What is SSPM?

An SSPM tool connects to a SaaS application through its management API, reads the tenant-level settings, and compares them with a list of recommended values. Findings say which setting is off and where.

Examples of SaaS settings that get checked

• Microsoft 365: whether MFA is required for administrators, how many Global Administrators exist, whether Anyone links are allowed in SharePoint, and whether audit log search is on.
• Other SaaS tenants: admin roles, external sharing defaults and sign-in rules follow the same pattern, each read through that vendor's own API.
• Vendor scoring: Microsoft's Secure Score is a built-in example. It turns a tenant's settings into a score and lists improvement actions.
• Cloud platforms behind the SaaS: Microsoft 365 users and administrators live in Microsoft Entra ID, the same identity service that Azure uses, so a weak sign-in policy there is relevant to both.

The key difference from reviewing a setting by hand is coverage. A tenant can have hundreds of options spread over several admin portals, and a tool reads all of them the same way every time.

With SaaS, the provider operates the servers, the network and the application code. What remains with you is the tenant: who can sign in and how, who is an administrator, what can be shared outside the company, and which apps are allowed to connect.

Those are exactly the areas that the joint NSA and CISA advisory AA23-278a names among the common misconfigurations, such as weak or misconfigured MFA and poorly separated administrator privileges. CISA also publishes the SCuBA project, which offers secure configuration baselines for cloud business applications such as Microsoft 365.

Think about a typical tenant after a few years. Several administrators have joined and left, a handful of apps were given broad consent for a pilot, and sharing was opened for one client project and never closed. Each step was reasonable at the time. Together they are the sort of thing an SSPM review is meant to find, and it is far cheaper to find them in a review than after an incident.

The settings also change. A new admin, a new app or a quick exception for a project can undo a good baseline without anyone noticing.

The line between SSPM and CSPM is not sharp. Microsoft 365 and Azure share one identity service, Microsoft Entra, so a sign-in policy affects both. Many vendors now sell the two together.

1. List your SaaS applications and note who administers each one. Start with Microsoft 365, since email, files and identity sit there.
2. Reduce administrator accounts first. Count Global Administrators and make sure each has a named owner and MFA.
3. Look at the vendor's own scoring page, for example Secure Score in Microsoft 365, as a first overview.
4. Pick one written baseline, such as the CIS Benchmark for that application, and measure against it instead of ad-hoc opinions.
5. Check external sharing and third-party app consent, and write down every deliberate exception.
6. Re-check regularly, because settings drift.

ConfigCobra's CSPM module assesses Microsoft 365 against the CIS Microsoft 365 Foundations Benchmark v7.0.0. It has 160 controls, which cover the Microsoft 365 admin center, Entra, Defender, Purview, Intune, Exchange Online, SharePoint and OneDrive, Teams and Fabric / Power BI. Of the 160, 143 are marked Automated by CIS and 17 need manual verification.

It reads through read-only Microsoft Graph permissions, with no agents and no admin password sharing, and it never changes the tenant. Each finding comes with a severity estimate, a copy-paste fix (PowerShell or admin portal steps) and an entry in a PDF report. You can assess several tenants from one workspace.