Checks

The tenant device registration policy should restrict which registering users are added to the local administrators group during Microsoft Entra join to Selected users or None (azureADJoin.localAdmins.registeringUsers), rather than granting local admin to every user who registers a device.

When on-premises directory synchronization is enabled, both blockSoftMatchEnabled and blockCloudObjectTakeoverThroughHardMatchEnabled must be true. Without these blocks, an attacker who can write to on-premises AD can craft an object that matches a privileged cloud account and take it over.

Microsoft Entra groups are evaluated for dynamic membership that includes only users with userType -eq "Guest".

The finding indicates whether a guest-targeted dynamic group exists to centrally scope policies and governance.

Microsoft Entra Conditional Access is verified to have at least one emergency access (break glass) account or group excluded from every enabled Conditional Access policy with a Block grant control. Emergency access accounts provide a fallback mechanism when normal administrative access is blocked due to misconfigured blocking policies.

Microsoft Entra Conditional Access has a sign-in risk-based Identity Protection policy that targets All users and All cloud apps, evaluates Medium and High sign-in risk, requires MFA, sets sign-in frequency: every time, and is actively enforced not report-only.

Microsoft Entra Conditional Access has a user risk-based policy that targets All users and All applications, evaluates High user risk, and actively enforces controls requiring both multifactor authentication and a secure password change with an AND condition.

An activity-based timeout policy should sign out inactive users from Microsoft 365 web apps after a period of inactivity. The web session idle timeout (WebSessionIdleTimeout) should be set to 3 hours or less so that unattended sessions are terminated.

Microsoft Entra Conditional Access for Microsoft Intune Enrollment must require strong authentication and set sign-in frequency to Every time for all users.

This check evaluates whether an active policy targets the Intune Enrollment app, requires MFA or authentication strength, and forces reauthentication on each enrollment attempt.

Microsoft Entra Conditional Access has an active policy that blocks legacy authentication for All users and All cloud apps by targeting legacy client app types (e.g., Exchange ActiveSync, other basic-auth clients) and enforcing Block access.

Microsoft Entra Conditional Access evaluates whether an enabled policy targeting all users and all applications includes grant controls that require a managed device (hybrid domain-joined) with multifactor authentication during sign-in.

Microsoft Entra Conditional Access evaluates whether MFA registration is restricted to organization-managed devices. It looks for policies that target the security info registration action for all users and require a managed (compliant or hybrid-joined) device when registering authentication methods.

Microsoft Entra hybrid tenants use password hash synchronization to replicate on-premises Active Directory password hashes to Entra for cloud authentication.

Applies to hybrid sync scenarios, not fully federated domains.

The tenant Password Rule Settings should enforce a custom banned password list (EnableBannedPasswordCheck true with a non-empty BannedPasswordList). This blocks organization-specific weak or predictable passwords (e.g., company name, products, locations) in addition to Microsoft's global banned list.

The tenant Password Rule Settings should set the smart LockoutDurationInSeconds to 60 or more. The lockout duration determines how long an account remains locked out before the user can attempt to sign in again.

The tenant Password Rule Settings should set the smart LockoutThreshold to 10 or less. The lockout threshold determines how many failed sign-in attempts are permitted before an account is placed in a locked-out state.

The tenant Password Rule Settings should enable password protection on Windows Server Active Directory (EnableBannedPasswordCheckOnPremises) with the mode set to Enforced. This extends Entra banned-password checks to on-premises password changes in hybrid environments. This control only applies to tenants with on-premises directory synchronization.

Privileged Identity Management (PIM) should require approval to activate the Global Administrator role, with at least one approver configured. This adds a human authorization step before the most privileged role in the tenant can be used. Requires a Microsoft Entra ID P2 license.

Privileged Identity Management (PIM) should require approval to activate the Privileged Role Administrator role, with at least one approver configured. This role can manage role assignments, so its activation should require human authorization. Requires a Microsoft Entra ID P2 license.

The tenant Group.Unified directory setting should have EnableGroupCreation set to false so that non-admin users cannot create Microsoft 365 groups through the portal, API, or PowerShell. Microsoft 365 group creation should be delegated to a controlled set of users.

Microsoft Entra tenant's authorization policy should restrict non-admin users from creating security groups. Security groups can be used to grant access to resources across Microsoft 365, so their creation should be limited to administrators to preserve least privilege and prevent uncontrolled access grants.

Microsoft Entra tenant's authorization policy should restrict non-admin users from reading (self-recovering) BitLocker recovery keys for devices they own. Restricting self-service recovery reduces the risk of an attacker who has compromised a user account from also recovering the disk-encryption key of that user's device.

Microsoft Entra authorization policy defines default user permissions, including whether non-admin users are allowed_to_create_tenants. This evaluates if tenant creation is disabled for default users via default_user_role_permissions.

The external collaboration settings should allow invitations only to specified domains (most restrictive). An explicit allow-list limits B2B guest invitations to trusted partner organizations, while an empty allow-list blocks invitations from all external domains.

Microsoft Entra authorization policy controls guest invitations via guest_invite_settings. It should be adminsAndGuestInviters or none, so only specific administrative roles can invite guests-or invitations are disabled.