Tests authored
- EIDSCA.AF01Authentication Method - FIDO2 security key - State.
- EIDSCA.AF02Authentication Method - FIDO2 security key - Allow self-service set up.
- EIDSCA.AF03Authentication Method - FIDO2 security key - Enforce attestation.
- EIDSCA.AF04Authentication Method - FIDO2 security key - Enforce key restrictions.
- EIDSCA.AF05Authentication Method - FIDO2 security key - Restricted.
- EIDSCA.AF06Authentication Method - FIDO2 security key - Restrict specific keys.
- EIDSCA.AG01Authentication Method - General Settings - Manage migration.
- EIDSCA.AG02Authentication Method - General Settings - Report suspicious activity - State.
- EIDSCA.AG03Authentication Method - General Settings - Report suspicious activity - Included users/groups.
- EIDSCA.AM01Authentication Method - Microsoft Authenticator - State.
- EIDSCA.AM02Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.
- EIDSCA.AM03Authentication Method - Microsoft Authenticator - Require number matching for push notifications.
- EIDSCA.AM04Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.
- EIDSCA.AM06Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.
- EIDSCA.AM07Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications.
- EIDSCA.AM09Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.
- EIDSCA.AM10Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications.
- EIDSCA.AP01Default Authorization Settings - Enabled Self service password reset for administrators.
- EIDSCA.AP04Default Authorization Settings - Guest invite restrictions.
- EIDSCA.AP05Default Authorization Settings - Sign-up for email based subscription.
- EIDSCA.AP06Default Authorization Settings - User can join the tenant by email validation.
- EIDSCA.AP07Default Authorization Settings - Guest user access.
- EIDSCA.AP08Default Authorization Settings - User consent assignments match the restricted or Microsoft recommended baseline.
- EIDSCA.AP09Default Authorization Settings - Allow user consent on risk-based apps.
- EIDSCA.AP10Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.
- EIDSCA.AP12Default Authorization Settings - Default User Role Permissions - Allowed to create Tenants.
- EIDSCA.AP14Default Authorization Settings - Default User Role Permissions - Allowed to read other users.
- EIDSCA.AP15Default Authorization Settings - Default User Role Permissions - Allowed to create agent identity blueprints.
- EIDSCA.AS04Authentication Method - SMS - Use for sign-in.
- EIDSCA.AT01Authentication Method - Temporary Access Pass - State.
- EIDSCA.AT02Authentication Method - Temporary Access Pass - One-time.
- EIDSCA.AV01Authentication Method - Voice call - State.
- EIDSCA.CP01Default Settings - Consent Policy Settings - Group owner consent for apps accessing data.
- EIDSCA.CP03Default Settings - Consent Policy Settings - Block user consent for risky apps.
- EIDSCA.CP04Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to.
- EIDSCA.CR01Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature.
- EIDSCA.CR02Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests.
- EIDSCA.CR03Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire.
- EIDSCA.CR04Consent Framework - Admin Consent Request - Consent request duration (days).
- EIDSCA.CR05Consent Framework - Admin Consent Request - Admin consent reviewers have valid query scopes.
- EIDSCA.PR01Default Settings - Password Rule Settings - Password Protection - Mode.
- EIDSCA.PR02Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.
- EIDSCA.PR03Default Settings - Password Rule Settings - Enforce custom list.
- EIDSCA.PR05Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.
- EIDSCA.PR06Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.
- EIDSCA.ST08Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.
- EIDSCA.ST09Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content.
- MT.1025No external user with permanent role assignment on Control Plane.
- MT.1026No hybrid user with permanent role assignment on Control Plane.
- MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.
- MT.1028No user with mailbox and permanent role assignment on Control Plane.
- MT.1029Stale accounts are not assigned to privileged roles.
- MT.1030Eligible role assignments on Control Plane are in use by administrators.
- MT.1031Privileged role on Control Plane are managed by PIM only.
- MT.1032Limited number of Global Admins are assigned.
- MT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.
- MT.1038Conditional Access policies should not include or exclude deleted groups.
- MT.1059Microsoft Defender for Identity health issues should be resolved
- MT.1077App registrations with privileged API permissions should not have owners.
- MT.1078App registrations with highly privileged directory roles should not have owners.
- MT.1079Privileged API permissions on service principals should not remain unused.
- MT.1080Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints.
- MT.1081Hybrid users should not be assigned Entra ID role assignments.
- MT.1085Pending approvals for Critical Asset Management should not be present.
- MT.1111High privileged user should be linked to an identity.
- MT.1112Privileged user accounts should not remain enabled when the linked primary account is disabled.