CIS Microsoft 365 Foundation.
90%+ of controls, automated.
The Center for Internet Security's Microsoft 365 Foundations Benchmark v5.0.0 is the industry-standard set of security configurations for Microsoft 365. ConfigCobra evaluates every control automatically — all 129 controls, across all 9 sections.
The industry-standard baseline for Microsoft 365 security.
The Center for Internet Security (CIS) is a non-profit organisation maintained by a global community of security experts. The CIS Benchmarks are prescriptive configuration recommendations for hardening operating systems, cloud platforms, and SaaS applications — used by governments, regulators, and security auditors worldwide.
The Microsoft 365 Foundations Benchmark (v5.0.0) covers 129 individual controls across the Microsoft 365 admin center, Microsoft Entra (Identity), Microsoft Defender, Microsoft Purview, Microsoft Intune, Exchange Online, SharePoint Online & OneDrive, Microsoft Teams, and Microsoft Fabric (Power BI) — every Microsoft 365 service in scope for a typical compliance audit.
ConfigCobra is a CIS Member organisation and implements the full CIS Microsoft 365 Foundations Benchmark v5.0.0, including all Level 1 and Level 2 controls.
129 controls across 9 sections.
Every Microsoft 365 admin surface has its own CIS section. ConfigCobra walks every section in a single scan.
Level 1 or Level 2 — pick the right depth for your environment.
Foundational hardening
Safe defaults for every Microsoft 365 tenant.
Controls that should be applied to virtually every organisation. Implementing Level 1 should not cause service disruption or reduce functionality for typical users.
- Recommended starting point for most teams
- Low / no impact on user experience
- Appropriate for most organisations as a starting point
Enhanced security
Stricter controls for regulated industries.
Controls intended for environments with higher security requirements (financial services, healthcare, government). Some Level 2 controls may affect functionality and warrant testing before deployment.
- Required for high-assurance environments
- Includes Level 1 plus additional controls
- Suitable for regulated and high-assurance environments
Connect once. Every control evaluated automatically.
ConfigCobra connects to your Microsoft 365 tenant with read-only OAuth and walks every CIS control programmatically — pulling the current configuration via Microsoft Graph API and comparing it against the benchmark requirement.
- Full 129-control scan across all 9 sections — results in 20–25 minutes
- Covers the Microsoft 365 admin center, Entra, Defender, Purview, Intune, Exchange, SharePoint/OneDrive, Teams, and Fabric/Power BI
- Per-control evidence with the actual policy value, not just pass/fail
- CIS-certified PDF report ready for auditors on demand