Checks

Microsoft Entra ID authentication methods policy is evaluated for strong authentication enforcement. The check verifies that at least one strong method (Microsoft Authenticator, FIDO2, or X.509 Certificate) is enabled and that the MFA registration campaign is active to prompt users to enroll.

Microsoft Entra Conditional Access is evaluated for a policy that requires multifactor authentication when accessing Microsoft Admin Portals (Microsoft 365 Admin Center, Microsoft Entra Admin Center, Microsoft Exchange Admin Center, etc.). The check confirms an enabled policy targets All users, includes the Microsoft Admin Portals app, and enforces an MFA grant control.

Microsoft Entra Conditional Access is evaluated for a policy that requires multifactor authentication when accessing the Windows Azure Service Management API (Azure PowerShell, Azure CLI, Azure Resource Manager API, etc.). The check confirms an enabled policy targets All users, includes the Service Management API app, and enforces an MFA grant control.

Microsoft Entra Global Administrator assignments are evaluated by counting current role members per tenant and identifying when the number of assignees is 5 or more.

Microsoft Entra non-privileged users are assessed for multifactor authentication by verifying they have two or more registered authentication methods (MFA enrollment).

Microsoft Entra authorization policy setting for default user role permissions governing creation of security groups by non-privileged users.

The value of allowed_to_create_security_groups is examined to ensure group creation is limited to administrators across portals, API, and PowerShell.

Microsoft Entra authorization policy controls whether default users can create application registrations via allowed_to_create_apps. App creation is expected to be limited to administrators or explicitly delegated roles.

Microsoft Entra authorization policy governs whether default users can create new tenants. This evaluates if tenant creation is disabled for non-admin users via allowed_to_create_tenants=false.

Microsoft Entra authorization policy controls who can send B2B guest invitations.

Secure posture is when invitations are restricted to specific admin roles (adminsAndGuestInviters) or completely disabled (none).

Microsoft Entra authorization policy guest settings are assessed to determine whether guest user access is limited to the properties and memberships of their own directory objects (Restricted access) instead of broader visibility into users and groups

Microsoft Entra authorization settings are evaluated to determine if the default user role permits user consent to applications. The check looks at permission grant policies to see whether end users can authorize apps to access organization data on their behalf, or if consent is restricted (e.g., Do not allow user consent).

Microsoft Entra authorization policy for the default user role is assessed for assignment of the user-consent policy microsoft-user-default-legacy. Its presence means users can self-consent to app permissions; its absence indicates consent is restricted (e.g., only verified publishers or low-impact scopes).

Microsoft Entra privileged accounts are expected to use multifactor authentication. This evaluates users assigned to elevated directory roles and confirms they have multiple authentication methods registered for sign-in.

Microsoft Entra Security defaults provide tenant-wide baseline identity protections:

• MFA registration and challenges
• Legacy auth (IMAP/POP/SMTP) blocked
• Extra checks for privileged access

This evaluation identifies whether that baseline is enabled at the tenant level.

Microsoft Entra ID Conditional Access supports trusted named locations defined by public IP ranges. Presence of at least one location marked trusted with IP CIDR ranges available for use in policy conditions.

Microsoft Entra directory setting Group.Unified governs who can create Microsoft 365 Groups. The evaluation inspects EnableGroupCreation and, when present, GroupCreationAllowedGroupId to determine if group creation is broadly allowed or restricted to a designated group.

Microsoft Entra ID enabled user accounts are evaluated for recent sign-in activity. Accounts that have not signed in for more than 90 days are flagged as stale. Stale accounts indicate orphaned identities that may have been abandoned after personnel changes, project completions, or role transitions without proper deprovisioning.

Microsoft Entra users with Azure roles that grant VM sign-in or management access-such as Owner, Contributor, Virtual Machine * Login, and Virtual Machine Contributor-are evaluated for multi-factor authentication enrollment. The finding highlights accounts with VM access that lack more than one authentication factor.

Azure custom RBAC roles include the Microsoft.Authorization/locks/* action, indicating permission to administer management locks at subscription, resource group, or resource scope.

Azure subscription role assignments granting User Access Administrator are identified to surface principals able to manage access (Azure RBAC) at that scope.

Azure custom roles are analyzed for wildcard permissions. Roles that allow * in actions within their assignable scopes are treated as owner-equivalent, granting unrestricted control over subscription resources.

Azure Key Vaults configured with private endpoints have public network access set to Disabled, so connectivity occurs only over the private link.

Each enabled key in an Azure Key Vault using access policies (non-RBAC) is assessed to confirm it has an expiration (exp) attribute defined.

Each Azure Key Vault key is assessed for a rotation policy that includes a Rotate lifetime action scheduling automatic key version creation.