Tests authored
- CIS.M365.1.3.2(L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices
- CIS.M365.1.3.9(L1) Ensure shared bookings pages are restricted to select users
- CIS.M365.2.1.8(L1) Ensure that SPF records are published for all Exchange Domains
- CIS.M365.2.1.10(L1) Ensure DMARC records for all Exchange Online domains are published
- CIS.M365.2.1.14(L1) Ensure inbound anti-spam policies do not contain allowed domains
- CIS.M365.2.1.15(L1) Ensure outbound anti-spam message limits are in place
- CIS.M365.2.4.1(L1) Ensure Priority account protection is enabled and configured
- CIS.M365.2.4.2(L1) Ensure Priority accounts have 'Strict protection' presets applied
- CIS.M365.3.2.1(L1) Ensure DLP policies are enabled
- CIS.M365.3.2.2(L1) Ensure DLP policies are enabled for Microsoft Teams
- CIS.M365.3.2.3(L1) Ensure DLP policies are published for Copilot users
- CIS.M365.3.3.1(L1) Ensure Information Protection sensitivity label policies are published
- CIS.M365.4.2(L1) Ensure device enrollment for personally owned devices is blocked by default
- CIS.M365.5.1.3.1(L1) Ensure users cannot create security groups
- CIS.M365.5.1.3.4(L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- CIS.M365.5.1.4.1(L2) Ensure the ability to join devices to Entra is restricted
- CIS.M365.5.1.4.2(L1) Ensure the maximum number of devices per user is limited
- CIS.M365.5.1.4.3(L1) Ensure the GA role is not added as a local administrator during Entra join
- CIS.M365.5.1.4.4(L1) Ensure local administrator assignment is limited during Entra join
- CIS.M365.5.1.4.5(L1) Ensure Local Administrator Password Solution is enabled
- CIS.M365.5.1.5.3(L2) Ensure password addition is blocked for applications
- CIS.M365.5.1.5.4(L1) Ensure password lifetime for applications does not exceed 180 days
- CIS.M365.5.1.5.5(L1) Ensure new application passwords are system-generated
- CIS.M365.5.1.5.6(L1) Ensure maximum certificate lifetime for applications does not exceed 180 days
- CIS.M365.5.1.6.1(L2) Ensure that collaboration invitations are sent to allowed domains only
- CIS.M365.5.1.6.3(L2) Ensure guest user invitations are limited
- CIS.M365.5.1.8.1(L1) Ensure that password hash sync is enabled for hybrid deployments
- CIS.M365.5.2.2.1(L1) Ensure multifactor authentication is enabled for all users in administrative roles
- CIS.M365.5.2.2.2(L1) Ensure multifactor authentication is enabled for all users
- CIS.M365.5.2.2.3(L1) Enable Conditional Access policies to block legacy authentication
- CIS.M365.5.2.2.4(L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
- CIS.M365.5.2.2.5(L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators
- CIS.M365.5.2.2.6(L1) Enable Identity Protection user risk policies
- CIS.M365.5.2.2.7(L1) Enable Identity Protection sign-in risk policies
- CIS.M365.5.2.2.8(L2) Ensure 'sign-in risk' is blocked for medium and high risk
- CIS.M365.5.2.2.9(L1) Ensure a managed device is required for authentication
- CIS.M365.5.2.2.10(L1) Ensure a managed device is required to register security information
- CIS.M365.5.2.2.11(L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time'
- CIS.M365.5.2.2.12(L1) Ensure the device code sign-in flow is blocked
- CIS.M365.5.2.2.13(L1) Ensure that periodic reauthentication is required for all users
- CIS.M365.5.2.2.14(L2) Ensure trusted 'named locations' are defined
- CIS.M365.5.2.2.15(L2) Ensure exclusionary geographic access controls are utilized
- CIS.M365.5.2.2.16(L2) Ensure Token Protection is enforced for session tokens
- CIS.M365.5.2.2.17(L1) Ensure authentication transfer is blocked
- CIS.M365.5.2.3.1(L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue
- CIS.M365.5.2.3.2(L1) Ensure custom banned passwords lists are used
- CIS.M365.5.2.3.3(L1) Ensure password protection is enabled for on-prem Active Directory
- CIS.M365.5.2.3.4(L1) Ensure all member users are 'MFA capable'
- CIS.M365.5.2.3.6(L1) Ensure system-preferred multifactor authentication is enabled
- CIS.M365.5.2.3.7(L2) Ensure the email OTP authentication method is disabled
- CIS.M365.5.2.3.8(L1) Ensure that Account 'Lockout threshold' is '10' or less
- CIS.M365.5.2.3.9(L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds
- CIS.M365.5.2.3.10(L1) Ensure Microsoft Authenticator on companion applications is disabled
- CIS.M365.5.3.1(L2) Ensure privileged role assignments are activated and not assigned
- CIS.M365.5.3.2(L1) Ensure 'Access reviews' for guest users are configured
- CIS.M365.5.3.3(L1) Ensure 'Access reviews' for privileged roles are configured
- CIS.M365.5.3.4(L1) Ensure approval is required for Global Administrator role activation
- CIS.M365.5.3.5(L1) Ensure approval is required for Privileged Role Administrator activation
- CIS.M365.6.1.1(L1) Ensure 'AuditDisabled' organizationally is set to 'False'
- CIS.M365.6.1.2(L1) Ensure mailbox audit actions are configured
- CIS.M365.6.1.3(L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes
- CIS.M365.6.2.1(L1) Ensure all forms of mail forwarding are blocked and/or disabled
- CIS.M365.6.2.2(L1) Ensure mail transport rules do not whitelist specific domains
- CIS.M365.6.2.3(L1) Ensure email from external senders is identified
- CIS.M365.6.3.1(L2) Ensure users installing Outlook add-ins is not allowed
- CIS.M365.6.3.2(L1) Ensure the ability to add personal email accounts and calendars is disabled
- CIS.M365.6.5.1(L1) Ensure modern authentication for Exchange Online is enabled
- CIS.M365.6.5.2(L1) Ensure MailTips are enabled for end users
- CIS.M365.6.5.4(L1) Ensure SMTP AUTH is disabled
- CIS.M365.6.5.5(L2) Ensure Direct Send submissions are rejected
- CIS.M365.7.2.1(L1) Ensure modern authentication for SharePoint applications is required
- CIS.M365.7.2.3(L1) Ensure external content sharing is restricted
- CIS.M365.7.2.4(L2) Ensure OneDrive content sharing is restricted
- CIS.M365.7.2.6(L2) Ensure SharePoint external sharing is managed through domain whitelist/blacklists
- CIS.M365.7.2.8(L2) Ensure external sharing is restricted by security group
- CIS.M365.7.2.10(L1) Ensure reauthentication with verification code is restricted
- CIS.M365.8.1.2(L1) Ensure users can't send emails to a channel email address
- CIS.M365.8.2.1(L2) Ensure external domains are restricted in the Teams admin center
- CIS.M365.8.2.4(L1) Ensure the organization cannot communicate with accounts in trial Teams tenants
- CIS.M365.8.5.1(L2) Ensure anonymous users can't join a meeting
- CIS.M365.8.5.2(L1) Ensure anonymous users and dial-in callers can't start a meeting
- CIS.M365.8.5.4(L1) Ensure users dialing in can't bypass the lobby
- CIS.M365.8.5.5(L2) Ensure meeting chat does not allow anonymous users
- CIS.M365.8.5.6(L2) Ensure only organizers and co-organizers can present
- CIS.M365.8.5.7(L1) Ensure external participants can't give or request control
- CIS.M365.8.5.8(L2) Ensure external meeting chat is off
- CIS.M365.8.5.9(L2) Ensure meeting recording is off by default
- CIS.M365.9.1.1(L1) Restrict guest access to Fabric
- CIS.M365.9.1.2(L1) Restrict external guest invitations through Fabric
- CIS.M365.9.1.3(L1) Restrict guest browsing of Fabric content
- CIS.M365.9.1.4(L1) Restrict public publishing of Fabric reports
- CIS.M365.9.1.5(L2) Disable R and Python visuals in Fabric
- CIS.M365.9.1.6(L1) Enable sensitivity labels for Fabric content
- CIS.M365.9.1.7(L1) Restrict organization-wide Fabric links
- CIS.M365.9.1.8(L1) Restrict external sharing of semantic models
- CIS.M365.9.1.9(L1) Block resource-key authentication for Fabric datasets
- CIS.M365.9.1.10(L1) Restrict service principal access to Fabric public APIs
- CIS.M365.9.1.11(L1) Restrict service principal profiles in Fabric
- CIS.M365.9.1.12(L1) Restrict service principal access to Fabric global APIs