Checks

Microsoft 365 Exchange Online user mailboxes have auditing enabled, include a defined set of actions for Owner, Delegate, and Admin, and retain audit records for at least the configured baseline (default 90 days).

Intune has a built-in Device Compliance Policy that governs how devices without an explicit compliance policy are treated. When the default behavior marks those devices as Compliant, unmanaged devices can be treated as compliant and gain access to corporate resources. This check verifies the default is set to Not compliant (secureByDefault = true).

Microsoft Purview tenant setting for audit log search is assessed to confirm unified audit log ingestion (UnifiedAuditLogIngestionEnabled), which records user and admin activities and makes them searchable.

Microsoft 365 SharePoint external sharing uses domain-based restrictions via AllowList or BlockList. The evaluation inspects sharingDomainRestrictionMode and whether the corresponding domain list is populated, flagging when domain controls are missing or the selected list is empty.

Microsoft 365 SharePoint org-wide external sharing is evaluated to ensure it excludes anonymous 'Anyone' links and is restricted to authenticated guests via ExternalUserSharingOnly, ExistingExternalUserSharingOnly, or fully Disabled.

Microsoft 365 SharePoint tenant sharing settings evaluate whether guest resharing is disabled (resharingEnabled=false).

Focus is the org-level option that blocks guests from sharing items they don't own.

Microsoft 365 SharePoint tenant settings require modern authentication for applications and block access for apps using legacy protocols.

The assessment determines whether legacy authentication is disabled so only OAuth-based sign-ins with advanced controls are allowed.

Microsoft 365 SharePoint tenant settings for OneDrive sync enforce that only managed, domain-joined devices can sync. The evaluation looks for a configured list of approved domain GUIDs that limits syncing to specific Active Directory domains.

Microsoft 365 Teams tenant configuration for channel email addresses determines if channels can receive messages via email. This evaluates the allow_email_into_channel setting.

The Teams external access configuration should block communication with trial-only tenants (tenants that don't have any purchased seats). When blocked, users from these trial-only tenants cannot search for, contact, call, or meet with the organization's users via Teams external access.

Microsoft 365 Teams tenant external access configuration is assessed. The expected posture is federation with external domains disabled, so users cannot chat, call, or meet with accounts in other domains.

Microsoft 365 Teams client settings restrict external file sharing via third-party storage providers to an approved allowlist. Configuration is considered in place when only sanctioned providers are enabled, or when all non-approved providers are disabled.

Microsoft 365 Teams external access blocks conversation initiation from unmanaged Teams accounts when AllowTeamsConsumerInbound=false.

Microsoft 365 Teams org-wide meeting policy is evaluated to ensure anonymous meeting join is disabled, preventing non-authenticated participants from joining.

Microsoft 365 Teams meeting policies disable AllowAnonymousUsersToStartMeeting so anonymous users and dial-in callers cannot start meetings and must wait in the lobby until an authenticated participant joins

Microsoft 365 Teams meeting policies restrict chat so anonymous participants cannot send or read messages.

Accepted configurations include EnabledExceptAnonymous or EnabledInMeetingOnlyForAllExceptAnonymous.

Microsoft 365 Teams meeting policies prevent PSTN dial-in callers from bypassing the lobby (AllowPSTNUsersToBypassLobby=false), requiring admission by organizers or presenters.

Microsoft 365 Teams meeting policy setting AllowExternalNonTrustedMeetingChat governs whether users can read or send chat messages in meetings hosted by untrusted organizations.

This assesses the org-wide default policy to confirm external meeting chat with non-trusted tenants is blocked.

Microsoft 365 Teams meeting policies govern whether external participants can give, be given, or request control during screen sharing via allowExternalParticipantGiveRequestControl.

Evaluation targets the org-wide default policy to confirm external control actions are blocked.

Teams Meetings global policy restricts lobby bypass so only EveryoneInCompanyExcludingGuests, OrganizerOnly, or InvitedUsers are auto-admitted; all others wait in the lobby.

Teams meeting policy sets the default Who can present to only organizers and co-organizers in the org-wide policy.

This evaluates whether attendees are limited to the attendee role by default rather than joining as presenters.

Microsoft 365 Teams Global meeting policy has cloud meeting recording disabled by default (AllowCloudRecording=false).

Teams messaging policies enable end-user security reporting via AllowSecurityEndUserReporting, letting users report messages from chats, channels, and meetings for security review.

Microsoft 365 Teams external access configuration for unmanaged Teams accounts is reviewed, expecting the "Teams accounts not managed by an organization" option to be Off, preventing chats with personal Microsoft accounts.