Tests authored
Also contributed to
- CIS.M365.1.3.6(L2) Ensure the customer lockbox feature is enabled
- CISA.MS.AAD.5.4Group owners SHALL NOT be allowed to consent to applications.
- CISA.MS.EXO.2.1A list of approved IP addresses for sending mail SHALL be maintained.
- CISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.
- CISA.MS.SHAREPOINT.1.1External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.
- CISA.MS.SHAREPOINT.1.3External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.
- MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
- MT.1006At least one Conditional Access policy is configured to require MFA for admins.
- MT.1007At least one Conditional Access policy is configured to require MFA for all users.
- MT.1008At least one Conditional Access policy is configured to require MFA for Azure management.
- MT.1016At least one Conditional Access policy is configured to require MFA for guest access.
- MT.1020All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them.
- MT.1024Entra recommendations should be completed.
- MT.1058Exchange application access policies must be configured.
- MT.1059Microsoft Defender for Identity health issues should be resolved
- MT.1076MOERA SHOULD NOT be used for sent mail
- MT.1087Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.
- MT.1088Devices with critical credentials should be protected by TPM.
- MT.1089Devices with critical credentials should be protected by Credential Guard.
- MT.1100Intune Diagnostic Settings should include Audit Logs