Tests authored
- MT.1001At least one Conditional Access policy is configured with device compliance.
- MT.1003At least one Conditional Access policy is configured with All Apps.
- MT.1004At least one Conditional Access policy is configured with All Apps and All Users.
- MT.1034Emergency access users should not be blocked.
- MT.1055Microsoft 365 Group (and Team) creation should be restricted to approved users.
Also contributed to
- CIS.M365.1.3.1(L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'
- CIS.M365.1.3.3(L2) Ensure 'External sharing' of calendars is not available
- CIS.M365.8.1.1(L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services
- CIS.M365.8.2.2(L1) Ensure communication with unmanaged Teams users is disabled
- CIS.M365.8.2.3(L1) Ensure external Teams users cannot initiate conversations
- CIS.M365.8.4.1(L1) Ensure app permission policies are configured
- CIS.M365.8.5.3(L1) Ensure only people in my org can bypass the lobby
- CIS.M365.8.6.1(L1) Ensure users can report security concerns in Teams
- CISA.MS.AAD.1.1Legacy authentication SHALL be blocked.
- CISA.MS.AAD.2.1Users detected as high risk SHALL be blocked.
- CISA.MS.AAD.2.2A notification SHOULD be sent to the administrator when high-risk users are detected.
- CISA.MS.AAD.2.3Sign-ins detected as high risk SHALL be blocked.
- CISA.MS.AAD.5.1Only administrators SHALL be allowed to register applications.
- CISA.MS.AAD.5.2Only administrators SHALL be allowed to consent to applications.
- CISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.
- CISA.MS.AAD.8.1Guest users SHOULD have limited or restricted access to Entra ID directory objects.
- CISA.MS.EXO.1.1Automatic forwarding to external domains SHALL be disabled.
- CISA.MS.EXO.5.1SMTP AUTH SHALL be disabled.
- CISA.MS.EXO.6.1Contact folders SHALL NOT be shared with all domains.
- CISA.MS.EXO.6.2Calendar details SHALL NOT be shared with all domains.
- CISA.MS.EXO.7.1External sender warnings SHALL be implemented.
- CISA.MS.EXO.12.1IP allow lists SHOULD NOT be created.
- CISA.MS.EXO.12.2Safe lists SHOULD NOT be enabled.
- CISA.MS.EXO.13.1Mailbox auditing SHALL be enabled.
- CISA.MS.EXO.17.2Microsoft Purview Audit (Premium) logging SHALL be enabled.
- CISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
- MT.1002App management restrictions on applications and service principals is configured and enabled.
- MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
- MT.1011At least one Conditional Access policy is configured to secure security info registration only from a trusted location.
- MT.1016At least one Conditional Access policy is configured to require MFA for guest access.
- MT.1017At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices.
- MT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.
- MT.1022All users utilizing a P1 license should be licensed.
- MT.1023All users utilizing a P2 license should be licensed.
- MT.1024Entra recommendations should be completed.
- MT.1029Stale accounts are not assigned to privileged roles.
- MT.1030Eligible role assignments on Control Plane are in use by administrators.
- MT.1031Privileged role on Control Plane are managed by PIM only.
- MT.1032Limited number of Global Admins are assigned.
- MT.1037Only users with Presenter role are allowed to present in Teams meetings
- MT.1038Conditional Access policies should not include or exclude deleted groups.
- MT.1042Restrict dial-in users from bypassing a meeting lobby
- MT.1045Only invited users should be automatically admitted to Teams meetings
- MT.1046Restrict anonymous users from joining meetings
- MT.1047Restrict anonymous users from starting Teams meetings
- MT.1048Limit external participants from having control in a Teams meeting
- MT.1049Conditional Access policies for User Risk and Sign-in Risk should be configured separately.
- MT.1050Apps with high-risk permissions having a direct path to Global Administrator
- MT.1051Apps with high-risk permissions having an indirect path to Global Administrator
- MT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.
- MT.1053Ensure intune device clean-up rule is configured
- MT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
- MT.1056Ensure that no person has permanent access to all Azure subscriptions at the root scope
- MT.1058Exchange application access policies must be configured.
- MT.1084Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers.