Jean-Philippe George
🏢 SodixCH
Also contributed to
- CIS.M365.2.1.9(L1) Ensure that DKIM is enabled for all Exchange Online Domains
- CISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
- CISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.
- CISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.
- CISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.
- CISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.
- CISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.
- CISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.
- CISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.
- CISA.MS.EXO.10.1Emails SHALL be scanned for malware.
- CISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.
- CISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.
- MT.1074Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain
- MT.1106Catalog resources must have valid roles (no stale / removed app roles or SPNs).
- MT.1107Access packages and catalogs should not reference deleted groups.
- MT.1108Access packages should not reference inactive or orphaned assignment policies.
- MT.1109Access package approval workflows must have valid approvers.
- MT.1110No catalog should contain resources without any associated access packages.