Checks

Microsoft Entra groups are evaluated for dynamic membership that includes only users with userType -eq "Guest".

The finding indicates whether a guest-targeted dynamic group exists to centrally scope policies and governance.

Microsoft Entra Conditional Access is verified to have at least one emergency access (break glass) account or group excluded from every enabled Conditional Access policy with a Block grant control. Emergency access accounts provide a fallback mechanism when normal administrative access is blocked due to misconfigured blocking policies.

Microsoft Entra Global Administrator assignments are evaluated by counting current role members per tenant and identifying when the number of assignees is 5 or more.

Microsoft Entra Conditional Access has a sign-in risk-based Identity Protection policy that targets All users and All cloud apps, evaluates Medium and High sign-in risk, requires MFA, sets sign-in frequency: every time, and is actively enforced not report-only.

Microsoft Entra Conditional Access has a user risk-based policy that targets All users and All applications, evaluates High user risk, and actively enforces controls requiring both multifactor authentication and a secure password change with an AND condition.

An activity-based timeout policy should sign out inactive users from Microsoft 365 web apps after a period of inactivity. The web session idle timeout (WebSessionIdleTimeout) should be set to 3 hours or less so that unattended sessions are terminated.

Microsoft Entra Conditional Access for Microsoft Intune Enrollment must require strong authentication and set sign-in frequency to Every time for all users.

This check evaluates whether an active policy targets the Intune Enrollment app, requires MFA or authentication strength, and forces reauthentication on each enrollment attempt.

Microsoft Entra Conditional Access has an active policy that blocks legacy authentication for All users and All cloud apps by targeting legacy client app types (e.g., Exchange ActiveSync, other basic-auth clients) and enforcing Block access.

Microsoft Entra Conditional Access evaluates whether an enabled policy targeting all users and all applications includes grant controls that require a managed device (hybrid domain-joined) with multifactor authentication during sign-in.

Microsoft Entra Conditional Access evaluates whether MFA registration is restricted to organization-managed devices. It looks for policies that target the security info registration action for all users and require a managed (compliant or hybrid-joined) device when registering authentication methods.

Microsoft Entra non-privileged users are assessed for multifactor authentication by verifying they have two or more registered authentication methods (MFA enrollment).

Microsoft Entra hybrid tenants use password hash synchronization to replicate on-premises Active Directory password hashes to Entra for cloud authentication.

Applies to hybrid sync scenarios, not fully federated domains.

The tenant Password Rule Settings should enforce a custom banned password list (EnableBannedPasswordCheck true with a non-empty BannedPasswordList). This blocks organization-specific weak or predictable passwords (e.g., company name, products, locations) in addition to Microsoft's global banned list.

The tenant Password Rule Settings should set the smart LockoutDurationInSeconds to 60 or more. The lockout duration determines how long an account remains locked out before the user can attempt to sign in again.

The tenant Password Rule Settings should set the smart LockoutThreshold to 10 or less. The lockout threshold determines how many failed sign-in attempts are permitted before an account is placed in a locked-out state.

The tenant Password Rule Settings should enable password protection on Windows Server Active Directory (EnableBannedPasswordCheckOnPremises) with the mode set to Enforced. This extends Entra banned-password checks to on-premises password changes in hybrid environments. This control only applies to tenants with on-premises directory synchronization.

Privileged Identity Management (PIM) should require approval to activate the Global Administrator role, with at least one approver configured. This adds a human authorization step before the most privileged role in the tenant can be used. Requires a Microsoft Entra ID P2 license.

Privileged Identity Management (PIM) should require approval to activate the Privileged Role Administrator role, with at least one approver configured. This role can manage role assignments, so its activation should require human authorization. Requires a Microsoft Entra ID P2 license.

The tenant Group.Unified directory setting should have EnableGroupCreation set to false so that non-admin users cannot create Microsoft 365 groups through the portal, API, or PowerShell. Microsoft 365 group creation should be delegated to a controlled set of users.

Microsoft Entra tenant's authorization policy should restrict non-admin users from creating security groups. Security groups can be used to grant access to resources across Microsoft 365, so their creation should be limited to administrators to preserve least privilege and prevent uncontrolled access grants.

Microsoft Entra tenant's authorization policy should restrict non-admin users from reading (self-recovering) BitLocker recovery keys for devices they own. Restricting self-service recovery reduces the risk of an attacker who has compromised a user account from also recovering the disk-encryption key of that user's device.

Microsoft Entra authorization policy setting for default user role permissions governing creation of security groups by non-privileged users.

The value of allowed_to_create_security_groups is examined to ensure group creation is limited to administrators across portals, API, and PowerShell.

Microsoft Entra authorization policy controls whether default users can create application registrations via allowed_to_create_apps. App creation is expected to be limited to administrators or explicitly delegated roles.

Microsoft Entra authorization policy governs whether default users can create new tenants. This evaluates if tenant creation is disabled for non-admin users via allowed_to_create_tenants=false.