From CIS Findings to Fixes: Working Through a Microsoft 365 Assessment Report

A CIS assessment run ends with a report, and that is where the real work starts. After a scan against the CIS Microsoft 365 Foundations Benchmark v7.0.0, the question is how to get from a findings list to a tenant that is actually configured differently. This post walks through a practical workflow for doing that with a ConfigCobra report, without breaking production along the way.

Start by understanding what the report contains

The benchmark has 160 controls: 114 Level 1 and 46 Level 2. Of those, 143 are assessed automatically and 17 are Manual, meaning they need a human to verify. A ConfigCobra assessment covers the 160 controls with automated checks where the benchmark allows it, and the scan itself takes 20–25 minutes.

The resulting PDF report contains findings, supporting evidence, and a timestamped tenant snapshot. Each control carries a severity taken from the benchmark itself, and each finding comes with a copy-paste remediation script (PowerShell) or step-by-step admin portal instructions. Read the report in that order: what failed, how bad it is, what evidence shows it, and what the fix looks like.

Step 1: separate the Manual controls from the failures

The 17 Manual controls are not failures; they are open questions. A control such as 1.1.2 – Ensure two emergency access accounts have been defined cannot be proven by reading tenant settings alone, because someone has to confirm the accounts exist, are excluded appropriately, and have their credentials stored safely. Put these on a separate checklist with an owner and a date, and do not mix them into the remediation queue for automated findings.

Step 2: triage by profile and severity, not by section order

It is tempting to work top to bottom through sections 1 to 9. Resist that. Section 5 (Microsoft Entra) alone holds 63 of the 160 controls, so section order would bury everything else behind identity work. Instead, filter on two things the report already gives you:

• Profile. Level 1 controls are described by CIS as safe with minimal impact; Level 2 controls are stricter and security-focused. Clear failing Level 1 controls first, then plan Level 2 as a separate project.
• Severity. Within a profile, address higher-severity findings before lower ones.

Controls like 5.2.2.1 – Ensure multifactor authentication is enabled for all users in administrative roles and 5.2.2.2 – Ensure multifactor authentication is enabled for all users are both Level 1 and automated, so a failure on either is an obvious early candidate. For a full sequencing argument, see our post on where to start with the 160 controls.

Step 3: classify each fix by blast radius

Before running any remediation script, ask what the change could break. Some controls are pure metadata or logging changes. For example, 6.1.1 – Ensure 'AuditDisabled' organizationally is set to 'False' turns on auditing and does not change what users can do. Others change user-facing behaviour: requiring MFA for all users (5.2.2.2) or requiring modern authentication for SharePoint applications (7.2.1) can interrupt legacy clients and service accounts.

A simple three-bucket split works well:

• Safe to apply immediately – configuration that does not alter user sign-in or sharing behaviour.
• Apply with a pilot group – changes that affect users; test with a small group, then widen.
• Needs a stakeholder decision – changes that alter business workflows, such as external sharing defaults.

Step 4: read the script before you run it

The generated PowerShell is a starting point you review, not a button. Read what it changes, confirm the target tenant, and run it in a change window when appropriate. If a portal path is more comfortable for your team, the same finding includes admin portal steps. ConfigCobra does not apply changes to your tenant for you: its Microsoft Graph permissions are read-only, so every change is made by an administrator on your side.

Step 5: re-scan and compare

After each batch of fixes, run the assessment again. The new report has its own timestamped tenant snapshot, so you can show that a failing control at one point in time became a passing control at a later one. That before-and-after evidence is what auditors and clients usually ask for.

Once you reach a baseline you are happy with, use the scheduler to rescan on a daily, weekly, or monthly cadence, with email notifications when a control regresses. Configuration drift is the usual reason a fixed finding returns.

Step 6: share evidence with auditors and clients

You do not need to hand out admin access to show your work. ConfigCobra includes a read-only auditor seat, so an external auditor or a client can be invited to view results directly. If you manage several customers, the multi-tenant workspace lets you assess subsidiaries or client tenants from one place.

A short checklist

• Run the assessment and download the PDF report.
• Move the 17 Manual controls to their own verification list.
• Sort remaining findings by profile (Level 1 first) and severity.
• Label each fix by blast radius: immediate, pilot, or decision needed.
• Review each remediation script, then apply it as an administrator.
• Re-scan, keep the new report as evidence, and schedule recurring scans.

Try it on your own tenant

The free trial runs for 14 days with full access, which is enough to see what a finding, its evidence, and its remediation script look like. Start the free trial, or review the CIS Microsoft 365 benchmark coverage and pricing if you are planning a full assessment.