Services in this catalog
- admincenter - 6 checks
- defender - 15 checks
- defenderidentity - 1 checks
- defenderxdr - 2 checks
- entra - 42 checks
- exchange - 13 checks
- intune - 1 checks
- purview - 1 checks
- sharepoint - 5 checks
- teams - 15 checks
admincenter
6 checks.| Check ID | Title | Severity |
|---|---|---|
admincenter_external_calendar_sharing_disabled | External calendar sharing is disabled at the organization level | MEDIUM |
admincenter_groups_not_public_visibility | Microsoft 365 group has Private visibility | HIGH |
admincenter_organization_customer_lockbox_enabled | Customer Lockbox is enabled at the organization level | HIGH |
admincenter_settings_password_never_expire | Tenant password policy is set to never expire | MEDIUM |
admincenter_users_admins_reduced_license_footprint | Administrative user has no license or an allowed license (AAD_PREMIUM or AAD_PREMIUM_P2) | HIGH |
admincenter_users_between_two_and_four_global_admins | Tenant has between two and four Global Administrators | MEDIUM |
defender
15 checks.| Check ID | Title | Severity |
|---|---|---|
defender_antiphishing_policy_configured | Defender anti-phishing policy active, quarantines spoofed senders and DMARC reject/quarantine failures, honors… | LOW |
defender_antispam_connection_filter_policy_empty_ip_allowlist | Defender Antispam Connection Filter Policy IP Allowlist is empty or undefined | MEDIUM |
defender_antispam_connection_filter_policy_safe_list_off | Defender Antispam Connection Filter Policy has Safe List disabled | MEDIUM |
defender_antispam_outbound_policy_configured | Defender outbound spam policy is configured to notify recipients when senders are blocked or exceed sending li… | LOW |
defender_antispam_outbound_policy_forwarding_disabled | Defender Outbound Spam policy disables mail forwarding | HIGH |
defender_antispam_policy_inbound_no_allowed_domains | Inbound anti-spam policy does not contain allowed domains | LOW |
defender_atp_safe_attachments_and_docs_configured | ATP Safe Attachments policy has Safe Documents enabled and click-through blocked for SharePoint, OneDrive, and… | MEDIUM |
defender_chat_report_policy_configured | Defender report submission policy uses customized addresses for junk, not junk and phish, and chat reports are… | MEDIUM |
defender_domain_dkim_enabled | Exchange Online domain has DKIM enabled | HIGH |
defender_malware_policy_common_attachments_filter_enabled | Defender malware policy has Common Attachment Types Filter enabled | CRITICAL |
defender_malware_policy_comprehensive_attachments_filter_applied | Defender anti-malware policy has Common Attachment Types Filter enabled and blocks all recommended file types | HIGH |
defender_malware_policy_notifications_internal_users_malware_enabled | Defender anti-malware policy has admin notifications enabled for internal users sending malware | MEDIUM |
defender_safe_attachments_policy_enabled | Safe Attachments policy is enabled with secure configuration | MEDIUM |
defender_safelinks_policy_enabled | Safe Links policy is enabled and properly configured in Microsoft Defender for Office 365. | MEDIUM |
defender_zap_for_teams_enabled | Zero-hour auto purge (ZAP) protects Microsoft Teams from malware and phishing | MEDIUM |
defenderidentity
1 checks.| Check ID | Title | Severity |
|---|---|---|
defenderidentity_health_issues_no_open | Defender for Identity has no unresolved health issues affecting hybrid infrastructure monitoring | MEDIUM |
defenderxdr
2 checks.| Check ID | Title | Severity |
|---|---|---|
defenderxdr_critical_asset_management_pending_approvals | Critical asset management classifications are reviewed and approved | MEDIUM |
defenderxdr_endpoint_privileged_user_exposed_credentials | Privileged users do not have credentials exposed on vulnerable endpoints | CRITICAL |
entra
42 checks.| Check ID | Title | Severity |
|---|---|---|
entra_admin_consent_workflow_enabled | Admin consent workflow is enabled | HIGH |
entra_admin_portals_access_restriction | Admin portals are accessible only to administrative roles | MEDIUM |
entra_admin_users_cloud_only | All users with administrative roles are cloud-only accounts | HIGH |
entra_admin_users_mfa_enabled | Users in administrative roles require multifactor authentication via a Conditional Access policy for all appli… | HIGH |
entra_admin_users_phishing_resistant_mfa_enabled | At least one Conditional Access policy requires phishing-resistant MFA strength for administrator roles | HIGH |
entra_admin_users_sign_in_frequency_enabled | Admin users have sign-in frequency enforced by Conditional Access at or below the recommended interval | HIGH |
entra_all_apps_conditional_access_coverage | Conditional Access policy ensures comprehensive coverage for all cloud apps | MEDIUM |
entra_app_registration_no_unused_privileged_permissions | App registration has no unused privileged API permissions | MEDIUM |
entra_authentication_method_sms_voice_disabled | SMS and Voice authentication methods are disabled in the tenant | MEDIUM |
entra_break_glass_account_fido2_security_key_registered | Break glass account has a FIDO2 security key registered for phishing-resistant authentication | CRITICAL |
entra_conditional_access_policy_all_apps_all_users | Conditional Access policy covers all cloud apps and all users | LOW |
entra_conditional_access_policy_app_enforced_restrictions | Conditional Access policy enforces application restrictions for unmanaged devices | MEDIUM |
entra_conditional_access_policy_approved_client_app_required_for_mobile | Conditional Access policy enforces approved client apps or app protection for mobile devices | MEDIUM |
entra_conditional_access_policy_block_elevated_insider_risk | Conditional Access Policy blocks access for users with elevated insider risk | MEDIUM |
entra_conditional_access_policy_block_o365_elevated_insider_risk | Conditional Access policy blocks Office 365 access for users with elevated insider risk | MEDIUM |
entra_conditional_access_policy_block_unknown_device_platforms | Conditional Access policy blocks access from unknown or unsupported device platforms | MEDIUM |
entra_conditional_access_policy_compliant_device_hybrid_joined_device_mfa_required | Conditional Access requires compliant device OR hybrid joined device OR MFA for admins or all users | HIGH |
entra_conditional_access_policy_corporate_device_sign_in_frequency_enforced | Conditional Access policy enforces sign-in frequency for non-corporate devices | MEDIUM |
entra_conditional_access_policy_device_code_flow_blocked | Conditional Access policy blocks device code flow to prevent phishing attacks | HIGH |
entra_conditional_access_policy_device_registration_mfa_required | Conditional Access policies enforce MFA for device registration | HIGH |
entra_conditional_access_policy_directory_sync_account_excluded | Conditional Access policy excludes Directory Synchronization Accounts to protect Entra Connect sync | MEDIUM |
entra_conditional_access_policy_mdm_compliant_device_required | Conditional Access policy requires an MDM-compliant device for all cloud app access | HIGH |
entra_conditional_access_policy_mfa_enforced_for_guest_users | Conditional Access Policy enforces MFA for guest and external users | HIGH |
entra_conditional_access_policy_require_mfa_for_management_api | Conditional Access Policy enforces MFA for Azure Management API access | HIGH |
entra_default_app_management_policy_enabled | Default app management policy enforces credential restrictions on applications and service principals | MEDIUM |
entra_dynamic_group_for_guests_created | A dynamic membership group for guest users exists | LOW |
entra_emergency_access_exclusion | Emergency access exclusions prevent lockout from Conditional Access policies | HIGH |
entra_identity_protection_sign_in_risk_enabled | At least one Conditional Access Identity Protection sign-in risk policy protects against high and medium risk… | HIGH |
entra_identity_protection_user_risk_enabled | At least one Conditional Access policy enforces Identity Protection user risk for high-risk users | HIGH |
entra_intune_enrollment_sign_in_frequency_every_time | Conditional Access requires strong authentication and Every Time sign-in frequency for Intune Enrollment | HIGH |
entra_legacy_authentication_blocked | At least one Conditional Access policy blocks legacy authentication | CRITICAL |
entra_managed_device_required_for_authentication | Conditional Access policies require authentication from a managed device for all users and applications | HIGH |
entra_managed_device_required_for_mfa_registration | Tenant has a Conditional Access policy that requires a managed device for MFA registration for all users | HIGH |
entra_password_hash_sync_enabled | Organization has password hash synchronization enabled for hybrid deployments | MEDIUM |
entra_policy_ensure_default_user_cannot_create_tenants | Tenant restricts non-admin users from creating tenants | MEDIUM |
entra_policy_guest_invite_only_for_admin_roles | Tenant guest invitations are restricted to specific admin roles or disabled | HIGH |
entra_policy_guest_users_access_restrictions | Authorization policy restricts guest user access to properties and memberships of their own directory objects | MEDIUM |
entra_policy_restricts_user_consent_for_apps | User consent for applications is set to ‘Do not allow user consent’ | HIGH |
entra_seamless_sso_disabled | Hybrid deployment does not have Seamless SSO enabled | MEDIUM |
entra_thirdparty_integrated_apps_not_allowed | Authorization policy disallows app creation by non-admin users | HIGH |
entra_users_mfa_capable | User is MFA capable | HIGH |
entra_users_mfa_enabled | Multifactor authentication is enforced for all users | CRITICAL |
exchange
13 checks.| Check ID | Title | Severity |
|---|---|---|
exchange_external_email_tagging_enabled | Identity has external sender tagging enabled | MEDIUM |
exchange_mailbox_audit_bypass_disabled | Mailbox has AuditBypassEnabled disabled | HIGH |
exchange_mailbox_policy_additional_storage_restricted | Mailbox policy has additional storage providers disabled | HIGH |
exchange_organization_delicensing_resiliency_enabled | Delicensing Resiliency protects Exchange Online mailboxes from immediate access loss during license changes | MEDIUM |
exchange_organization_mailbox_auditing_enabled | Organization has mailbox auditing enabled | HIGH |
exchange_organization_mailtips_enabled | Organization has MailTips fully enabled | MEDIUM |
exchange_organization_modern_authentication_enabled | Organization has Modern Authentication enabled | CRITICAL |
exchange_roles_assignment_policy_addins_disabled | Role assignment policy does not allow Outlook add-ins | HIGH |
exchange_shared_mailbox_sign_in_disabled | Shared mailbox has sign-in blocked | MEDIUM |
exchange_transport_config_smtp_auth_disabled | SMTP AUTH is disabled in the Exchange Online Transport Configuration | HIGH |
exchange_transport_rules_mail_forwarding_disabled | Transport rule does not allow forwarding mail to external domains | HIGH |
exchange_transport_rules_whitelist_disabled | Transport rule does not whitelist any domains | HIGH |
exchange_user_mailbox_auditing_enabled | User mailbox auditing is enabled with required Admin, Delegate, and Owner actions and audit log age meets the… | HIGH |
intune
1 checks.| Check ID | Title | Severity |
|---|---|---|
intune_device_compliance_policy_unassigned_devices_not_compliant_by_default | Built-in Device Compliance Policy marks devices without an assigned compliance policy as Not compliant by defa… | HIGH |
purview
1 checks.| Check ID | Title | Severity |
|---|---|---|
purview_audit_log_search_enabled | Purview audit log search is enabled | CRITICAL |
sharepoint
5 checks.| Check ID | Title | Severity |
|---|---|---|
sharepoint_external_sharing_managed | External sharing is restricted using a non-empty domain allowlist or blocklist | HIGH |
sharepoint_external_sharing_restricted | Organization external sharing is set to Existing guests only, New and existing guests, or Disabled | HIGH |
sharepoint_guest_sharing_restricted | Guest users cannot share items they do not own | HIGH |
sharepoint_modern_authentication_required | Requires modern authentication for applications | HIGH |
sharepoint_onedrive_sync_restricted_unmanaged_devices | OneDrive sync from unmanaged devices is blocked | HIGH |
teams
15 checks.| Check ID | Title | Severity |
|---|---|---|
teams_email_sending_to_channel_disabled | Email to Teams channel addresses is disabled | HIGH |
teams_external_domains_restricted | External domain access is disabled for Teams users | HIGH |
teams_external_file_sharing_restricted | External file sharing is restricted to only approved cloud storage services | HIGH |
teams_external_users_cannot_start_conversations | Users cannot start conversations with unmanaged accounts | CRITICAL |
teams_meeting_anonymous_user_join_disabled | Anonymous users cannot join Teams meetings | CRITICAL |
teams_meeting_anonymous_user_start_disabled | Anonymous users cannot start Teams meetings | HIGH |
teams_meeting_chat_anonymous_users_disabled | Meetings global policy does not allow anonymous users in meeting chat | HIGH |
teams_meeting_dial_in_lobby_bypass_disabled | Meetings global policy does not allow dial-in users to bypass the lobby | HIGH |
teams_meeting_external_chat_disabled | Meeting chat for untrusted organizations is disabled | HIGH |
teams_meeting_external_control_disabled | Meetings global policy prevents external participants from giving or requesting control | HIGH |
teams_meeting_external_lobby_bypass_disabled | Meetings global policy allows only people in the organization to bypass the lobby | CRITICAL |
teams_meeting_presenters_restricted | Meetings org-wide default policy allows only organizers and co-organizers to present | MEDIUM |
teams_meeting_recording_disabled | Meetings global (Org-wide default) policy has meeting recording disabled by default | MEDIUM |
teams_security_reporting_enabled | Messaging policy has security reporting enabled | MEDIUM |
teams_unmanaged_communication_disabled | Users cannot communicate with unmanaged users | HIGH |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.