The 46 Level 2 Controls in CIS Microsoft 365 v7.0.0 (and When to Do Them)

Every recommendation in the CIS Microsoft 365 Foundations Benchmark v7.0.0 carries a profile, and that profile is the most useful field in the whole catalogue for deciding what to do and when. Of the 160 controls in v7.0.0, 114 are Level 1 and 46 are Level 2.

Level 1 is the safe baseline: settings that raise the security floor with minimal impact on how people work. Level 2 is stricter and security-focused — the tier you adopt deliberately, when the data in the tenant justifies inconveniencing the people using it. The distinction is not difficulty. It is consent.

This post lists all 46 Level 2 controls in v7.0.0, shows where they cluster, and separates the ones that are a toggle from the ones that are a conversation.

The split, by the numbers

• 160 controls in v7.0.0 across 9 sections.
• 114 Level 1 and 46 Level 2.
• Of the 46 Level 2 controls, 40 are Automated and 6 are Manual.
• By licence profile: 37 are E3 Level 2 and 9 are E5 Level 2.

The automation ratio is worth pausing on. Level 2 is not disproportionately hand-checked — 40 of its 46 controls carry an Automated assessment status, in line with the 143 of 160 across the benchmark as a whole. Measuring Level 2 is not the hard part. Agreeing to it is.

Where the 46 sit

Level 2 is not spread evenly across the nine sections. Counted as Level 2 controls out of each section total:

• Section 1 — Microsoft 365 admin center: 6 of 15
• Section 2 — Microsoft Defender / Defender for Office 365: 6 of 21
• Section 3 — Microsoft Purview: 0 of 5
• Section 4 — Microsoft Intune: 0 of 2
• Section 5 — Microsoft Entra (Identity): 18 of 63
• Section 6 — Microsoft Exchange Online: 3 of 13
• Section 7 — Microsoft SharePoint Online & OneDrive: 5 of 12
• Section 8 — Microsoft Teams: 7 of 17
• Section 9 — Microsoft Fabric / Power BI: 1 of 12

Three things fall out of that distribution. Purview and Intune are entirely Level 1 — all 7 of their controls are baseline, so there is nothing in those two sections to defer to a second phase. Entra carries 18 of the 46, more than a third, so a Level 2 programme is mostly an identity programme. And Teams is the densest collaboration surface at 7, all of them about who is allowed into a meeting and what they can do once inside.

The full list of 46 Level 2 controls

Recommendation number, title, and licence profile, exactly as they appear in v7.0.0. Controls flagged Manual carry a Manual assessment status; the rest are Automated.

Section 1 — Microsoft 365 admin center (6)

• 1.2.1 Ensure that only organizationally managed/approved public groups exist — E3
• 1.3.2 Ensure ‘Idle session timeout’ is set to ‘3 hours (or less)’ for unmanaged devices — E3
• 1.3.3 Ensure ‘External sharing’ of calendars is not available — E3
• 1.3.6 Ensure the customer lockbox feature is enabled — E5
• 1.3.7 Ensure ‘third-party storage services’ are restricted in ‘Microsoft 365 on the web’ — E3
• 1.3.8 Ensure that Sways cannot be shared with people outside of your organization — E3, Manual

Section 2 — Microsoft Defender / Defender for Office 365 (6)

• 2.1.1 Ensure Safe Links for Office Applications is Enabled — E5
• 2.1.4 Ensure Safe Attachments policy is enabled — E5
• 2.1.5 Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled — E5
• 2.1.7 Ensure that an anti-phishing policy has been created — E5
• 2.1.11 Ensure comprehensive attachment filtering is applied — E3
• 2.4.3 Ensure Microsoft Defender for Cloud Apps is enabled and configured — E5, Manual

Section 5 — Microsoft Entra, Identity (18)

• 5.1.2.5 Ensure the option to remain signed in is hidden — E3, Manual
• 5.1.2.6 Ensure ‘LinkedIn account connections’ is disabled — E3, Manual
• 5.1.3.2 Ensure that ‘Restrict user ability to access groups features in My Groups’ is set to ‘Yes’ — E3, Manual
• 5.1.3.4 Ensure that ‘Users can create Microsoft 365 groups in Azure portals, API or PowerShell’ is set to ‘No’ — E3
• 5.1.4.1 Ensure the ability to join devices to Entra is restricted — E3
• 5.1.4.6 Ensure users are restricted from recovering BitLocker keys — E3
• 5.1.5.1 Ensure user consent to apps accessing company data on their behalf is not allowed — E3
• 5.1.5.3 Ensure password addition is blocked for applications — E3
• 5.1.6.1 Ensure that collaboration invitations are sent to allowed domains only — E3
• 5.1.6.3 Ensure guest user invitations are limited — E3

• 5.2.2.5 Ensure ‘Phishing-resistant MFA strength’ is required for Administrators — E3
• 5.2.2.8 Ensure ‘sign-in risk’ is blocked for medium and high risk — E5
• 5.2.2.14 Ensure trusted ‘named locations’ are defined — E3
• 5.2.2.15 Ensure exclusionary geographic access controls are utilized — E3
• 5.2.2.16 Ensure Token Protection is enforced for session tokens — E3
• 5.2.3.7 Ensure the email OTP authentication method is disabled — E3
• 5.2.4.2 Ensure that 2 methods are required for password reset — E3, Manual
• 5.3.1 Ensure privileged role assignments are activated and not assigned — E5

Section 6 — Microsoft Exchange Online (3)

• 6.3.1 Ensure users installing Outlook add-ins is not allowed — E3
• 6.5.3 Ensure additional storage providers are restricted in Outlook on the web — E3
• 6.5.5 Ensure Direct Send submissions are rejected — E3

Section 7 — SharePoint Online & OneDrive (5)

• 7.2.4 Ensure OneDrive content sharing is restricted — E3
• 7.2.5 Ensure that SharePoint guest users cannot share items they do not own — E3
• 7.2.6 Ensure SharePoint external sharing is restricted — E3
• 7.2.8 Ensure external sharing is restricted by security group — E3
• 7.3.1 Ensure Office 365 SharePoint infected files are disallowed for download — E5

Section 8 — Microsoft Teams (7)

• 8.1.1 Ensure external file sharing in Teams is enabled for only approved cloud storage services — E3
• 8.2.1 Ensure external domains are restricted in the Teams admin center — E3
• 8.5.1 Ensure anonymous users cannot join a meeting — E3
• 8.5.5 Ensure meeting chat does not allow anonymous users — E3
• 8.5.6 Ensure only organizers and co-organizers can present — E3
• 8.5.8 Ensure external meeting chat is off — E3
• 8.5.9 Ensure meeting recording is off by default — E3

Section 9 — Microsoft Fabric / Power BI (1)

• 9.1.5 Ensure ‘Interact with and share R and Python’ visuals is ‘Disabled’ — E3

The six you cannot script

Six of the 46 carry a Manual assessment status, which means no API call settles them — someone has to look:

• 1.3.8 Sways cannot be shared externally
• 2.4.3 Defender for Cloud Apps is enabled and configured
• 5.1.2.5 The option to remain signed in is hidden
• 5.1.2.6 LinkedIn account connections is disabled
• 5.1.3.2 Restrict user ability to access groups features in My Groups
• 5.2.4.2 Two methods are required for password reset

Four of the six sit in Entra, alongside the seven Entra manual controls that are Level 1. If you are already running a review cycle for the benchmark’s 17 manual controls, these six fold into it rather than needing a process of their own.

The nine that need E5

Nine of the 46 carry an E5 profile, and five of those nine are in Section 2:

• 1.3.6 Customer lockbox
• 2.1.1 Safe Links for Office applications
• 2.1.4 Safe Attachments policy
• 2.1.5 Safe Attachments for SharePoint, OneDrive and Teams
• 2.1.7 Anti-phishing policy
• 2.4.3 Defender for Cloud Apps
• 5.2.2.8 Sign-in risk blocked for medium and high risk
• 5.3.1 Privileged role assignments activated, not assigned
• 7.3.1 Infected files disallowed for download in SharePoint

If your tenant is on E3, those nine are not failures — they are out of scope until the licence changes, and a report that grades them as gaps is measuring the wrong thing. The other 37 Level 2 controls are all reachable on E3. For the full licence picture across all 160 controls, see which controls need E5.

What Level 2 actually asks of your users

Read the 46 titles back to back and a pattern emerges. Level 2 is where the benchmark stops hardening the tenant behind the scenes and starts removing things people use:

• Meetings get tighter. Anonymous users cannot join, anonymous chat is off, external meeting chat is off, recording is off by default, and only organizers present. That is five of the seven Teams controls.
• Sharing narrows. External calendar sharing off, OneDrive content sharing restricted, SharePoint external sharing restricted and scoped to security groups, guests blocked from resharing, Teams file sharing limited to approved providers.
• Self-service ends. No user app consent, no self-recovery of BitLocker keys, no user-installed Outlook add-ins, no group creation from the portal or PowerShell, no third-party storage in Microsoft 365 on the web.
• Sign-in gets stricter. Phishing-resistant MFA for administrators, token protection on session tokens, named locations, geographic exclusions, email OTP disabled, remain-signed-in hidden.

Every one of those generates a helpdesk ticket the week it ships. That is precisely why CIS put them in the second tier instead of the baseline — not because they are harder to configure, but because they need a decision from someone who owns the trade-off.

A workable order for the 46

1. Finish Level 1 first. All 114 of them. A tenant with Level 2 meeting restrictions and an unfinished Level 1 identity baseline has inconvenienced its users without closing the gap that matters. Our post on sequencing the 160 controls covers the ordering logic in full.
2. Measure the 40 automated Level 2 controls before changing any of them. A good share of them are usually already compliant, either from an earlier hardening project or because Microsoft shipped a safer default. Knowing which 40 you actually have to fight for shrinks the argument.
3. Take Entra next. Eighteen of the 46 are there, and most of them — app consent, BitLocker key recovery, device join, guest invitations — are administrative restrictions with a much smaller blast radius than the Teams and SharePoint sharing controls.
4. Batch the collaboration controls into one change window. The 12 Teams and SharePoint or OneDrive Level 2 controls all change what end users can do with external parties. Shipping them together, with one announcement, costs less goodwill than five separate surprises.
5. Park the nine E5 controls behind the licence decision and the six manual ones in your review cycle.

Measure the 46 before you argue about them

Every number in this post comes from the v7.0.0 catalogue itself, and that is the point: the profile field is data, not opinion. The question that decides your Level 2 programme is not what the benchmark says — it is which of the 46 your tenant already passes.

ConfigCobra assesses all 160 controls of CIS Microsoft 365 Foundations Benchmark v7.0.0 in one read-only scan, results in 20 to 25 minutes, using read-only Microsoft Graph permissions — no agents and no shared admin passwords. Both profiles are covered, each finding carries the severity tagged in the benchmark, and the output is a CIS-certified PDF report with evidence and copy-paste remediation steps per finding.

Start with the free trial — 14 days with full access.