Tests authored
- CIS.M365.1.3.2(L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices
- CIS.M365.4.2(L1) Ensure device enrollment for personally owned devices is blocked by default
- CIS.M365.5.1.3.1(L1) Ensure users cannot create security groups
- CIS.M365.5.1.3.4(L2) Ensure that 'Users can create Microsoft 365 groups in Azure portals, API or PowerShell' is set to 'No'
- CIS.M365.5.1.4.1(L2) Ensure the ability to join devices to Entra is restricted
- CIS.M365.5.1.4.2(L1) Ensure the maximum number of devices per user is limited
- CIS.M365.5.1.4.3(L1) Ensure the GA role is not added as a local administrator during Entra join
- CIS.M365.5.1.4.4(L1) Ensure local administrator assignment is limited during Entra join
- CIS.M365.5.1.4.5(L1) Ensure Local Administrator Password Solution is enabled
- CIS.M365.5.1.5.3(L2) Ensure password addition is blocked for applications
- CIS.M365.5.1.5.4(L1) Ensure password lifetime for applications does not exceed 180 days
- CIS.M365.5.1.5.5(L1) Ensure new application passwords are system-generated
- CIS.M365.5.1.5.6(L1) Ensure maximum certificate lifetime for applications does not exceed 180 days
- CIS.M365.5.1.6.1(L2) Ensure that collaboration invitations are sent to allowed domains only
- CIS.M365.5.1.6.3(L2) Ensure guest user invitations are limited
- CIS.M365.5.1.8.1(L1) Ensure that password hash sync is enabled for hybrid deployments
- CIS.M365.5.2.2.1(L1) Ensure multifactor authentication is enabled for all users in administrative roles
- CIS.M365.5.2.2.2(L1) Ensure multifactor authentication is enabled for all users
- CIS.M365.5.2.2.3(L1) Enable Conditional Access policies to block legacy authentication
- CIS.M365.5.2.2.4(L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users
- CIS.M365.5.2.2.5(L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators
- CIS.M365.5.2.2.6(L1) Enable Identity Protection user risk policies
- CIS.M365.5.2.2.7(L1) Enable Identity Protection sign-in risk policies
- CIS.M365.5.2.2.8(L2) Ensure 'sign-in risk' is blocked for medium and high risk
- CIS.M365.5.2.2.9(L1) Ensure a managed device is required for authentication
- CIS.M365.5.2.2.10(L1) Ensure a managed device is required to register security information
- CIS.M365.5.2.2.11(L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time'
- CIS.M365.5.2.2.12(L1) Ensure the device code sign-in flow is blocked
- CIS.M365.5.2.2.13(L1) Ensure that periodic reauthentication is required for all users
- CIS.M365.5.2.2.14(L2) Ensure trusted 'named locations' are defined
- CIS.M365.5.2.2.15(L2) Ensure exclusionary geographic access controls are utilized
- CIS.M365.5.2.2.16(L2) Ensure Token Protection is enforced for session tokens
- CIS.M365.5.2.2.17(L1) Ensure authentication transfer is blocked
- CIS.M365.5.2.3.1(L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue
- CIS.M365.5.2.3.2(L1) Ensure custom banned passwords lists are used
- CIS.M365.5.2.3.3(L1) Ensure password protection is enabled for on-prem Active Directory
- CIS.M365.5.2.3.4(L1) Ensure all member users are 'MFA capable'
- CIS.M365.5.2.3.6(L1) Ensure system-preferred multifactor authentication is enabled
- CIS.M365.5.2.3.7(L2) Ensure the email OTP authentication method is disabled
- CIS.M365.5.2.3.8(L1) Ensure that Account 'Lockout threshold' is '10' or less
- CIS.M365.5.2.3.9(L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds
- CIS.M365.5.2.3.10(L1) Ensure Microsoft Authenticator on companion applications is disabled
- CIS.M365.5.3.1(L2) Ensure privileged role assignments are activated and not assigned
- CIS.M365.5.3.2(L1) Ensure 'Access reviews' for guest users are configured
- CIS.M365.5.3.3(L1) Ensure 'Access reviews' for privileged roles are configured
- CIS.M365.5.3.4(L1) Ensure approval is required for Global Administrator role activation
- CIS.M365.5.3.5(L1) Ensure approval is required for Privileged Role Administrator activation