Checks

Microsoft 365 calendar sharing is evaluated at the organization level to determine if sharing with external recipients is disabled, including blocking anonymous access and links sent outside the tenant.

Microsoft 365 groups are assessed for their visibility setting.

The finding highlights groups configured as Public; groups set to Private align with the intended privacy posture.

Microsoft 365 organization setting indicates whether Customer Lockbox is enabled to require explicit approval for Microsoft support access to customer content

Microsoft 365 tenant password policy is configured so user passwords do not expire (never expire), meaning no time-based rotation is enforced across accounts.

Microsoft Bookings (Shared Bookings) should be turned off unless the organization has a business need for it. Bookings lets users create public booking pages so customers can schedule time with staff. It is considered compliant when it is disabled at the tenant level (BookingsEnabled) or when the default OWA mailbox policy blocks Bookings mailbox creation (BookingsMailboxCreationEnabled).

Privileged users in Microsoft 365 are evaluated for a reduced license footprint: only AAD_PREMIUM (P1) or AAD_PREMIUM_P2 (P2), or no license. Assignments that include productivity app suites indicate excess application entitlements on administrative accounts.

Count of users assigned the Global Administrator role in the Microsoft 365 tenant is between 2 and 4 (inclusive).

Microsoft Defender for Office 365 anti-phishing policies are evaluated for custom scoping to users, groups, or domains and precedence over the default, plus key settings: spoof intelligence, DMARC honoring, quarantine actions for spoof/DMARC, safety tips, unauthenticated sender indicators, and policy enablement.

Microsoft Defender connection filter policy is evaluated to determine whether the IP Allowlist (IPAllowList) is configured. The finding indicates if any IP addresses are present in the policy's allow list for Exchange Online or standalone EOP environments.

Microsoft Defender for Office 365 connection filter policy safe list setting is evaluated. When enabled, mail from Microsoft-managed IPs skips spam filtering and some sender authentication. The finding indicates whether this implicit bypass is turned off.

Microsoft Defender for Office 365 outbound spam policies must send administrator alerts and Bcc suspicious outbound messages when a sender exceeds limits or is blocked. The assessment checks for notify limit exceeded and notify sender blocked with recipient addresses in the default policy and any applicable custom policies.

Microsoft Defender for Office 365 outbound spam policies are evaluated to confirm that automatic mail forwarding is disabled in the default policy and in any custom policies applied to users, groups, or domains.

Microsoft Defender for Office 365 inbound anti-spam policies are evaluated for domains listed in AllowedSenderDomains.

The finding identifies any policy where this list is populated rather than empty.

Microsoft Defender for Office 365 Safe Attachments for SharePoint, OneDrive, and Microsoft Teams protects organizations from inadvertently sharing malicious files. When enabled, files identified as malicious are blocked and cannot be opened, copied, moved, or shared until further actions are taken by the organization's security team.

Microsoft Defender for Office 365 user-reported settings ensure junk, not-junk, and phish reports are sent to customized addresses with valid destinations, and that Teams chat reports route to customized addresses while direct chat reporting to Microsoft is disabled.

Microsoft 365 Exchange Online domains use DKIM signing for outbound mail. This evaluates each domain to confirm an active DKIM configuration so messages include a verifiable signature via the domain's DKIM selectors.

Microsoft 365 Exchange Online domains should publish a DMARC DNS TXT record at _dmarc.<domain> with an enforcement policy (p=quarantine or p=reject). This evaluates each accepted domain to confirm the published record and that it does not rely solely on the monitoring-only p=none policy.

Microsoft Defender for Identity (MDI) monitors your hybrid identity infrastructure and detects advanced threats targeting Active Directory. This check verifies that MDI sensors are deployed and that there are no unresolved health issues that may affect the ability to detect identity-based attacks.

Microsoft Defender for Office 365 anti-malware policies use the Common Attachment Types Filter to block risky file formats regardless of extension. The evaluation checks whether this filter is enabled across default and custom policies and considers policy precedence that could override or bypass the protection.

Microsoft Defender anti-malware policies use the Common Attachment Types Filter to block a comprehensive set of risky file extensions. It evaluates whether the filter is enabled and all recommended types are blocked across the default policy and any enabled custom policies, considering scope and precedence.

Microsoft Defender for Office 365 anti-malware policies are checked for admin notifications on malware detected from internal senders, ensuring a valid notification address is defined (EnableInternalSenderAdminNotifications and InternalSenderAdminAddress).

Effective settings across default and custom policies are considered.

Priority account protection applies enhanced monitoring and protection to high-value accounts. The tenant-level flag EnablePriorityAccountProtection (from Get-EmailTenantSettings) should be enabled. This check evaluates the tenant-level enablement flag; tagging priority accounts and configuring alert policies must be verified separately.

Microsoft Defender for Office 365 Safe Attachments provides an additional layer of protection by scanning email attachments in a secure environment before delivering them to recipients.

The Built-In Protection Policy should have Enable=True, Action=Block, and QuarantineTag=AdminOnlyAccessPolicy to ensure malicious attachments are blocked and quarantined with admin-only access.

Microsoft Defender for Office 365 Safe Links is a feature that provides URL scanning and rewriting of inbound email messages, as well as time-of-click verification of URLs and links in email messages, Teams, and Office apps.

This check verifies that the Safe Links policy is properly configured with all recommended settings enabled.