CIS Benchmark Tests
These tests verify tenant and organization configuration against CIS Benchmark recommendations.
Tests
| Test ID | Title | Severity | Product | Feature |
|---|---|---|---|---|
| CIS.GH.1.2.2 | (L1) Ensure repository creation is limited to specific members | Medium | GitHub | Organization settings |
| CIS.GH.1.2.3 | (L1) Ensure repository deletion is limited to specific users | High | GitHub | Organization settings |
| CIS.GH.1.2.4 | (L1) Ensure issue deletion is limited to specific users | Medium | GitHub | Organization settings |
| CIS.GH.1.3.2 | (L1) Ensure team creation is limited to specific members | Medium | GitHub | Organization settings |
| CIS.GH.1.3.8 | (L1) Ensure strict base permissions are set for repositories | High | GitHub | Organization settings |
| CIS.M365.1.1.1 | (L1) Ensure Administrative accounts are cloud-only | High | Microsoft 365 | Administrative accounts |
| CIS.M365.1.1.3 | (L1) Ensure that between two and four global admins are designated | High | Microsoft 365 | Administrative accounts |
| CIS.M365.1.2.1 | (L2) Ensure that only organizationally managed/approved public groups exist | Medium | Microsoft 365 | Teams and groups |
| CIS.M365.1.2.2 | (L1) Ensure sign-in to shared mailboxes is blocked | Medium | Microsoft 365 | Teams and groups |
| CIS.M365.1.3.1 | (L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.2 | (L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.3 | (L2) Ensure 'External sharing' of calendars is not available | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.4 | (L1) Ensure 'User owned apps and services' is restricted | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.5 | (L1) Ensure internal phishing protection for Forms is enabled | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.6 | (L2) Ensure the customer lockbox feature is enabled | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.7 | (L2) Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web' | Medium | Microsoft 365 | Organization settings |
| CIS.M365.1.3.9 | (L1) Ensure shared bookings pages are restricted to select users | Low | Microsoft 365 | Organization settings |
| CIS.M365.2.1.1 | (L2) Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) | Medium | Defender | Safe Links |
| CIS.M365.2.1.2 | (L1) Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Medium | Defender | Anti-malware |
| CIS.M365.2.1.3 | (L1) Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Medium | Defender | Anti-malware |
| CIS.M365.2.1.4 | (L2) Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | High | Defender | Safe Attachments |
| CIS.M365.2.1.5 | (L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Medium | Defender | Safe Attachments |
| CIS.M365.2.1.6 | (L1) Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Medium | Defender | Anti-spam |
| CIS.M365.2.1.7 | (L1) Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Medium | Defender | Anti-phishing |
| CIS.M365.2.1.8 | (L1) Ensure that SPF records are published for all Exchange Domains | Medium | Defender | Email authentication |
| CIS.M365.2.1.9 | (L1) Ensure that DKIM is enabled for all Exchange Online Domains | Medium | Defender | Email authentication |
| CIS.M365.2.1.10 | (L1) Ensure DMARC records for all Exchange Online domains are published | Medium | Defender | Email authentication |
| CIS.M365.2.1.11 | (L2) Ensure comprehensive attachment filtering is applied | Medium | Defender | Anti-malware |
| CIS.M365.2.1.12 | (L1) Ensure the connection filter IP allow list is not used (Only Checks Default Policy) | Medium | Defender | Anti-spam |
| CIS.M365.2.1.13 | (L1) Ensure the connection filter safe list is off (Only Checks Default Policy) | Medium | Defender | Anti-spam |
| CIS.M365.2.1.14 | (L1) Ensure inbound anti-spam policies do not contain allowed domains | High | Defender | Anti-spam |
| CIS.M365.2.1.15 | (L1) Ensure outbound anti-spam message limits are in place | Medium | Defender | Anti-spam |
| CIS.M365.2.4.1 | (L1) Ensure Priority account protection is enabled and configured | Medium | Defender | Tenant settings |
| CIS.M365.2.4.2 | (L1) Ensure Priority accounts have 'Strict protection' presets applied | Medium | Defender | Tenant settings |
| CIS.M365.2.4.4 | (L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled) | Medium | Defender | Zero-hour auto purge |
| CIS.M365.3.1.1 | (L1) Ensure Microsoft 365 audit log search is Enabled | High | Purview | Audit |
| CIS.M365.3.2.1 | (L1) Ensure DLP policies are enabled | Medium | Purview | Data loss prevention |
| CIS.M365.3.2.2 | (L1) Ensure DLP policies are enabled for Microsoft Teams | Medium | Purview | Data loss prevention |
| CIS.M365.3.2.3 | (L1) Ensure DLP policies are published for Copilot users | Medium | Purview | Data loss prevention |
| CIS.M365.3.3.1 | (L1) Ensure Information Protection sensitivity label policies are published | Low | Purview | Information protection |
| CIS.M365.4.1 | (L1) Ensure devices without a compliance policy are marked 'not compliant' | Medium | Intune | Device compliance |
| CIS.M365.4.2 | (L1) Ensure device enrollment for personally owned devices is blocked by default | Medium | Intune | Device enrollment |
| CIS.M365.5.1.2.2 | (L1) Ensure users cannot register applications | Medium | Entra ID | User and directory settings |
| CIS.M365.5.1.2.3 | (L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' | Medium | Entra ID | User and directory settings |
| CIS.M365.5.1.3.1 | (L1) Ensure users cannot create security groups | Low | Entra ID | Groups |
| CIS.M365.5.1.3.4 | (L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No' | Low | Entra ID | Groups |
| CIS.M365.5.1.4.1 | (L2) Ensure the ability to join devices to Entra is restricted | Medium | Entra ID | Device identity |
| CIS.M365.5.1.4.2 | (L1) Ensure the maximum number of devices per user is limited | Low | Entra ID | Device identity |
| CIS.M365.5.1.4.3 | (L1) Ensure the GA role is not added as a local administrator during Entra join | Medium | Entra ID | Device identity |
| CIS.M365.5.1.4.4 | (L1) Ensure local administrator assignment is limited during Entra join | Medium | Entra ID | Device identity |
| CIS.M365.5.1.4.5 | (L1) Ensure Local Administrator Password Solution is enabled | Medium | Entra ID | Device identity |
| CIS.M365.5.1.4.6 | (L2) Ensure users are restricted from recovering BitLocker keys | Medium | Entra ID | Device identity |
| CIS.M365.5.1.5.1 | (L2) Ensure user consent to apps accessing company data on their behalf is not allowed | High | Entra ID | App consent and permissions |
| CIS.M365.5.1.5.2 | (L1) Ensure the admin consent workflow is enabled | High | Entra ID | App consent and permissions |
| CIS.M365.5.1.5.3 | (L2) Ensure password addition is blocked for applications | Medium | Entra ID | Applications |
| CIS.M365.5.1.5.4 | (L1) Ensure password lifetime for applications does not exceed 180 days | Medium | Entra ID | Applications |
| CIS.M365.5.1.5.5 | (L1) Ensure new application passwords are system-generated | Medium | Entra ID | Applications |
| CIS.M365.5.1.5.6 | (L1) Ensure maximum certificate lifetime for applications does not exceed 180 days | Medium | Entra ID | Applications |
| CIS.M365.5.1.6.1 | (L2) Ensure that collaboration invitations are sent to allowed domains only | Medium | Entra ID | External identities |
| CIS.M365.5.1.6.2 | (L1) Ensure that guest user access is restricted | Medium | Entra ID | External identities |
| CIS.M365.5.1.6.3 | (L2) Ensure guest user invitations are limited | Medium | Entra ID | External identities |
| CIS.M365.5.1.8.1 | (L1) Ensure that password hash sync is enabled for hybrid deployments | Medium | Entra ID | Hybrid identity |
| CIS.M365.5.2.2.1 | (L1) Ensure multifactor authentication is enabled for all users in administrative roles | High | Entra ID | Conditional Access |
| CIS.M365.5.2.2.2 | (L1) Ensure multifactor authentication is enabled for all users | High | Entra ID | Conditional Access |
| CIS.M365.5.2.2.3 | (L1) Enable Conditional Access policies to block legacy authentication | High | Entra ID | Conditional Access |
| CIS.M365.5.2.2.4 | (L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.5 | (L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators | High | Entra ID | Conditional Access |
| CIS.M365.5.2.2.6 | (L1) Enable Identity Protection user risk policies | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.7 | (L1) Enable Identity Protection sign-in risk policies | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.8 | (L2) Ensure 'sign-in risk' is blocked for medium and high risk | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.9 | (L1) Ensure a managed device is required for authentication | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.10 | (L1) Ensure a managed device is required to register security information | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.11 | (L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time' | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.12 | (L1) Ensure the device code sign-in flow is blocked | High | Entra ID | Conditional Access |
| CIS.M365.5.2.2.13 | (L1) Ensure that periodic reauthentication is required for all users | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.14 | (L2) Ensure trusted 'named locations' are defined | Low | Entra ID | Conditional Access |
| CIS.M365.5.2.2.15 | (L2) Ensure exclusionary geographic access controls are utilized | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.16 | (L2) Ensure Token Protection is enforced for session tokens | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.2.17 | (L1) Ensure authentication transfer is blocked | Medium | Entra ID | Conditional Access |
| CIS.M365.5.2.3.1 | (L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue | Medium | Entra ID | Authentication methods |
| CIS.M365.5.2.3.2 | (L1) Ensure custom banned passwords lists are used | Medium | Entra ID | Password protection |
| CIS.M365.5.2.3.3 | (L1) Ensure password protection is enabled for on-prem Active Directory | Medium | Entra ID | Password protection |
| CIS.M365.5.2.3.4 | (L1) Ensure all member users are 'MFA capable' | High | Entra ID | Authentication methods |
| CIS.M365.5.2.3.5 | (L1) Ensure weak authentication methods are disabled | High | Entra ID | Authentication methods |
| CIS.M365.5.2.3.6 | (L1) Ensure system-preferred multifactor authentication is enabled | Low | Entra ID | Authentication methods |
| CIS.M365.5.2.3.7 | (L2) Ensure the email OTP authentication method is disabled | Medium | Entra ID | Authentication methods |
| CIS.M365.5.2.3.8 | (L1) Ensure that Account 'Lockout threshold' is '10' or less | Medium | Entra ID | Password protection |
| CIS.M365.5.2.3.9 | (L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds | Medium | Entra ID | Password protection |
| CIS.M365.5.2.3.10 | (L1) Ensure Microsoft Authenticator on companion applications is disabled | Low | Entra ID | Authentication methods |
| CIS.M365.5.3.1 | (L2) Ensure privileged role assignments are activated and not assigned | High | Entra ID | Privileged Identity Management |
| CIS.M365.5.3.2 | (L1) Ensure 'Access reviews' for guest users are configured | Medium | Entra ID | Identity Governance |
| CIS.M365.5.3.3 | (L1) Ensure 'Access reviews' for privileged roles are configured | Medium | Entra ID | Identity Governance |
| CIS.M365.5.3.4 | (L1) Ensure approval is required for Global Administrator role activation | Medium | Entra ID | Privileged Identity Management |
| CIS.M365.5.3.5 | (L1) Ensure approval is required for Privileged Role Administrator activation | Medium | Entra ID | Privileged Identity Management |
| CIS.M365.6.1.1 | (L1) Ensure 'AuditDisabled' organizationally is set to 'False' | High | Exchange Online | Mailbox auditing |
| CIS.M365.6.1.2 | (L1) Ensure mailbox audit actions are configured | Medium | Exchange Online | Mailbox auditing |
| CIS.M365.6.1.3 | (L1) Ensure 'AuditBypassEnabled' is not enabled on mailboxes | Medium | Exchange Online | Mailbox auditing |
| CIS.M365.6.2.1 | (L1) Ensure all forms of mail forwarding are blocked and/or disabled | High | Exchange Online | Mail flow |
| CIS.M365.6.2.2 | (L1) Ensure mail transport rules do not whitelist specific domains | Medium | Exchange Online | Mail flow |
| CIS.M365.6.2.3 | (L1) Ensure email from external senders is identified | Medium | Exchange Online | Outlook |
| CIS.M365.6.3.1 | (L2) Ensure users installing Outlook add-ins is not allowed | Medium | Exchange Online | Outlook |
| CIS.M365.6.3.2 | (L1) Ensure the ability to add personal email accounts and calendars is disabled | Low | Exchange Online | Outlook |
| CIS.M365.6.5.1 | (L1) Ensure modern authentication for Exchange Online is enabled | Low | Exchange Online | Client access |
| CIS.M365.6.5.2 | (L1) Ensure MailTips are enabled for end users | Low | Exchange Online | Outlook |
| CIS.M365.6.5.3 | (L2) Ensure additional storage providers are restricted in Outlook on the web | Medium | Exchange Online | Outlook |
| CIS.M365.6.5.4 | (L1) Ensure SMTP AUTH is disabled | High | Exchange Online | Client access |
| CIS.M365.6.5.5 | (L2) Ensure Direct Send submissions are rejected | Medium | Exchange Online | Mail flow |
| CIS.M365.7.2.1 | (L1) Ensure modern authentication for SharePoint applications is required | Medium | SharePoint | Access control |
| CIS.M365.7.2.2 | (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled | Medium | SharePoint | External sharing |
| CIS.M365.7.2.3 | (L1) Ensure external content sharing is restricted | Medium | SharePoint | External sharing |
| CIS.M365.7.2.4 | (L2) Ensure OneDrive content sharing is restricted | Medium | SharePoint | External sharing |
| CIS.M365.7.2.5 | (L2) Ensure that SharePoint guest users cannot share items they don't own | Medium | SharePoint | External sharing |
| CIS.M365.7.2.6 | (L2) Ensure SharePoint external sharing is managed through domain whitelist/blacklists | Medium | SharePoint | External sharing |
| CIS.M365.7.2.7 | (L1) Ensure link sharing is restricted in SharePoint and OneDrive | Medium | SharePoint | Sharing links |
| CIS.M365.7.2.8 | (L2) Ensure external sharing is restricted by security group | Medium | SharePoint | External sharing |
| CIS.M365.7.2.9 | (L1) Ensure guest access to a site or OneDrive will expire automatically | Medium | SharePoint | External sharing |
| CIS.M365.7.2.10 | (L1) Ensure reauthentication with verification code is restricted | Medium | SharePoint | External sharing |
| CIS.M365.7.2.11 | (L1) Ensure the SharePoint default sharing link permission is set | Medium | SharePoint | Sharing links |
| CIS.M365.7.3.1 | (L2) Ensure Office 365 SharePoint infected files are disallowed for download | Medium | SharePoint | Access control |
| CIS.M365.8.1.1 | (L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services | Medium | Teams | File sharing |
| CIS.M365.8.1.2 | (L1) Ensure users can't send emails to a channel email address | Medium | Teams | Messaging |
| CIS.M365.8.2.1 | (L2) Ensure external domains are restricted in the Teams admin center | Medium | Teams | External access |
| CIS.M365.8.2.2 | (L1) Ensure communication with unmanaged Teams users is disabled | Medium | Teams | External access |
| CIS.M365.8.2.3 | (L1) Ensure external Teams users cannot initiate conversations | Medium | Teams | External access |
| CIS.M365.8.2.4 | (L1) Ensure the organization cannot communicate with accounts in trial Teams tenants | Medium | Teams | External access |
| CIS.M365.8.4.1 | (L1) Ensure app permission policies are configured | Medium | Teams | Apps |
| CIS.M365.8.5.1 | (L2) Ensure anonymous users can't join a meeting | Medium | Teams | Meetings |
| CIS.M365.8.5.2 | (L1) Ensure anonymous users and dial-in callers can't start a meeting | Medium | Teams | Meetings |
| CIS.M365.8.5.3 | (L1) Ensure only people in my org can bypass the lobby | Medium | Teams | Meetings |
| CIS.M365.8.5.4 | (L1) Ensure users dialing in can't bypass the lobby | Medium | Teams | Meetings |
| CIS.M365.8.5.5 | (L2) Ensure meeting chat does not allow anonymous users | Medium | Teams | Meetings |
| CIS.M365.8.5.6 | (L2) Ensure only organizers and co-organizers can present | Low | Teams | Meetings |
| CIS.M365.8.5.7 | (L1) Ensure external participants can't give or request control | Medium | Teams | Meetings |
| CIS.M365.8.5.8 | (L2) Ensure external meeting chat is off | Medium | Teams | Meetings |
| CIS.M365.8.5.9 | (L2) Ensure meeting recording is off by default | Low | Teams | Meetings |
| CIS.M365.8.6.1 | (L1) Ensure users can report security concerns in Teams | Medium | Teams | Messaging |
| CIS.M365.9.1.1 | (L1) Restrict guest access to Fabric | Medium | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.2 | (L1) Restrict external guest invitations through Fabric | Medium | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.3 | (L1) Restrict guest browsing of Fabric content | Low | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.4 | (L1) Restrict public publishing of Fabric reports | Medium | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.5 | (L2) Disable R and Python visuals in Fabric | Medium | Microsoft Fabric | Tenant settings |
| CIS.M365.9.1.6 | (L1) Enable sensitivity labels for Fabric content | Medium | Microsoft Fabric | Information protection |
| CIS.M365.9.1.7 | (L1) Restrict organization-wide Fabric links | Low | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.8 | (L1) Restrict external sharing of semantic models | Medium | Microsoft Fabric | Export and sharing settings |
| CIS.M365.9.1.9 | (L1) Block resource-key authentication for Fabric datasets | Medium | Microsoft Fabric | Developer settings |
| CIS.M365.9.1.10 | (L1) Restrict service principal access to Fabric public APIs | Medium | Microsoft Fabric | Developer settings |
| CIS.M365.9.1.11 | (L1) Restrict service principal profiles in Fabric | Medium | Microsoft Fabric | Developer settings |
| CIS.M365.9.1.12 | (L1) Restrict service principal access to Fabric global APIs | Medium | Microsoft Fabric | Developer settings |