Checks

Microsoft Entra authorization policy defines default user permissions, including whether non-admin users are allowed_to_create_tenants. This evaluates if tenant creation is disabled for default users via default_user_role_permissions.

The external collaboration settings should allow invitations only to specified domains (most restrictive). An explicit allow-list limits B2B guest invitations to trusted partner organizations, while an empty allow-list blocks invitations from all external domains.

Microsoft Entra authorization policy controls who can send B2B guest invitations.

Secure posture is when invitations are restricted to specific admin roles (adminsAndGuestInviters) or completely disabled (none).

Microsoft Entra authorization policy controls guest invitations via guest_invite_settings. It should be adminsAndGuestInviters or none, so only specific administrative roles can invite guests-or invitations are disabled.

Microsoft Entra authorization policy guest settings are assessed to determine whether guest user access is limited to the properties and memberships of their own directory objects (Restricted access) instead of broader visibility into users and groups

Microsoft Entra authorization policy evaluates guest user access restrictions being set to the most restrictive level, where guests can view only their own directory object and related memberships (Guest user access is restricted to properties and memberships of their own directory objects).

Microsoft Entra authorization settings are evaluated to determine if the default user role permits user consent to applications. The check looks at permission grant policies to see whether end users can authorize apps to access organization data on their behalf, or if consent is restricted (e.g., Do not allow user consent).

Microsoft Entra tenant settings restrict user consent to applications, preventing end users from granting delegated permissions to apps on their behalf. Only administrator-approved or policy-allowed consents are permitted.

Microsoft Entra authorization policy for the default user role is assessed for assignment of the user-consent policy microsoft-user-default-legacy. Its presence means users can self-consent to app permissions; its absence indicates consent is restricted (e.g., only verified publishers or low-impact scopes).

Microsoft Entra privileged accounts are expected to use multifactor authentication. This evaluates users assigned to elevated directory roles and confirms they have multiple authentication methods registered for sign-in.

Microsoft Entra hybrid deployments use Seamless Single Sign-On (SSO) to allow automatic authentication for domain-joined devices on the corporate network.

This check verifies the actual Seamless SSO configuration in directory synchronization settings. Modern devices with Primary Refresh Token (PRT) support no longer require Seamless SSO.

Microsoft Entra Security defaults provide tenant-wide baseline identity protections:

• MFA registration and challenges
• Legacy auth (IMAP/POP/SMTP) blocked
• Extra checks for privileged access

This evaluation identifies whether that baseline is enabled at the tenant level.

Microsoft Entra service principals with permanent assignments to Control Plane (Tier 0) directory roles are evaluated for the use of client secrets (password credentials) instead of more secure authentication methods such as certificates or managed identities.

Microsoft Entra service principals holding permanent Control Plane (Tier 0) directory roles (such as Global Administrator or Privileged Role Administrator) are evaluated for the presence of owners on either the service principal itself or its parent app registration.

Microsoft Entra authorization policy restricts registration of third-party applications, verifying that non-admin users cannot create app registrations and that only administrators or explicitly delegated roles can add integrated apps.

Microsoft Entra ID Conditional Access supports trusted named locations defined by public IP ranges. Presence of at least one location marked trusted with IP CIDR ranges available for use in policy conditions.

Microsoft Entra directory setting Group.Unified governs who can create Microsoft 365 Groups. The evaluation inspects EnableGroupCreation and, when present, GroupCreationAllowedGroupId to determine if group creation is broadly allowed or restricted to a designated group.

Microsoft Entra users have a registered and enabled multifactor authentication method (MFA capable). The evaluation targets enabled accounts and identifies those lacking any usable second factor.

Microsoft Entra Conditional Access has an enforced policy requiring multifactor authentication for All users across All cloud apps (not just report-only).

Microsoft Entra ID enabled user accounts are evaluated for recent sign-in activity. Accounts that have not signed in for more than 90 days are flagged as stale. Stale accounts indicate orphaned identities that may have been abandoned after personnel changes, project completions, or role transitions without proper deprovisioning.

Microsoft Entra users with Azure roles that grant VM sign-in or management access-such as Owner, Contributor, Virtual Machine * Login, and Virtual Machine Contributor-are evaluated for multi-factor authentication enrollment. The finding highlights accounts with VM access that lack more than one authentication factor.

Etcd is configured to require TLS client certificate authentication when the etcd container includes --client-cert-auth, so client access is validated with trusted certificates.

Etcd configuration is reviewed for the --auto-tls option, which enables automatically generated self-signed certificates for client TLS.

Presence of this flag indicates self-signed TLS is used; absence indicates client TLS relies on externally managed certificates.

Etcd peer TLS configuration is evaluated by checking etcd containers for the --peer-auto-tls flag. Presence of --peer-auto-tls indicates peers use automatically generated self-signed certificates for inter-peer connections.