Tests authored
- CIS.M365.7.2.2(L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled
- CIS.M365.7.2.5(L2) Ensure that SharePoint guest users cannot share items they don't own
- CIS.M365.7.2.7(L1) Ensure link sharing is restricted in SharePoint and OneDrive
- CIS.M365.7.2.9(L1) Ensure guest access to a site or OneDrive will expire automatically
- CIS.M365.7.2.11(L1) Ensure the SharePoint default sharing link permission is set
- CIS.M365.7.3.1(L2) Ensure Office 365 SharePoint infected files are disallowed for download
- CIS.M365.8.2.3(L1) Ensure external Teams users cannot initiate conversations
- CISA.MS.SHAREPOINT.1.2External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.
- CISA.MS.SHAREPOINT.2.1File and folder default sharing scope SHALL be set to Specific People.
- CISA.MS.SHAREPOINT.2.2File and folder default sharing permissions SHALL be set to View only.
- CISA.MS.SHAREPOINT.3.1Expiration days for Anyone links SHALL be set to 30 days or less.
- CISA.MS.SHAREPOINT.3.2Allowable file and folder permissions for Anyone links SHALL be set to View only.
- CISA.MS.SHAREPOINT.3.3Reauthentication days for people who use a verification code SHALL be set to 30 days or less.
Also contributed to
- CIS.M365.1.2.1(L2) Ensure that only organizationally managed/approved public groups exist
- CIS.M365.1.2.2(L1) Ensure sign-in to shared mailboxes is blocked
- CIS.M365.1.3.4(L1) Ensure 'User owned apps and services' is restricted
- CIS.M365.1.3.5(L1) Ensure internal phishing protection for Forms is enabled
- CIS.M365.1.3.6(L2) Ensure the customer lockbox feature is enabled
- CIS.M365.1.3.7(L2) Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'
- CIS.M365.2.1.1(L2) Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy)
- CIS.M365.2.1.3(L1) Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy)
- CIS.M365.2.1.7(L1) Ensure that an anti-phishing policy has been created (Only Checks Default Policy)
- CIS.M365.2.1.11(L2) Ensure comprehensive attachment filtering is applied
- CIS.M365.4.1(L1) Ensure devices without a compliance policy are marked 'not compliant'
- CIS.M365.5.1.2.2(L1) Ensure users cannot register applications
- CIS.M365.5.1.2.3(L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'
- CIS.M365.5.1.5.1(L2) Ensure user consent to apps accessing company data on their behalf is not allowed
- CIS.M365.5.1.5.2(L1) Ensure the admin consent workflow is enabled
- CIS.M365.5.1.6.2(L1) Ensure that guest user access is restricted
- CIS.M365.5.2.3.5(L1) Ensure weak authentication methods are disabled
- CIS.M365.6.5.3(L2) Ensure additional storage providers are restricted in Outlook on the web
- CIS.M365.8.1.1(L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services
- CIS.M365.8.2.2(L1) Ensure communication with unmanaged Teams users is disabled
- CIS.M365.8.4.1(L1) Ensure app permission policies are configured
- MT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.
- MT.1098Mobile Threat Defense Connectors should be healthy