prediction is set to Enabled: Don't predict network actions on any network connectionCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.072Enable profile creation from the Identity flyout menu or the Settings page is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.073Enable resolution of navigation errors using a web service is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.074Enable security warnings for command-line flags is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.075Enable site isolation for every site is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.076Enable the Search bar is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.077Enable tab organization suggestions is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.078Enable upload files from mobile in Microsoft Edge desktop is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.079Enable use of ephemeral profiles is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.080Enable warnings for insecure forms is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.081Enables DALL-E themes generation is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.082Enhance the security state in Microsoft Edge is set to Enabled: Balanced mode or Strict modeCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.083Hide the First-run experience and splash screen is set to EnabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.084In-app support Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.085Manage exposure of local IP addressess by WebRTC is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.086Notify a user that a browser restart is recommended or required for pending updates is set to Enabled: Required - Show a recurring prompt to the user indicating that a restart is requiredCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.087Set disk cache size, in bytes is set to Enabled: 250609664Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.088Set the time period for update notifications is set to Enabled: 86400000Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.089Shopping in Microsoft Edge Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.090Show Microsoft Rewards experiences is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.091Show the Reload in Internet Explorer mode button in the toolbar is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.092Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.093Standalone Sidebar Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.094Suggest similar pages when a webpage can't be found is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.095Suppress the unsupported OS warning is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.096Wait for Internet Explorer mode tabs to completely unload before ending the browser session is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.097Wallet Donation Enabled is set to DisabledCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.098Update policy override default is set to Enabled: Always allow updates or Automatic silent updates onlyCommunity pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISEDGEINT.L1.099Auto-update check period override is set to Enabled: any value except 0Community pack · JL.CISEDGEINT.L1Intune——Medium————CIS Microsoft Intune for Edge BenchmarkMP.JL.CISIOSINT.L1.002Treat AirDrop as an unmanaged destination is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.003Allow copy/paste to be affected by managed open-in is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.004Block App Store is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.005Block access to network drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.006Block Siri while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.007Require Safari fraud warnings is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.010Block backup of enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.011Block notes and highlights sync for enterprise books is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.015Block Handoff is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.019Force Apple Watch wrist detection is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.020Require AirPlay outgoing requests pairing password is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.021Block Apple Watch auto unlock is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.022Block iBeacon discovery of AirPrint printers is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.023Block access to USB drive in Files app is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.024Block sending diagnostic and usage data to Apple is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.025Block screenshots and screen recording is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.026Force limited ad tracking is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.027Block trusting new enterprise app authors is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.028Limit Apple personalized advertising is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.033Force automatic date and time is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.034Block VPN creation is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.035Block Control Center access in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.036Block Today view in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.037Block Wallet notifications in lock screen is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISIOSINT.L1.046Block voice dialing while device is locked is set to YesCommunity pack · JL.CISIOSINT.L1Intune——Medium————CIS Apple iOS 26 and iPadOS26 Intune BenchmarkMP.JL.CISMACINT.L1.001Disable Guest Account is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.002Allow Sign In is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.003Enabled is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.004Allow Apple Intelligence Report is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.005Allow Genmoji is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.006Allow Image Playground is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.007Allow Writing Tools is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.008Allow Smart Replies is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.009Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.010Allow Transcription is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.011Allow Transcription Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.012Allow Summary is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.013Force On Device Only Dictation is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.014Automatic Device Lock is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.015Change At Next Auth is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.016Regex is configuredCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.017Failed Attempts Reset In Minutes is at least 15Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.018Maximum Grace Period is set to 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.019Maximum Number of Failed Attempts is set to 5 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.020Maximum Passcode Age In Days is set to 365 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.021Minimum Passcode Length is at least 15Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.022Passcode Reuse Limit is at least 24Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.023Require Alphanumeric Passcode is set to EnabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.025Enabled is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.031Enable is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.032Enable Rollback is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.040Show Full Name is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.041Disable Login Items Suppression is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.044Allow Activity Continuation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.045Allow Air Play Incoming Requests is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.046Allow AirDrop is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.047Allow Apple Personalized Advertising is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.048Allow ARD Remote Management Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.049Allow Auto Unlock is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.050Allow Bluetooth Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.051Allow Cloud Address Book is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.052Allow Cloud Bookmarks is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.053Allow Cloud Calendar is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.054Allow Cloud Desktop And Documents is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.055Allow Cloud Document Sync is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.056Allow Cloud Freeform is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.057Allow Cloud Keychain Sync is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.058Allow Cloud Mail is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.059Allow Cloud Notes is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.060Allow Cloud Photo Library is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.061Allow Cloud Reminders is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.062Allow Device Name Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.063Allow Diagnostic Submission is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.064Allow Erase Content And Settings is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.065Allow File Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.066Allow Find My Friends is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.067Allow Internet Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.068Allow iPhone Mirroring is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.069Allow iTunes File Sharing is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.070Allow Local User Creation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.071Allow Media Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.072Allow Multiplayer Gaming is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.073Allow Password Proximity Requests is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.074Allow Password Sharing is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.075Allow Printer Sharing Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.076Allow Startup Disk Modification is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.077Allow UI Configuration Profile Installation is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.078Allow Universal Control is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.079Display Sleep Timer is set to 10 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.080System Sleep Timer is set to 15 or less, but not 0Community pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.081Wake on LAN is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.082Wake On Modem Ring is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.085Allow User Overrides is set to FalseCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.086Allow Identified Developers is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.087Enable XProtect Malware Upload is set to DisabledCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISMACINT.L1.088Disable Override is set to TrueCommunity pack · JL.CISMACINT.L1Intune——Medium————CIS Apple MacOS 26 Tahoe Intune BenchmarkMP.JL.CISOFFINT.L1.001Block Flash activation in Office documents is set to Enabled: Block all activationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.002Restrict legacy JScript execution for Office is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.004Bind to object is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.005Consistent Mime Handling is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.006Disable user name and password is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.007Information Bar is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.008Local Machine Zone Lockdown Security is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.009Mime Sniffing Safety Feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.010Navigate URL is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.011Object Caching Protection is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.012Protection From Zone Elevation is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.014Restrict File Download is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.015Saved from URL is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.016Scripted Window Security Restrictions is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.018Hide option to enable or disable updates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.020Access: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.021Access: Require that application add-ins are signed by Trusted Publisher is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.023Underline hyperlinks is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.024Default file format is set to Enabled: Access 2007Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.025Do not prompt to convert older databases is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.026Modal Trust Decision Only is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.027Do not show data extraction options when opening corrupt workbooks is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.028Ask to update automatic links is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.029Load Pictures from Web pages not created in Excel is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.030Internet and network paths as hyperlinks is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.032Disable AutoRepublish is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.033Do not show AutoRepublish warning alert is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.034Force file extension to match file type is set to Enabled: Always match file typeCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.035Scan encrypted macros in Excel Open XML workbooks is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.036Excel: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.037WEBSERVICE Function Notification Settings is set to Enabled: Disable all with notification or Disable all without notificationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.038Block Excel XLL Add-ins that come from an untrusted source is set to Enabled: BlockedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.043Excel: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.044Store macro in Personal Macro Workbook by default is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.045Excel: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.046Always prevent untrusted Microsoft Query files from opening is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.047Don't allow Dynamic Data Exchange (DDE) server launch in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.048Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.049dBase III /IV files is set to Enable: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.050Dif and Sylk files is set to Enabled: Open/Save blocked, use open policyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.063Always open untrusted database files in Protected View is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.066Excel: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.067Excel: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.068Excel: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.070Disable UI extending from documents and templates is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.071Document Information Panel Beaconing UI is set to Enabled: Always show UICommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.072Allow users with earlier versions of Office to read with browsers... is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.073Always expand groups in Office when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.074Always require users to connect to verify permission is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.075Never allow users to specify groups when restricting permission for documents is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.076Prevent users from changing permissions on rights managed content is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.078Control Blogging is set to Enabled: All Blogging DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.079Block opening of pre-release versions of file formats new to Excel 2016 through the Compatibility Pack for Office 2016 and Excel 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.080Block opening of pre-release versions of file formats new to PowerPoint 2016 through the Compatibility Pack for Office 2016 and PowerPoint 2016 Converter is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.081ActiveX Control Initialization is set to Enabled: 6Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.082Allow Basic Authentication prompts from network proxies is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.083Allow VBA to load typelib references by path from untrusted intranet locations is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.084Automation Security is set to Enabled: Disable Macros by defaultCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.085Control how Office handles form-based sign-in prompts is set to Enabled: Block all promptsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.086Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.087Disable all Trust Bar notifications for security issues is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.088Disable password to open UI is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.089Encryption mode for Information Rights Management (IRM) is set to Enabled: Cipher Block Chaining (CBC)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.090Encryption type for password protected Office 97-2003 files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.091Encryption type for password protected Office Open XML files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.092Load Controls in Forms3 is set to Enabled: 4Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.093Macro Runtime Scan Scope is set to Enabled: Enable for all documentsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.094Protect document metadata for password protected files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.095Protect document metadata for rights managed Office Open XML Files is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.096Suppress hyperlink warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.097Allow mix of policy and user locations is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.098Disable the Office client from polling the SharePoint Server for published links is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.099Disable Internet Fax feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.100Legacy format signatures is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.101Suppress external signature services menu item is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.102Disable Smart Document's use of manifests is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.103Open Office documents as read/write while browsing is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.104Send Office Feedback is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.105Automatically receive small updates to improve reliability is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.106Disable Opt-in Wizard on first run is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.107Enable Customer Experience Improvement Program is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.108Send personal information is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.109Do not allow users to change permissions on folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.110Automatically download attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.111Do not include Internet Calendar integration in Outlook is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.112Download full text of articles as HTML attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.113Synchronize Outlook RSS Feeds with Common Feed List is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.114Turn off RSS feature is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.115Do not allow Home Page URL to be set in folder Properties is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.116Disable user entries to server list is set to Enabled: Publish default, disallow othersCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.117PST Null Data on Delete is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.118Plain Text Options is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.119Make Outlook the default program for E-mail, Contacts, and Calendar is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.120Do not allow folders in non-default stores to be set as folder home pages is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.121Access to published calendars is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.122Prevent publishing to a DAV server is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.123Prevent publishing to Office.com is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.124Restrict level of calendar details users can publish is set to Enabled: Disables Full details and Limited detailsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.125Restrict upload method is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.126Add e-mail recipients to users' Safe Senders Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.127Hide Junk Mail UI is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.128Trust e-mail from contacts is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.129Turn off Outlook Social Connector is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.130Disable 'Remember password' for Internet e-mail accounts is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.131Do not automatically sign replies is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.132Prompt user to choose security settings if default settings fail is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.133Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.134Block Trusted Zones is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.135Display pictures and external content in HTML e-mail is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.136Do not permit download of content from safe zones is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.137Do not display 'Publish to GAL' button is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.138Do not provide Continue option on Encryption warning dialog boxes is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.139Message Formats is set to Enabled: S/MIMECommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.140S/MIME interoperability with external clients is set to Enabled: Handle internallyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.141Attachment Secure Temporary Folder is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.142Missing CRLs is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.143Missing Root Certificates is set to Enabled: ErrorCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.144Promote Level 2 errors as errors, not warnings is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.145Outlook Security Mode is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.146Allow Active X One Off Forms is set to Enabled: Load only Outlook ControlsCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.147Allow hyperlinks in suspected phishing e-mail messages is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.148Allow scripts in one-off Outlook forms is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.149Allow users to demote attachments to Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.150Authentication with Exchange server is set to Enabled: Kerberos Password AuthenticationCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.151Configure Outlook object model prompt when accessing an address book is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.152Configure Outlook object model prompt When accessing the Formula property of a UserProperty object is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.153Configure Outlook object model prompt when executing Save As is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.154Configure Outlook object model prompt when reading address information is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.155Configure Outlook object model prompt when responding to meeting and task requests is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.156Display Level 1 attachments is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.157Configure Outlook object model prompt when sending mail is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.158Do not allow Outlook object model scripts to run for public folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.159Do not allow Outlook object model scripts to run for shared folders is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.160Enable RPC encryption is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.161Include Internet in Safe Zones for Automatic Picture Download is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.164Outlook Security Policy is set to Use Outlook Security Group PolicyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.165Prevent users from customizing attachment security settings is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.166Remove file extensions blocked as Level 1 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.167Remove file extensions blocked as Level 2 is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.168Retrieving CRLs (Certificate Revocation Lists) is set to Enabled: When online always retrieve the CRLCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.169Security setting for macros is set to Enabled: Warn for signed, disable unsignedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.170Set Outlook object model custom actions execution prompt is set to Enabled: Automatically DenyCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.171Signature Warning is set to Enabled: Always warn about invalid signaturesCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.172Use Unicode format when dragging e-mail message to file system is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.173Do not prompt about Level 1 attachments when closing an item is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.174Do not prompt about Level 1 attachments when sending an item is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.176PowerPoint: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.177Run Programs is set to Enabled: disable (don't run any programs)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.178Scan encrypted macros in PowerPoint Open XML presentations is set to Enabled: Scan encrypted macrosCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.179PowerPoint: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.180Unblock automatic download of linked images is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.183PowerPoint: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.184PowerPoint: Trust Access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.187PowerPoint: Set default file block behavior is set to Enabled: Blocked files are not openedCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.188PowerPoint: Do not open files from the Internet zone in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.189PowerPoint: Do not open files in unsafe locations in Protected View is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.190PowerPoint: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.191PowerPoint: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.192PowerPoint: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.194Publisher Automation Security Level is set to Enabled: By UI (prompted)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.197Publisher: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.199Update automatic links at Open is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.200Hidden text is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.201Default file format is set to Enabled: Word Document (.docx)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.202Word: Make hidden markup visible is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.203Word: Turn off file validation is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.205Dynamic Data Exchange is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.207Word: Disable Trust Bar Notification for unsigned application add-ins and block them is set to EnabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.208Scan encrypted macros in Word Open XML Documents is set to Enabled: Scan encrypted macros (default)Community pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.209Word: Trust access to Visual Basic Project is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.222Word: Set document behavior if file validation fails is set to Enabled: Open in Protected ViewCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.223Word: Set document behavior if file validation fails is set to Unchecked: Do not allow editCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISOFFINT.L1.224Word: Turn off Protected View for attachments opened from Outlook is set to DisabledCommunity pack · JL.CISOFFINT.L1Intune——Medium————CIS Microsoft Intune for Office BenchmarkMP.JL.CISW11INT.BL.002Allow Warning For Other Disk Encryption is set to DisabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.003Allow Warning For Other Disk Encryption: Allow Standard User Encryption is set to Disabled: EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.007Prevent installation of devices using drivers that match these device setup classes is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.008Prevent installation of devices using drivers that match these device setup classes: Also apply to matching devices that are already installed. is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.009Prevent installation of devices using drivers that match these device setup classes: Prevented Classes is set to Enabled: {d48179be-ec20-11d1-b6b8-00c04fa372a7}, {7ebefbc0-3200-11d2-b4c2-00a0C9697d07…Community pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.010Choose how BitLocker-protected fixed drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.011Choose how BitLocker-protected fixed drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Allow 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.012Choose how BitLocker-protected fixed drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.013Choose how BitLocker-protected fixed drives can be recovered: Allow data recovery agent is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.014Choose how BitLocker-protected fixed drives can be recovered: FDVRecoveryKeyUsageDropDown_Name is set to Enabled: Allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.015Choose how BitLocker-protected fixed drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Backup recovery passwords onlyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.016Choose how BitLocker-protected fixed drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.017Choose how BitLocker-protected fixed drives can be recovered: Save BitLocker recovery information to AD DS for fixed data drives is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.018Choose how BitLocker-protected operating system drives can be recovered is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.019Choose how BitLocker-protected operating system drives can be recovered: OSRecoveryKeyUsageDropDown_Name is set to Enabled: Do not allow 256-bit recovery keyCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.020Choose how BitLocker-protected operating system drives can be recovered: Configure storage of BitLocker recovery information to AD DS is set to Enabled: Store recovery passwords and key packagesCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.021Choose how BitLocker-protected operating system drives can be recovered: Omit recovery options from the BitLocker setup wizard is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.022Choose how BitLocker-protected operating system drives can be recovered: Configure user storage of BitLocker recovery information is set to Enabled: Require 48-digit recovery passwordCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.023Choose how BitLocker-protected operating system drives can be recovered: Allow data recovery agent is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.024Choose how BitLocker-protected operating system drives can be recovered: Do not enable BitLocker until recovery information is stored to AD DS for operating system drives is set to Enabled: TRUECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.027Deny write access to removable drives not protected by BitLocker is set to EnabledCommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.BL.028Deny write access to removable drives not protected by BitLocker: Do not allow write access to devices configured in another organization is set to Enabled: FALSECommunity pack · JL.CISW11INT.BLIntune——Medium————CIS Windows 11 Intune BLMP.JL.CISW11INT.L1.001Allow Cortana Above Lock is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.002Allow Toasts is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.003Prevent enabling lock screen camera is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.004Apply UAC restrictions to local accounts on network logons is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.005Configure SMB v1 client driver is set to Enabled: Disable driver (recommended)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.006Configure SMB v1 server is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.007Enable Structured Exception Handling Overwrite Protection (SEHOP) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.008WDigest Authentication (disabling may require KB2871997) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.009MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.010MSS: (DisableIPSourceRouting IPv6) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.011MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing) is set to Enabled: Highest protection, source routing is completely disabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.012MSS: (EnableICMPRedirect) Allow ICMP redirects to override OSPF generated routes is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.013MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.014MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.015MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning: WarningLevel is set to Enabled: 90% or lessCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.016Turn off multicast name resolution is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.017Prohibit installation and configuration of Network Bridge on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.018Prohibit use of Internet Connection Sharing on your DNS domain network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.019Require domain users to elevate when setting a network's location is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.020Hardened UNC Paths is set to Enabled: \\*\NETLOGON and \\*\SYSVOL with RequireIntegrity=1,RequireMutualAuthentication=1,RequirePrivacy=1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.021Minimize the number of simultaneous connections to the Internet or a Windows Domain is set to Enabled: 3 = Prevent Wi-Fi when on EthernetCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.022Prohibit connection to non-domain networks when connected to domain authenticated network is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.023Allow Print Spooler to accept client connections is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.024Configure Redirection Guard: Redirection Guard Options is set to Enabled: Redirection Guard EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.025Configure RPC connection settings: Protocol to use for outgoing RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.026Configure RPC connection settings: Use authentication for outgoing RPC connections is set to Enabled: DefaultCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.027Configure RPC listener settings: Authentication protocol to use for incoming RPC connections is set to Enabled: Negotiate or KerberosCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.028Configure RPC listener settings: Protocols to allow for incoming RPC connections is set to Enabled: RPC over TCPCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.029Configure RPC over TCP port: RPC over TCP port is set to Enabled: 0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.030Limits print driver installation to Administrators is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.031Manage processing of Queue-specific files: Manage processing of Queue-Specific files is set to Enabled: Limit Queue-specific files to Color profilesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.032Point and Print Restrictions: When installing drivers for a new connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.033Point and Print Restrictions: When updating drivers for an existing connection is set to Enabled: Show warning and elevation promptCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.034Include command line in process creation events is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.035Encryption Oracle Remediation is set to Enabled: Force Updated ClientsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.036Remote host allows delegation of non-exportable credentials is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.037Prevent automatic download of applications associated with device metadata is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.038Boot-Start Driver Initialization Policy is set to Enabled: Good, unknown and bad but criticalCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.039Continue experiences on this device is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.040Turn off downloading of print drivers over HTTP is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.041Turn off Internet download for Web publishing and online ordering wizards is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.042Allow Custom SSPs and APs to be loaded into LSASS is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.043Block user from showing account details on sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.044Do not display network selection UI is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.045Do not enumerate connected users on domain-joined computers is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.046Enumerate local users on domain-joined computers is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.047Turn off app notifications on the lock screen is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.048Turn off picture password sign-in is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.049Turn on convenience PIN sign-in is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.050Require a password when a computer wakes (on battery) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.051Require a password when a computer wakes (plugged in) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.052Configure Offer Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.053Configure Solicited Remote Assistance is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.054Enable RPC Endpoint Mapper Client Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.055Restrict Unauthenticated RPC clients is set to Enabled: AuthenticatedCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.056Enable Windows NTP Client is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.057Enable Windows NTP Server is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.058Allow Microsoft accounts to be optional is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.059Do not preserve zone information in file attachments (User) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.060Notify antivirus programs when opening attachments (User) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.061Disallow Autoplay for non-volume devices is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.062Set the default behavior for AutoRun is set to Enabled: Do not execute any autorun commandsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.063Turn off Autoplay is set to Enabled: All drivesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.064Do not display the password reveal button is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.065Enumerate administrator accounts on elevation is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.066Prevent the use of security questions for local accounts is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.067Enable App Installer Experimental Features is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.068Enable App Installer Hash Override is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.069Enable App Installer ms-appinstaller protocol is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.070Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.071Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.072Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.073Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 196,608 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.074Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.075Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.076Control Event Log behavior when the log file reaches its maximum size is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.077Specify the maximum log file size (KB): Maximum Log Size (KB) is set to Enabled: 32,768 or moreCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.078Configure Windows Defender SmartScreen is set to Enabled: Warn and prevent bypassCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.079Turn off Data Execution Prevention for Explorer is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.080Turn off heap termination on corruption is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.081Turn off shell protocol protected mode is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.082Block all consumer Microsoft account user authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.083Prevent users from sharing files within their profile. (User) is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.084Do not allow passwords to be saved is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.085Do not allow drive redirection is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.086Always prompt for password upon connection is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.087Require secure RPC communication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.088Require use of specific security layer for remote (RDP) connections is set to Enabled: SSLCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.089Require user authentication for remote connections by using Network Level Authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.090Set client connection encryption level is set to Enabled: High LevelCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.091Do not delete temp folders upon exit is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.092Prevent downloading of enclosures is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.093Turn off the offer to update to the latest version of Windows is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.094Configure the transmission of the user's password in the content of MPR notifications sent by winlogon. is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.095Sign-in and lock last interactive user automatically after a restart is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.096Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.097Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.098Disallow Digest authentication is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.099Allow Basic authentication is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.100Allow unencrypted traffic is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.101Disallow WinRM from storing RunAs credentials is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.102Account Logon Audit Credential Validation is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.103Account Logon Logoff Audit Account Lockout is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.104Account Logon Logoff Audit Group Membership is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.105Account Logon Logoff Audit Logoff is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.106Account Logon Logoff Audit Logon is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.107Account Management Audit Application Group Management is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.108Audit Authentication Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.109Audit Authorization Policy Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.110Audit Changes to Audit Policy is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.111Audit File Share Access is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.112Audit Other Logon Logoff Events is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.113Audit Security Group Management is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.114Audit Security System Extension is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.115Audit Special Logon is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.116Audit User Account Management is set to Success+FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.117Detailed Tracking Audit PNP Activity is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.118Detailed Tracking Audit Process Creation is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.119Object Access Audit Detailed File Share is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.120Object Access Audit Other Object Access Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.121Object Access Audit Removable Storage is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.122Policy Change Audit MPSSVC Rule Level Policy Change is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.123Policy Change Audit Other Policy Change Events is set to Failure or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.124Privilege Use Audit Sensitive Privilege Use is set to SuccessCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.125System Audit I Psec Driver is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.126System Audit Other System Events is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.127System Audit Security State Change is set to Success or Success and FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.128System Audit System Integrity is set to Success+ FailureCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.129Refresh cadence is at most 90Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.130DO Download Mode is not set to HTTP blended with Internet peeringCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.135Allow Cortana is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.136Allow Spotlight Collection (User) is set to 0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.137Disable Consumer Account State Content is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.138Do Not Show Feedback Notifications is set to Feedback notifications are disabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.162Audit Client Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.163Audit Client Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.164Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.165Auth Rate Limiter Delay In Ms is at least 2000Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.166Enable Auth Rate Limiter is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.167Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.168Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.169Audit Insecure Guest Logon is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.170Audit Server Does Not Support Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.171Audit Server Does Not Support Signing is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.172Enable Insecure Guest Logons is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.173Enable Mailslots is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.174Min Smb2 Dialect is set to SMB 3.1.1Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.175Require Encryption is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.176Accounts Enable Guest Account Status is set to DisableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.177Accounts Limit Local Account Use Of Blank Passwords To Console Logon Only is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.178Accounts Rename Administrator Account is not AdministratorCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.179Accounts Rename Guest Account is not GuestCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.180Interactive Logon Do Not Display Last Signed In is set to Enabled (username will not be shown)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.181Interactive Logon Machine Inactivity Limit is set to 1 to 900 secondsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.182Interactive Logon Message Title For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.183Interactive Logon Message Text For Users Attempting To Log On is configuredCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.184Interactive Logon Smart Card Removal Behavior is set to Lock Workstation, Force Logoff or Disconnect Remote Desktop SessionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.185Microsoft Network Client Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.186Microsoft Network Client Send Unencrypted Password To Third Party SMB Servers is set to DisableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.187Microsoft Network Server Digitally Sign Communications Always is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.188Network Access Do Not Allow Anonymous Enumeration Of SAM Accounts is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.189Network Access Do Not Allow Anonymous Enumeration Of Sam Accounts And Shares is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.190Network Access Restrict Anonymous Access To Named Pipes And Shares is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.191Network Access Restrict Clients Allowed To Make Remote Calls To SAM is set to O:BAG:BAD:(A;;RC;;;BA)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.192Network Security Allow Local System To Use Computer Identity For NTLM is set to AllowCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.193Network Security Allow PKU2U Authentication Requests is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.194Network Security LAN Manager Authentication Level is set to Send LM and NTLMv2 responses only. Refuse LM and NTLMCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.195Network Security Minimum Session Security For NTLMSSP Based Clients is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.196Network Security Minimum Session Security For NTLMSSP Based Servers is set to Require NTLM and 128-bit encryptionCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.197Network Security Restrict NTLM Audit Incoming NTLM Traffic is set to Enable auditing for all accountsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.198User Account Control Behavior Of The Elevation Prompt For Administrators is set to Prompt for consent or credentials on the secure desktopCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.199User Account Control Behavior Of The Elevation Prompt For Standard Users is set to Automatically deny elevation requestsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.200User Account Control Detect Application Installations And Prompt For Elevation is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.201User Account Control Only Elevate UI Access Applications That Are Installed In Secure Locations is set to Enabled: Application runs with UIAccess integrity only if it resides in secure location.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.202User Account Control Use Admin Approval Mode is set to EnableCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.203User Account Control Switch To The Secure Desktop When Prompting For Elevation is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.204User Account Control Run All Administrators In Admin Approval Mode is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.205User Account Control Virtualize File And Registry Write Failures To Per User Locations is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.206Configure Lsa Protected Process is set to Enabled with UEFI lock. LSA will run as protected process and this configuration is UEFI locked.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.207Allow apps from the Microsoft app store to auto update is set to Allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.208Allow Game DVR is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.209Block Non Admin User Install is set to AllowCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.210MSI Allow User Control Over Install is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.211MSI Always Install With Elevated Privileges is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.212Allow Input Personalization is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.213Let Apps Activate With Voice Above Lock is set to Force deny. Windows apps cannot be activated by voice while the screen is locked, and users cannot change it.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.214Allow Indexing Encrypted Stores Or Items is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.215Allow Search To Use Location is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.216Notify Malicious is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.217Notify Password Reuse is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.218Notify Unsafe App is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.219Service Enabled is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.220Enable Sudo is set to Sudo is disabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.221Allow Telemetry is set to BasicCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.222Enable One Settings Auditing is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.223Access Credential Manager As Trusted Caller is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.224Access From Network is set to *S-1-5-32-544, *S-1-5-32-555Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.225Act As Part Of The Operating System is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.226Allow Local Log On is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.227Backup Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.228Change System Time is set to *S-1-5-32-544, *S-1-5-19Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.229Create Global Objects is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.230Create Page File is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.231Create Permanent Shared Objects is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.232Create Symbolic Links is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.233Create Token is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.234Debug Programs is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.235Deny Access From Network includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.236Deny Local Log On includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.237Deny Log On As Batch Job includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.238Deny Log On As Service includes *S-1-5-32-546Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.239Deny Remote Desktop Services Log On includes *S-1-5-32-546, *S-1-5-113Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.240Enable Delegation is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.241Generate Security Audits is set to *S-1-5-19, *S-1-5-20, *S-1-5-99Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.242Impersonate Client is set to *S-1-5-32-544, *S-1-5-19, *S-1-5-20, *S-1-5-6, *S-1-5-99Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.243Increase Scheduling Priority is set to *S-1-5-32-544, *S-1-5-90-0Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.244Load Unload Device Drivers is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.245Lock Memory is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.246Manage Auditing And Security Log is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.247Manage Volume is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.248Modify Firmware Environment is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.249Modify Object Label is set to (<![CDATA[]]>)Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.250Profile Single Process is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.251Profile System Performance is set to *S-1-5-32-544, *S-1-5-80Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.252Remote Shutdown is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.253Replace Process Level Token is set to *S-1-5-19, *S-1-5-20Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.254Restore Files And Directories is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.255Shut Down The System is set to *S-1-5-32-544, *S-1-5-32-545Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.256Take Ownership is set to *S-1-5-32-544Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.259Allow Auto Connect To Wi Fi Sense Hotspots is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.264Allow Windows Ink Workspace is set to Disabled, or enabled but not above the lock screenCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.265Allow Clipboard Redirection is set to Not allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.266Allow Networking is set to Not allowed.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.267Allow Auto Update is not set to Turn off automatic updatesCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.268Defer Feature Updates Period In Days is at least 180Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.269Manage Preview Builds is set to Disable Preview buildsCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.270Scheduled Install Day is set to Every dayCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.271Block "Pause Updates" ability is set to BlockCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.272Require Pin For Pairing is set to Pairing ceremony for new devices will always require a PINCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.299Prevent enabling lock screen slide show is set to EnabledCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.300Config refresh is set to Enabled.Community pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.301Require BitLocker is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.302Require Secure Boot to be enabled on the device is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.303Require code integrity is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.304Firewall is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.305Trusted Platform Module (TPM) is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.306Antivirus is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.307Antispyware is set to RequireCommunity pack · JL.CISW11INT.L1Intune——Medium————CIS Windows 11 Intune L1MP.LPMS.1001Service principals hold only the Microsoft Graph permissions their activity requiresCommunity pack · LPMSEntra ID——Medium————Least Privileged MSGraphMP.LPMS.1004Service principals with Microsoft Graph permissions show activity in the analysis windowCommunity pack · LPMSEntra ID——Medium————Least Privileged MSGraphMP.RKS.IA.1003Windows devices are compliantCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.RKS.IA.1005The primary user of every Windows device is enabledCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.RKS.IA.1007Single-user Autopilot devices are used by one personCommunity pack · RKS.IAIntune——Medium————RKSolutions Intune AnomaliesMP.CLT.ADUA.1002All Active Directory users have a job title.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1003All Active Directory users have a department.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1005All Active Directory users have a company name.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1006All Active Directory users have a complete office address.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1007All Active Directory users have a business phone.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1008All Active Directory users have a mobile phone.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1010All Active Directory users have an office location.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1012Active Directory phone numbers use international E.164 format.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1013Active Directory name, job and location attributes have no stray spaces.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1014Active Directory country values use an approved spelling.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1015Active Directory departments are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1016Active Directory job titles are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1017Active Directory company names are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1018Active Directory street addresses are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1019Active Directory cities are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1020Active Directory states or provinces are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1021Active Directory postal codes are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1022Active Directory business phone numbers are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1023Active Directory user addresses match an approved office location.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1024All Active Directory users have the extension attributes your organisation requires.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.ADUA.1025Active Directory extension attribute values are on the approved list.Community pack · CLT.ADUAActive Directory——Low————AD User AttributesMP.CLT.UA.1003All member users have a job title.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1004All member users have a department.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1007All member users have a company name.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1008All member users have a complete office address.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1011User phone numbers use international E.164 format.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1012User name, job and location attributes have no stray spaces.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1013User country values use an approved spelling.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1014All member users have a business phone.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1015All member users have a mobile phone.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1017All member users have an office location.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1018User departments are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1019User job titles are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1020User company names are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1021User street addresses are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1022User cities are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1023User states or provinces are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1024User postal codes are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1025User business phone numbers are on the approved list.Community pack · CLT.UAEntra ID——Low————User AttributesMP.CLT.UA.1026User addresses match an approved office location.Community pack · CLT.UAEntra ID——Low————User AttributesMP.LPMS.1002All Microsoft Graph activity of service principals matches a known endpointCommunity pack · LPMSEntra ID——Low————Least Privileged MSGraphMP.LPMS.1003Service principals are not throttled at Warning or Critical level by Microsoft GraphCommunity pack · LPMSEntra ID——Low————Least Privileged MSGraphMP.RKS.IA.1004Windows devices have checked in with Intune recentlyCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.RKS.IA.1006Windows devices are registered in Windows AutopilotCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.RKS.IA.1008Settings Catalog policies use no deprecated settingsCommunity pack · RKS.IAIntune——Low————RKSolutions Intune AnomaliesMP.CLT.ADUA.1009All Active Directory users have a fax number.Community pack · CLT.ADUAActive Directory——Info————AD User AttributesMP.CLT.UA.1016All member users have a fax number.Community pack · CLT.UAEntra ID——Info————User AttributesMP.JL.CISW11INT.L1.279Computer Browser (Browser) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.280IIS Admin Service (IISADMIN) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.281Infrared monitor service (irmon) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.282LxssManager (LxssManager) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.283Microsoft FTP Service (FTPSVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.284OpenSSH SSH Server (sshd) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.285Remote Procedure Call (RPC) Locator (RpcLocator) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.286Routing and Remote Access (RemoteAccess) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.287Simple TCP/IP Services (simptcp) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.288Special Administration Console Helper (sacsvr) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.289SSDP Discovery (SSDPSRV) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.290UPnP Device Host (upnphost) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.291Web Management Service (WMSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.292Windows Media Player Network Sharing Service (WMPNetworkSvc) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.293Windows Mobile Hotspot Service (icssvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.294World Wide Web Publishing Service (W3SVC) is set to Disabled or Not InstalledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.295Xbox Accessory Management Service (XboxGipSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.296Xbox Live Auth Manager (XblAuthManager) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.297Xbox Live Game Save (XblGameSave) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.JL.CISW11INT.L1.298Xbox Live Networking Service (XboxNetApiSvc) is set to DisabledCommunity pack · JL.CISW11INT.L1Intune——Info————CIS Windows 11 Intune L1MP.LPMS.1005Least Privileged MSGraph permission analysis reportCommunity pack · LPMSEntra ID——Info————Least Privileged MSGraphNo checks match.