Checks

Microsoft Entra authorization policy evaluates guest user access restrictions being set to the most restrictive level, where guests can view only their own directory object and related memberships (Guest user access is restricted to properties and memberships of their own directory objects).

Microsoft Entra tenant settings restrict user consent to applications, preventing end users from granting delegated permissions to apps on their behalf. Only administrator-approved or policy-allowed consents are permitted.

Microsoft Entra hybrid deployments use Seamless Single Sign-On (SSO) to allow automatic authentication for domain-joined devices on the corporate network.

This check verifies the actual Seamless SSO configuration in directory synchronization settings. Modern devices with Primary Refresh Token (PRT) support no longer require Seamless SSO.

Microsoft Entra service principals with permanent assignments to Control Plane (Tier 0) directory roles are evaluated for the use of client secrets (password credentials) instead of more secure authentication methods such as certificates or managed identities.

Microsoft Entra service principals holding permanent Control Plane (Tier 0) directory roles (such as Global Administrator or Privileged Role Administrator) are evaluated for the presence of owners on either the service principal itself or its parent app registration.

Microsoft Entra authorization policy restricts registration of third-party applications, verifying that non-admin users cannot create app registrations and that only administrators or explicitly delegated roles can add integrated apps.

Microsoft Entra users have a registered and enabled multifactor authentication method (MFA capable). The evaluation targets enabled accounts and identifies those lacking any usable second factor.

Microsoft Entra Conditional Access has an enforced policy requiring multifactor authentication for All users across All cloud apps (not just report-only).

Microsoft 365 Exchange Online applications with mailbox access permissions should be restricted using Application Access Policies.

This check evaluates whether applications granted Exchange-related Microsoft Graph application permissions are scoped using Exchange Online ApplicationAccessPolicy objects.

Microsoft 365 Exchange Online uses native external sender identification so supported Outlook clients display an External tag on messages originating outside the organization.

Microsoft 365 Exchange Online mailboxes are evaluated for audit logging bypass by reviewing the AuditBypassEnabled setting and identifying mailboxes where auditing can be circumvented.

Microsoft 365 Outlook on the web mailbox policy governs access to additional storage providers (e.g., Box, Dropbox, Google Drive, personal OneDrive). The finding evaluates whether these third-party file integrations are disabled via AdditionalStorageProvidersAvailable=false.

Exchange Online mailboxes should use a custom domain as their primary SMTP address, not the default *.onmicrosoft.com routing domain assigned by Microsoft on tenant creation. This check verifies that the PrimarySmtpAddress of every user-facing mailbox does not end with .onmicrosoft.com.

Microsoft 365 Exchange Online Delicensing Resiliency provides a grace period when licenses expire or are reassigned, preventing immediate mailbox access loss.

This evaluates whether the organization has Delayed Delicensing enabled to protect mailbox data during licensing transitions. Note: This feature is only available to tenants with 5000 or more paid licenses.

Microsoft 365 Exchange Online organization setting AuditDisabled controls tenant-wide mailbox auditing. This evaluates whether it is False so default audit events are recorded for owner, delegate, and admin across all mailboxes, taking precedence over per-mailbox settings.

Microsoft 365 Exchange Online organization has MailTips fully configured: MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, and MailTipsLargeAudienceThreshold 25.

Microsoft 365 Exchange Online organization setting determines if Modern Authentication (OAuth 2.0) is enabled for client connections.

This evaluates whether clients use token-based sign-in rather than Basic credentials.

The Exchange Online organization configuration should have RejectDirectSend enabled. Direct Send allows on-premises devices, applications, or third-party cloud services to send email to the tenant's hosted mailboxes using one of the tenant's accepted domains without authentication, which can be abused to spoof internal senders.

The default Outlook on the web (OWA) mailbox policy should have PersonalAccountsEnabled and PersonalAccountCalendarsEnabled set to false. The former controls adding personal email accounts (e.g., Outlook.com, Gmail) in the new Outlook for Windows; the latter controls connecting personal Outlook.com or Google calendars in Outlook on the web.

Microsoft 365 Exchange Online role assignment policies are assessed for roles that permit installing or managing Outlook add-ins (such as My Marketplace Apps, My Custom Apps, My ReadWriteMailbox Apps, Org Marketplace Apps, Org Custom Apps). Presence of these roles indicates users or admins can deploy add-ins from the store or custom sources.

Microsoft 365 Shared mailboxes are used for collaboration and should not permit direct sign-in. This check verifies that the AccountEnabled property is set to false in Entra ID for all shared mailboxes, preventing direct authentication.

Microsoft 365 Exchange Online transport configuration disables authenticated SMTP submission (SMTP AUTH) at the organization level

Microsoft 365 Exchange Online mail flow rules are assessed for actions that forward or redirect messages to external domains. The finding highlights rules that add external recipients during transport.

Microsoft 365 Exchange Online mail flow rules that whitelist specific sender domains by forcing SCL to -1 (skip spam filtering) on matching messages