Checks

Microsoft 365 Teams client settings restrict external file sharing via third-party storage providers to an approved allowlist. Configuration is considered in place when only sanctioned providers are enabled, or when all non-approved providers are disabled.

Microsoft 365 Teams external access blocks conversation initiation from unmanaged Teams accounts when AllowTeamsConsumerInbound=false.

Microsoft 365 Teams org-wide meeting policy is evaluated to ensure anonymous meeting join is disabled, preventing non-authenticated participants from joining.

Microsoft 365 Teams meeting policies disable AllowAnonymousUsersToStartMeeting so anonymous users and dial-in callers cannot start meetings and must wait in the lobby until an authenticated participant joins

Microsoft 365 Teams meeting policies restrict chat so anonymous participants cannot send or read messages.

Accepted configurations include EnabledExceptAnonymous or EnabledInMeetingOnlyForAllExceptAnonymous.

Microsoft 365 Teams meeting policies prevent PSTN dial-in callers from bypassing the lobby (AllowPSTNUsersToBypassLobby=false), requiring admission by organizers or presenters.

Microsoft 365 Teams meeting policy setting AllowExternalNonTrustedMeetingChat governs whether users can read or send chat messages in meetings hosted by untrusted organizations.

This assesses the org-wide default policy to confirm external meeting chat with non-trusted tenants is blocked.

Microsoft 365 Teams meeting policies govern whether external participants can give, be given, or request control during screen sharing via allowExternalParticipantGiveRequestControl.

Evaluation targets the org-wide default policy to confirm external control actions are blocked.

Teams Meetings global policy restricts lobby bypass so only EveryoneInCompanyExcludingGuests, OrganizerOnly, or InvitedUsers are auto-admitted; all others wait in the lobby.

Teams meeting policy sets the default Who can present to only organizers and co-organizers in the org-wide policy.

This evaluates whether attendees are limited to the attendee role by default rather than joining as presenters.

Microsoft 365 Teams Global meeting policy has cloud meeting recording disabled by default (AllowCloudRecording=false).

Teams messaging policies enable end-user security reporting via AllowSecurityEndUserReporting, letting users report messages from chats, channels, and meetings for security review.

Microsoft 365 Teams external access configuration for unmanaged Teams accounts is reviewed, expecting the "Teams accounts not managed by an organization" option to be Off, preventing chats with personal Microsoft accounts.

AWS Transfer Family servers (SFTP, FTPS, AS2) are assessed for use of a FIPS security policy (TransferSecurityPolicy-FIPS-*, flagged Fips: true by AWS), which limits file-transfer sessions to the FIPS-enabled set of SSH and TLS algorithms.

AWS Transfer Family servers are evaluated for presence of the unencrypted FTP protocol among enabled protocols, as opposed to encrypted options like SFTP, FTPS, or AS2.

AWS Transfer Family servers (SFTP, FTPS, AS2) are assessed for use of an approved post-quantum (PQ) hybrid SSH key exchange security policy. Servers whose SecurityPolicyName is not in the configured allowlist of PQ-ready Transfer Family security policies leave file-transfer sessions exposed to harvest-now, decrypt-later attacks.

AWS Trusted Advisor check statuses are assessed to identify items in warning or error. The finding reflects the state reported by Trusted Advisor across categories such as Security, Fault Tolerance, Service Limits, and Cost, indicating where configurations or quotas require attention.

AWS account is subscribed to an AWS Premium Support plan (e.g., Business or Enterprise)

An Okta Workflows Automation must disable inactive user accounts. The automation must be ACTIVE, on an ACTIVE schedule, evaluate User Inactivity = 35 days (or less), apply to a group covering every user, and trigger Suspended / Deactivated / Deprovisioned. Threshold override: okta_user_inactivity_max_days. N/A when user sourcing is delegated to Active Directory or LDAP.

Azure VMs are evaluated for protection by Azure Backup by confirming they exist as VM backup items in a Recovery Services vault.

VMs absent from any vault item indicate no configured backup coverage.

Azure virtual machines are compared against an organization allowlist of VM size SKUs defined in desired_vm_sku_sizes.

Instances using sizes outside this list are flagged as non-standard.

Attached Azure managed disks (OS and data) are assessed to confirm encryption uses customer-managed keys (CMK) via disk encryption sets rather than platform-managed keys. Scope includes disks currently attached to VMs, evaluating their encryption type to verify CMK is applied.

Unattached Azure managed disks use Customer-Managed Keys (CMK) for server-side encryption rather than platform-managed keys. Only disks not currently attached to a VM are in scope.

Azure VMs are evaluated for use of an approved custom image by inspecting the VM image reference. The expected format is a subscription-scoped ID like /subscriptions/.../providers/Microsoft.Compute/images/<image>, not marketplace, gallery, or community sources.