Checks

Microsoft 365 Exchange Online mailboxes are evaluated for audit logging bypass by reviewing the AuditBypassEnabled setting and identifying mailboxes where auditing can be circumvented.

Microsoft 365 Outlook on the web mailbox policy governs access to additional storage providers (e.g., Box, Dropbox, Google Drive, personal OneDrive). The finding evaluates whether these third-party file integrations are disabled via AdditionalStorageProvidersAvailable=false.

Exchange Online mailboxes should use a custom domain as their primary SMTP address, not the default *.onmicrosoft.com routing domain assigned by Microsoft on tenant creation. This check verifies that the PrimarySmtpAddress of every user-facing mailbox does not end with .onmicrosoft.com.

Microsoft 365 Exchange Online Delicensing Resiliency provides a grace period when licenses expire or are reassigned, preventing immediate mailbox access loss.

This evaluates whether the organization has Delayed Delicensing enabled to protect mailbox data during licensing transitions. Note: This feature is only available to tenants with 5000 or more paid licenses.

Microsoft 365 Exchange Online organization setting AuditDisabled controls tenant-wide mailbox auditing. This evaluates whether it is False so default audit events are recorded for owner, delegate, and admin across all mailboxes, taking precedence over per-mailbox settings.

Microsoft 365 Exchange Online organization has MailTips fully configured: MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, and MailTipsLargeAudienceThreshold 25.

Microsoft 365 Exchange Online organization setting determines if Modern Authentication (OAuth 2.0) is enabled for client connections.

This evaluates whether clients use token-based sign-in rather than Basic credentials.

The Exchange Online organization configuration should have RejectDirectSend enabled. Direct Send allows on-premises devices, applications, or third-party cloud services to send email to the tenant's hosted mailboxes using one of the tenant's accepted domains without authentication, which can be abused to spoof internal senders.

The default Outlook on the web (OWA) mailbox policy should have PersonalAccountsEnabled and PersonalAccountCalendarsEnabled set to false. The former controls adding personal email accounts (e.g., Outlook.com, Gmail) in the new Outlook for Windows; the latter controls connecting personal Outlook.com or Google calendars in Outlook on the web.

Microsoft 365 Exchange Online role assignment policies are assessed for roles that permit installing or managing Outlook add-ins (such as My Marketplace Apps, My Custom Apps, My ReadWriteMailbox Apps, Org Marketplace Apps, Org Custom Apps). Presence of these roles indicates users or admins can deploy add-ins from the store or custom sources.

Microsoft 365 Shared mailboxes are used for collaboration and should not permit direct sign-in. This check verifies that the AccountEnabled property is set to false in Entra ID for all shared mailboxes, preventing direct authentication.

Microsoft 365 Exchange Online transport configuration disables authenticated SMTP submission (SMTP AUTH) at the organization level

Microsoft 365 Exchange Online mail flow rules are assessed for actions that forward or redirect messages to external domains. The finding highlights rules that add external recipients during transport.

Microsoft 365 Exchange Online mail flow rules that whitelist specific sender domains by forcing SCL to -1 (skip spam filtering) on matching messages

Microsoft 365 Exchange Online user mailboxes have auditing enabled, include a defined set of actions for Owner, Delegate, and Admin, and retain audit records for at least the configured baseline (default 90 days).

OCI File Storage file systems use Customer-Managed Keys (CMEK) for encryption when a KMS key is associated, instead of the default Oracle-managed encryption.

Amazon Data Firehose delivery streams must enable server-side encryption at rest with AWS KMS regardless of the source type. Encryption of upstream sources such as Kinesis Data Streams or MSK does not replace the need to protect the delivery stream itself.

Firewall Manager policies in the administrator account are evaluated for organization-wide compliance. The assessment reviews each policy's account-level status and flags entries marked NON_COMPLIANT or unset. It also identifies when no effective policies exist within the administrator scope.

Amazon FSx file systems are evaluated for whether they copy resource tags to their backups via the copy_tags_to_backups setting.

Amazon FSx file systems are configured to copy tags to volumes via copy_tags_to_volumes.

Identifies file systems where volume resources will not inherit the file system's tags.

FSx for Windows File Server file systems are evaluated for Multi-AZ deployment, determined when SubnetIds include more than one subnet in different Availability Zones.

Using 'allUsers' or 'allAuthenticatedUsers' as members in an IAM member/binding causes data to be exposed outside of the organisation.

When you enable uniform bucket-level access on a bucket, Access Control Lists (ACLs) are disabled, and only bucket-level Identity and Access Management (IAM) permissions grant access to that bucket and the objects it contains. You revoke all access granted by object ACLs and the ability to administrate permissions using bucket ACLs.

Permissions should not be directly granted to users, you identify roles that contain the appropriate permissions, and then grant those roles to the user.

Granting permissions to users quickly become unwieldy and complex to make large scale changes to remove access to a particular resource.

Permissions should be granted on roles, groups, services accounts instead.