Microsoft Entra Identity Hardening: What CIS Benchmark Section 5 Checks (63 Controls)

Section 5 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 is the largest section in the benchmark. It carries 63 of the 160 controls, and it covers one service: Microsoft Entra, the identity layer. The next largest section, Microsoft Defender for Office 365, has 19.

That weighting reflects blast radius rather than complexity. A misconfigured sharing link exposes a document. A misconfigured Conditional Access policy exposes the tenant.

How Section 5 is structured

The controls live in the Microsoft Entra admin center and split into three subsections:

• 5.1 — 26 controls: Entra ID tenant settings, external identities, guest access, and application consent
• 5.2 — 32 controls: authentication methods, MFA coverage, Conditional Access, and password protection
• 5.3 — 5 controls: Privileged Identity Management, approval workflows, and access reviews

26 + 32 + 5 = 63. As with every CIS benchmark, controls carry Level 1 (safe, minimal impact) and Level 2 (stricter, security-focused) profile designations.

5.1 — What is granted before authentication matters

Subsection 5.1 is largely about default permissions: what an ordinary user can do in the directory without ever holding an administrative role.

Self-service creation

Three controls cover what users can create on their own. App registration allows users to register custom-developed applications for use within the directory. Tenant creation is available to non-privileged users under Manage tenant in the Entra admin center — the benchmark notes that creating a tenant is recorded in the audit log under category DirectoryManagement, activity Create Company. Dynamic groups populate security group membership automatically from user attributes such as userType, department, or country/region, which means membership — and anything gated on it — can change without an administrator acting.

Application consent

Two controls cover consent. The first governs when end users and group owners may grant consent to applications, and when they must instead request administrator review and approval. The benchmark is explicit about the trade-off: allowing users to grant apps access to data helps them be productive but can represent a risk. The second covers the admin consent workflow, which gives a blocked user a path to request approval by email from designated admins rather than no recourse at all.

Consent is the quietest privilege path in a tenant. It hands an external application standing access to data with no password involved and no further sign-in to evaluate.

Guests and external identities

Three controls cover B2B collaboration. Guest invitations should be limited to specified domains — and the benchmark flags that this list works independently from the OneDrive for Business and SharePoint Online allow/block lists, so restricting one does not restrict the other. A second control restricts what external guest users can see in the directory: guests default to a limited permission level, member users to the full set of user permissions. The third addresses who may invite. By default all users in the organization, including existing B2B collaboration guest users, can invite further external users; the benchmark narrows this to certain roles.

Session and sign-in surface

The remaining five controls in 5.1 trim the sign-in surface. Legacy per-user MFA — the pre-Conditional Access model introduced in earlier versions of Office 365 — is assessed here. Stay signed in, also shown as Keep me signed in, creates a persistent refresh token when a user accepts the prompt; that token lasts 90 days by default and does not prompt for sign-in or multifactor in the meantime. Non-privileged users are restricted from signing into the Entra admin center, with a caveat the benchmark states plainly: this affects the web portal only and does not prevent other channels such as REST API or PowerShell, which are addressed elsewhere in the benchmark. LinkedIn account connections, which link a work or school account to LinkedIn and surface LinkedIn data inside Microsoft apps, are also covered. Finally, password hash synchronization is assessed for hybrid environments, where Entra Connect synchronizes a hash of the hash of a password from on-premises Active Directory.

5.2 — Authentication and Conditional Access (32 controls)

This is the densest subsection in the whole benchmark, and the one tenants tend to fail partially rather than cleanly.

MFA coverage is three controls, not one

The benchmark checks administrator roles and all users separately, then checks something subtler: whether member users are MFA capable. Microsoft defines that as registered and enabled for a strong authentication method that is also permitted by the authentication methods policy. A tenant can require MFA and still contain users who cannot satisfy the requirement — enforcement and capability are different states, and Section 5 tests both.

Legacy authentication

Entra ID still supports legacy authentication, including basic authentication — the industry-standard method of collecting username and password directly. Basic auth cannot present a second-factor prompt, so any messaging protocol still permitted to use it is a bypass around every MFA control above it. One control covers blocking it.

Which factors actually count

Four controls govern the quality of the second factor rather than its presence:

• Authentication strength — a Conditional Access control specifying which combination of authentication methods may access a resource, so phishing-resistant methods can be required for sensitive resources specifically.
• Authentication methods policy — the benchmark notes that SMS and Voice Call rely on telephony carrier communication, and treats methods as unequal rather than interchangeable.
• System-preferred MFA — prompts the user with the most secure method they have registered, in an order that is dynamic and updated by Microsoft as the security landscape changes.
• Authenticator additional context — shows the geographic location of the request and the requesting application in the push prompt, so the person approving has enough context to refuse.

Conditional Access and risk

Seven controls cover the shape of Conditional Access policy. Three are risk-based: one on Microsoft Entra ID Protection user risk, which detects the probability that an account has been compromised, and two on sign-in risk, which detects in real time and offline that a sign-in attempt might not have been performed by the legitimate owner of the account. The benchmark records Microsoft guidance that risk-based policies belong in Conditional Access rather than in the two built-in Identity Protection policies with their limited conditions.

Two more require device compliance or Entra hybrid join, which lets Conditional Access classify devices as managed or unmanaged. One applies to resource access generally; the other applies specifically to MFA registration, which closes the case where an attacker enrolls their own second factor from an unmanaged device.

Sign-in frequency is a control of its own: the Entra ID default is a rolling window of 90 days, and the benchmark recommends a sign-in frequency of Every time for specific applications instead of accepting that default. The last of the seven covers Conditional Access policies that target specific user accounts, for scenarios such as access from an unmanaged or shared device.

The device authorization grant

One control covers the device authorization grant — the device code flow that lets users sign in to input-constrained devices such as a smart TV, IoT device, or printer by visiting a webpage in a browser on another device. It is a legitimate feature and a live phishing vector, because the victim completes a genuine authentication for a session someone else started. We covered the mechanics separately in device-code phishing and the CIS hardening that stops it.

Passwords

Three controls remain. Entra Password Protection applies global banned password lists to all users automatically; a custom banned password list adds organization-specific terms, checked whenever users change or reset a password. A second control extends Entra Password Protection to on-premises Active Directory Domain Services. The third covers self-service password reset, which prompts users for the additional contact information needed to reset a password later.

5.3 — Privileged Identity Management (5 controls)

The smallest subsection, built around one idea: privileged access should be temporary and reviewed.

The first control removes permanent members from privileged Microsoft 365 roles and makes them eligible instead, activating through a just-in-time workflow. Two more require approval before activation, so a selected approver reviews the request before Privileged Identity Management grants the role. The remaining two cover access reviews — an automated recurring process for reviewing group memberships, access to enterprise applications, and role assignments, with the reviewing itself delegable.

Standing administrators are among the findings most likely to matter during an incident, and they are also the easiest to accumulate quietly: granted for a migration, never revoked.

Why Section 5 drifts

Identity controls regress differently from sharing controls. Sharing settings get loosened for convenience. Identity settings get loosened for a specific person or account — a service account that cannot do MFA, a break-glass account excluded from Conditional Access, a vendor given a role for one project. Each exception is defensible in isolation, and each one outlives the reason it was created.

Conditional Access exclusions are the clearest case: a policy reports as enabled and enforced while the accounts that matter most sit outside it. That gap does not show up in a policy list, only in the exclusion detail — we wrote about it in Conditional Access exclusions: the quiet gap in your MFA rollout.

How ConfigCobra assesses Section 5

ConfigCobra evaluates the Section 5 controls as part of a full CIS Microsoft 365 Foundations Benchmark v7.0.0 assessment. The scan connects to your tenant using read-only Microsoft Graph permissions — no agents, no admin password sharing — and returns results for all 160 controls across all 9 sections in 20–25 minutes.

Each finding returns its status against the recommended state, the evidence behind it, the CIS remediation procedure, and a copy-paste remediation script or admin portal steps where applicable. Severity is tagged per control from the benchmark itself. Results export to a CIS-certified PDF report with a timestamped tenant snapshot.

Because identity configuration drifts one exception at a time rather than breaking outright, continuous scanning and drift detection is what catches it — you are alerted when a control that previously passed regresses, instead of discovering it at the next audit.

Run it against your own tenant

Start a free trial, 14 days with full access, to see where your Entra identity configuration stands today.

The rest of the series

• Section 1 — Microsoft 365 admin center (15 controls)
• Section 2 — Microsoft Defender for Office 365 (21 controls)
• Section 6 — Exchange Online (13 controls)
• Section 7 — SharePoint Online and OneDrive (12 controls)
• Section 8 — Microsoft Teams (17 controls)

For every section control count in the benchmark, see the CIS Microsoft 365 Foundations Benchmark page.