The 17 CIS Microsoft 365 Controls You Have to Check by Hand

Automated assessment is the whole reason a 160-control benchmark is workable at all. But the CIS Microsoft 365 Foundations Benchmark v7.0.0 does not claim every recommendation can be machine-checked. Each of its 160 controls carries an Assessment Status of either Automated or Manual, and the split is exact: 143 Automated, 17 Manual.

Those 17 are the ones that quietly derail hardening projects. A tool reports 143 results, the remaining 17 sit in a “needs review” bucket, and six months later nobody has looked at them because nobody ever owned them. They are also not evenly spread — 11 of the 17 sit in a single section. This post lists all 17, shows where they cluster, and describes what each one asks you to confirm.

The split, by the numbers

Across the full CIS Microsoft 365 Foundations Benchmark v7.0.0 catalogue of 160 controls in 9 sections:

• 143 Automated — the audit procedure can be satisfied by reading tenant configuration.
• 17 Manual — the audit procedure needs a person to look at something configuration state alone does not settle.

By profile, the 17 manual controls break down as 9 E3 Level 1, 5 E3 Level 2, 2 E5 Level 1, and 1 E5 Level 2 — so 11 are Level 1 and 6 are Level 2. That matters for scoping: a Level 1 baseline does not let you skip the manual work. Eleven of these land inside the first, least-negotiable tier.

Where the 17 actually live

Only four of the benchmark’s nine sections contain manual controls at all:

• Section 1 — Microsoft 365 admin center: 2 (of 15 controls in the section)
• Section 2 — Microsoft Defender / Defender for Office 365: 3 (of 21)
• Section 5 — Microsoft Entra (Identity): 11 (of 63)
• Section 8 — Microsoft Teams: 1 (of 17)

Sections 3 (Microsoft Purview), 4 (Microsoft Intune), 6 (Exchange Online), 7 (SharePoint Online & OneDrive) and 9 (Microsoft Fabric / Power BI) contain no manual controls in v7.0.0. If your manual review queue holds anything from those five sections, that queue is not the benchmark’s — it is your tooling’s.

The practical consequence: almost two thirds of the manual work is identity work, in a single admin surface. That makes it schedulable. One person, one session in the Microsoft Entra admin center, covers 11 of the 17.

The full list of 17 manual controls

Section 1 — Microsoft 365 admin center

• 1.1.2 — Ensure two emergency access accounts have been defined (E3 Level 1)
• 1.3.8 — Ensure that Sways cannot be shared with people outside of your organization (E3 Level 2)

1.1.2 is the one to do first, and it is the clearest illustration of why Manual exists as a status. Counting two accounts is trivial; confirming they are genuinely usable break-glass accounts — credentials stored where an outage cannot lock you out of them, ownership that survives staff turnover, a documented procedure for use — is a judgement about your operating practice, not a tenant setting.

Section 2 — Microsoft Defender / Defender for Office 365

• 2.2.1 — Ensure emergency access account activity is monitored (E5 Level 1)
• 2.4.3 — Ensure Microsoft Defender for Cloud Apps is enabled and configured (E5 Level 2)
• 2.4.5 — Ensure ‘AIR’ remediation is enabled (E5 Level 1)

All three carry E5 profiles, so they fall outside the scope of an E3-only tenant. Note the pairing between 1.1.2 and 2.2.1: the benchmark asks you to define emergency access accounts, then asks separately whether anyone would notice if one of them were used. Both halves are manual, and reviewing them together is more efficient than treating them as two unrelated queue items.

2.4.3 is the broadest item on this list. “Enabled and configured” is not a boolean, which is precisely why it is not automated — a reviewer has to decide whether the configuration is meaningful for your environment.

Section 5 — Microsoft Entra (Identity)

• 5.1.2.1 — Ensure ‘Per-user MFA’ is disabled (E3 Level 1)
• 5.1.2.4 — Ensure access to the Entra admin center is restricted (E3 Level 1)
• 5.1.2.5 — Ensure the option to remain signed in is hidden (E3 Level 2)
• 5.1.2.6 — Ensure ‘LinkedIn account connections’ is disabled (E3 Level 2)
• 5.1.3.2 — Ensure that ‘Restrict user ability to access groups features in My Groups’ is set to ‘Yes’ (E3 Level 2)
• 5.1.3.3 — Ensure that ‘Owners can manage group membership requests in My Groups’ is set to ‘No’ (E3 Level 1)

• 5.2.4.1 — Ensure ‘Self service password reset enabled’ is set to ‘All’ (E3 Level 1)
• 5.2.4.2 — Ensure that 2 methods are required for password reset (E3 Level 2)
• 5.2.4.3 — Ensure SSPR registration and authentication re-confirmation are required (E3 Level 1)
• 5.2.4.4 — Ensure that users are notified on password resets (E3 Level 1)
• 5.2.4.5 — Ensure all admins are notified when other admins reset their password (E3 Level 1)

Every one of the 11 carries an E3 profile, meaning none of them can be deferred on licensing grounds. Seven are Level 1. For the rest of this section — the 52 controls that are automated — see the walkthrough of the Microsoft Entra identity controls.

Two clusters are worth calling out.

The self-service password reset block is entirely manual. Subsection 5.2.4 contains exactly 5 controls — 5.2.4.1 through 5.2.4.5 — and all 5 are marked Manual. There is no partial automated coverage to lean on here. If your compliance evidence has a gap, this is statistically the most likely place for it, and the fix is straightforward: review all five in one sitting, in the Microsoft Entra admin center, and record the outcome as a single reviewed unit rather than five orphaned tickets.

Four of the six controls in 5.1.2 are manual. 5.1.2.1, 5.1.2.4, 5.1.2.5 and 5.1.2.6 cover per-user MFA, admin center access, the remain-signed-in prompt, and LinkedIn account connections. They look like unrelated toggles, but they share a reviewer and a surface, so batch them too.

Section 8 — Microsoft Teams

• 8.4.1 — Ensure app permission policies are configured (E3 Level 1)

The only manual control outside sections 1, 2 and 5, and the same pattern as 2.4.3: “configured” is a judgement about whether your app permission policy reflects a deliberate decision on third-party apps in Teams, not a value a scanner can grade.

Working the manual 17 without stalling the project

The 17 are not a reason to distrust automation — the other 143 controls are exactly why automated assessment is worth running. But they need the same treatment as any other control: an owner, a cadence, and written evidence.

Three things make the difference in practice:

• Batch by admin surface, not by control number. Eleven of the 17 are reviewed in the Microsoft Entra admin center, three in Microsoft Defender, two in the Microsoft 365 admin center, one in the Microsoft Teams admin center. Four sittings, not seventeen tickets.
• Do the Level 1 eleven first. If you are scoping a Level 1 baseline, 11 of these 17 are already in scope. Sequencing them behind the automated work is how they get forgotten.
• Re-review them on a schedule. A manual control has no drift alert of its own — nothing tells you when a reviewed-and-approved answer stops being true. Pin them to the same cadence as your automated scans so the review date never trails the scan date by more than one cycle.

Know which 17 apply to your tenant

ConfigCobra assesses all 160 v7.0.0 controls against a live tenant using read-only Microsoft Graph permissions — no agents to install and no admin passwords to share. A scan completes in 20 to 25 minutes, and each result carries the benchmark’s own severity along with its Level 1 or Level 2 profile, so the 11 Level 1 manual items surface alongside the automated findings rather than in a separate spreadsheet. Findings arrive with copy-paste remediation scripts or the admin-portal steps to fix them, and the run exports as a CIS-certified PDF report with evidence and a timestamped tenant snapshot. Schedule it daily, weekly or monthly and you are emailed when a control regresses — which keeps the automated 143 honest while you work the manual 17.

Start the free trial to see where your tenant stands — 14 days with full access to all 160 controls. If you already know your scope, the pricing page breaks the tiers down by licensed M365 user count.