Checks

The Strict Preset Security Policy applies Microsoft's recommended strict protection settings and should be enabled for both Exchange Online Protection (anti-phishing, anti-spam, anti-malware) and Defender for Office 365 (Safe Attachments, Safe Links). The rules are exposed via Get-EOPProtectionPolicyRule and Get-ATPProtectionPolicyRule.

Microsoft Defender XDR critical asset management classifications with a lower classification confidence score must be approved by a security administrator.

Asset classifications that have not yet been reviewed and approved may result in incomplete critical asset visibility.

Microsoft Defender XDR's Security Exposure Management detects when credentials from users with Entra ID privileged roles are present on vulnerable devices. Privileged users may have authentication artifacts (CLI secrets, cookies, tokens) exposed on endpoints with high risk scores.

Microsoft Defender for Office 365 Zero-hour auto purge (ZAP) is a protection feature that retroactively detects and neutralizes malware and high confidence phishing in Teams messages.

When ZAP blocks a message, it is blocked for everyone in the chat. The initial block happens right after delivery, but ZAP can occur up to 48 hours after delivery.

An access review scoped to guest users should exist and be active so that external guest access is periodically recertified by reviewers. Requires a Microsoft Entra ID P2 license.

An access review scoped to privileged (PIM) directory roles should exist and be active so privileged role assignments are periodically recertified by reviewers. Requires a Microsoft Entra ID P2 license.

Microsoft Entra admin consent workflow is evaluated to confirm an approval path exists for app permission requests. The check looks for the workflow being enabled and, when present, whether reviewer notifications are configured.

Microsoft Entra Conditional Access restricts MicrosoftAdminPortals by targeting admin portals, including all users, excluding administrative roles, and applying a block decision. The assessment determines whether an active policy enforces this restriction rather than only reporting.

Microsoft Entra administrative users are evaluated to confirm they are cloud-only accounts, with no on-premises directory synchronization for any user holding privileged roles.

Microsoft Entra Conditional Access policies that enforce multifactor authentication for users in administrative roles across all resources.

The assessment identifies at least one active policy that targets admin roles (or all users), includes all applications, and grants access only when Require multifactor authentication is satisfied.

Microsoft Entra Conditional Access for administrator roles requires phishing-resistant MFA authentication strength on All applications. Disabled policies are ignored; report-only policies aren't considered. Policies with custom strengths require review to confirm they are truly phishing-resistant.

Microsoft Entra Conditional Access evaluates whether admin roles are covered by policies that enforce a defined sign-in frequency and non-persistent browser sessions across all cloud apps. It looks for reauthentication set to a time interval or Every time, persistent browser set to never, and policies that are enforced rather than report-only or disabled.

Microsoft Entra Conditional Access has at least one policy configured to target all cloud apps. This ensures comprehensive security coverage and automatic protection for newly onboarded applications without requiring policy updates.

Microsoft Entra application registrations should not have any secret credentials configured. This check audits the current state of every application registration and reports those that hold one or more secrets. Both expired and active secrets are reported, since expired entries are credential clutter that should be cleaned up.

Microsoft Entra OAuth app registrations with privileged API permissions (High privilege level) that are not being actively used. Usage status is determined by Microsoft Defender for Cloud Apps App Governance.

The Microsoft Authenticator authentication method should have the Show application name (displayAppInformationRequiredState) and Show geographic location (displayLocationInformationRequiredState) feature settings enabled. This adds context to push and passwordless notifications so users can detect and reject fraudulent approval requests.

Microsoft Entra tenant's authentication methods policy should have the Email OTP authentication method disabled. Email one-time passcodes depend on the security of the recipient mailbox, which is typically a lower-assurance channel, and should not be used as a primary or fallback multi-factor authentication method for members.

Microsoft Entra tenant's authentication methods policy should have SMS and Voice authentication methods disabled. These methods are vulnerable to SIM-swapping, interception, and social engineering attacks, and are deprecated by NIST SP 800-63B as out-of-band authenticators.

Microsoft Entra break glass (emergency access) accounts should have at least one FIDO2 security key registered as their authentication method. These accounts are identified as users excluded from all enabled Conditional Access policies.

Helper check that verifies whether Microsoft Entra Conditional Access includes at least one enabled policy scoped to all cloud applications and all users. Policies that only require a password change and report-only policies are excluded from passing. The result is intended to support other, more specific Conditional Access checks rather than enforce a baseline on its own.

Microsoft Entra Conditional Access policy with application enforced restrictions limits access to SharePoint, OneDrive, and Exchange content from unmanaged devices.

This control helps prevent data exfiltration by restricting download, print, and sync capabilities on devices that are not managed by the organization.

Microsoft Entra Conditional Access policies can require that only approved client apps or apps with app protection policies are used on iOS and Android devices. This ensures corporate data on mobile platforms is accessed only through managed or protected applications.

At least one enabled Conditional Access policy should target the authentication transfer flow for all users and all resources and set the grant control to Block. Authentication transfer lets a user move an authenticated session from one device to another (for example, by scanning a QR code), which can be abused to move a session onto an attacker-controlled device.

This check verifies that at least one enabled Conditional Access policy blocks access to all cloud applications for users flagged with an elevated insider risk level by Microsoft Purview Insider Risk Management and Adaptive Protection.