Where to Start with the CIS Microsoft 365 Benchmark: Sequencing 160 Controls

Every team that opens the CIS Microsoft 365 Foundations Benchmark v7.0.0 for the first time hits the same wall. There are 160 controls across 9 sections, every one of them looks mandatory, and nothing in the document tells you which to do on Monday and which can wait until next quarter.

The benchmark is a catalogue, not a project plan. But the catalogue itself carries enough structure to build a defensible order of work — you just have to read it as data rather than as a checklist. This post walks through four attributes that are attached to every one of the 160 controls, and how each one narrows the question of what to do first.

The four numbers that decide your order

Before sequencing anything, these are the splits that matter in v7.0.0:

• 160 controls total, spread across 9 top-level sections.
• 114 Level 1 and 46 Level 2 by profile.
• 143 Automated and 17 Manual by assessment status.
• 137 E3-profile and 23 E5-profile by licence requirement.

Each of those splits answers a different planning question: how risky is the change, where is the work concentrated, can a tool check it for you, and do you already own the licence to implement it. Take them in that order.

Step 1 — clear Level 1 before you touch Level 2

The profile split is the single most useful sequencing signal in the benchmark, and it is the one most often ignored.

Level 1 controls are the ones designed to be safe to apply with minimal operational impact. Level 2 controls are stricter and security-focused, which is another way of saying they are more likely to break something a user depends on. That is a deliberate distinction built into the benchmark, and it maps cleanly onto change-management reality: 114 of the 160 controls are Level 1.

Clearing Level 1 first gives you the larger share of the benchmark, at the lower end of the blast radius, before you start negotiating with application owners about the 46 Level 2 controls. It also means that when a Level 2 change does cause friction, you are arguing about one control in isolation rather than defending a 160-item programme.

The practical rule: treat Level 1 as the baseline you commit to closing, and Level 2 as a per-control business decision with a named owner and a documented reason if you decline it.

Step 2 — go where the controls actually are

The 160 controls are not evenly distributed. Here is the exact per-section breakdown in v7.0.0:

• Section 1 — 15 controls. Microsoft 365 admin center: administrative accounts, Microsoft 365 Groups, password and related tenant policies.
• Section 2 — 21 controls. Microsoft Defender / Defender for Office 365: Safe Links, Safe Attachments, threat policies, priority-account protection.
• Section 3 — 5 controls. Microsoft Purview: audit log search, Data Loss Prevention, Information Protection.
• Section 4 — 2 controls. Microsoft Intune: device compliance policies, device enrollment restrictions.
• Section 5 — 63 controls. Microsoft Entra (Identity): MFA, password protection, Conditional Access, authentication methods, Privileged Identity Management.
• Section 6 — 13 controls. Microsoft Exchange Online: mailbox auditing, mail flow and anti-phishing, Outlook add-ins, Exchange modern authentication.
• Section 7 — 12 controls. Microsoft SharePoint Online and OneDrive: external sharing, link defaults, site and OneDrive settings.
• Section 8 — 17 controls. Microsoft Teams: file sharing, external access, apps, meetings, messaging policies.
• Section 9 — 12 controls. Microsoft Fabric / Power BI: tenant settings.

Section 5 is 63 of the 160 controls. Identity is not one workstream among nine — it is the largest single block of work in the benchmark, and it dwarfs the next largest section by a factor of three. Any plan that treats the nine sections as nine equal sprints will be wrong by the end of the first one.

Inside Section 5 the concentration is tighter still. The subsection counts are 5.1 with 26 controls, 5.2 with 32 controls, and 5.3 with 5 controls. Two subsections carry 58 of the 63. If you are staffing this, that is where the hours go. We covered the full section in Microsoft Entra Identity Hardening: What CIS Benchmark Section 5 Checks.

At the other end, Sections 3 and 4 hold 5 and 2 controls respectively. Seven controls across Purview and Intune is a short, finishable piece of work, not a programme — and knocking them out early gives you two fully closed sections to report while identity is still in flight. Do not confuse small with unimportant; confuse small with finishable, and schedule accordingly.

Step 3 — split the 17 manual controls out of the plan

Of the 160 controls, 143 are Automated and 17 are Manual in the benchmark’s own assessment-status field. This distinction is about how a control is verified, not how hard it is to fix, and it has a direct consequence for planning.

The 143 automated controls can be assessed by a tool on a schedule. Their real cost is remediation, not detection. The 17 manual controls need a human to open a portal, read a setting, form a judgement, and write down what they saw — every single time you want current evidence. That cost repeats at every audit cycle.

Teams routinely under-plan this. They scope the benchmark as one number — 160 — and discover at audit time that 17 of those items have no owner, no evidence, and no repeatable procedure. Pull the manual set out into its own tracked list with named owners and a review cadence from day one. We listed all 17 in The 17 CIS Microsoft 365 Controls You Have to Check by Hand.

Step 4 — do not let E5 block the E3 work

The fourth split is licensing: 137 controls carry an E3 profile and 23 carry an E5 profile. The E3 set breaks down as 100 Level 1 and 37 Level 2; the E5 set as 14 Level 1 and 9 Level 2.

The sequencing implication is simple and worth stating plainly, because it is a common source of stalled programmes: if you are on E3, 137 controls are available to you right now. A licence gap is a reason to defer 23 specific controls with a documented justification — it is not a reason to defer the benchmark. We broke the E5 set down control by control in Do You Need Microsoft 365 E5 for CIS Benchmark Compliance?.

The nine admin surfaces the work actually happens in

Sequencing is also an access problem. Every control in the benchmark is implemented in one of these nine places, and a plan that starts before the right people have the right access stalls in week one:

• Microsoft 365 admin center
• Microsoft Entra admin center (Identity)
• Microsoft Defender (Defender for Office 365)
• Microsoft Purview compliance portal
• Microsoft Intune admin center
• Exchange admin center / Exchange Online PowerShell
• SharePoint admin center / OneDrive
• Microsoft Teams admin center
• Microsoft Fabric (Power BI) admin portal

Note that Section 9 lives in the Microsoft Fabric admin portal, which in many organisations is owned by a data or BI team rather than by security. Twelve controls sitting behind an org-chart boundary is a classic reason a benchmark programme sits stuck just short of complete for months. Identify that owner before you start, not when you are chasing the last dozen findings.

Putting it together

Read as data rather than as a checklist, the benchmark suggests an order that looks roughly like this:

• First, establish the baseline. Scan the full 160 so you know your actual starting position per control, rather than assuming. You cannot sequence what you have not measured.
• Then close the small sections. Sections 3 and 4 are 7 controls combined. Finish them and take them off the board.
• Then the Level 1 set in Section 5. Identity is the largest block at 63 controls, concentrated in subsections 5.1 and 5.2. Start it early precisely because it will take longest.
• In parallel, assign the 17 manual controls. They need owners and a recurring procedure, not a sprint.
• Then the remaining Level 1 controls across Sections 1, 2, 6, 7, 8 and 9.
• Finally, Level 2 as individual decisions. 46 controls, each with an owner, a business impact assessment, and a written accept-or-remediate outcome.
• Handle the 23 E5 controls separately as a licensing conversation, not a blocker.

None of that order comes from a risk score we invented. It comes from the profile, section and assessment-status fields already attached to every control in v7.0.0.

Measure first, then sequence

Every step above depends on knowing your real per-control position. A sequencing plan built on assumptions about what your tenant already does is a guess with a Gantt chart attached.

ConfigCobra assesses all 160 controls of CIS Microsoft 365 Foundations Benchmark v7.0.0 against your live tenant. The scan is more than 90 percent automated and returns results in 20 to 25 minutes, using read-only Microsoft Graph permissions — no agents to deploy and no admin passwords to share. Each finding carries the severity and the Level 1 or Level 2 profile from the benchmark itself, which means the sequencing logic in this post is already in your results rather than something you have to reconstruct in a spreadsheet.

From there you get copy-paste remediation steps per finding, a CIS-certified PDF report with evidence and a timestamped tenant snapshot for auditors, and continuous scanning with drift detection so a control that regresses after you close it does not go unnoticed until the next audit.

You can see the full control coverage on the CIS Microsoft 365 Benchmark page, or run all 160 controls against your own tenant on the 14-day free trial and replace the guesswork in your plan with your actual numbers.