Microsoft 365 · 160 controls
CIS Microsoft 365 Foundations v7.0.0 checklist
Every control in one list, in our own wording, with the CIS ID and profile. Use it to plan a review, or let ConfigCobra run it for you.
160 controls
| CIS ID | Check | Section | Profile | Assessment |
|---|---|---|---|---|
| 1.1.1 | Administrative accounts should be cloud-only, not synced from on-premises | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.1.2 | Two emergency access accounts have been defined | Microsoft 365 admin center | E3 Level 1 | Manual |
| 1.1.3 | The number of Global Administrators should be between two and four | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.1.4 | Administrative accounts should use a license with a reduced application footprint | Microsoft 365 admin center | E3 Level 1 | Manual |
| 1.2.1 | Microsoft 365 groups should not be publicly visible | Microsoft 365 admin center | E3 Level 2 | Automated |
| 1.2.2 | Sign-in to shared mailboxes should be blocked | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.3.1 | The password expiration policy should be set to never expire | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.3.2 | Idle session timeout for unmanaged devices should be three hours or less | Microsoft 365 admin center | E3 Level 2 | Automated |
| 1.3.3 | External calendar sharing should be turned off | Microsoft 365 admin center | E3 Level 2 | Automated |
| 1.3.4 | User-owned apps and services should be restricted | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.3.5 | Internal phishing protection for Microsoft Forms should be enabled | Microsoft 365 admin center | E3 Level 1 | Automated |
| 1.3.6 | The Customer Lockbox feature should be enabled | Microsoft 365 admin center | E5 Level 2 | Automated |
| 1.3.7 | Third-party storage should be restricted in Microsoft 365 on the web | Microsoft 365 admin center | E3 Level 2 | Automated |
| 1.3.8 | That Sways cannot be shared with people outside of your organization | Microsoft 365 admin center | E3 Level 2 | Manual |
| 1.3.9 | Shared Bookings pages should be restricted to selected users | Microsoft 365 admin center | E3 Level 1 | Automated |
| 2.1.1 | Safe Links for Office Applications should be enabled | Microsoft Defender | E5 Level 2 | Automated |
| 2.1.2 | The common attachment types filter should be enabled | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.3 | Notifications for internal users sending malware should be enabled | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.4 | Safe Attachments policy should be enabled | Microsoft Defender | E5 Level 2 | Automated |
| 2.1.5 | Safe Attachments for SharePoint, OneDrive, and Microsoft Teams should be enabled | Microsoft Defender | E5 Level 2 | Automated |
| 2.1.6 | Exchange Online spam policies should notify administrators | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.7 | An anti-phishing policy should be created and configured | Microsoft Defender | E5 Level 2 | Automated |
| 2.1.8 | SPF records should be published for all Exchange Online domains | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.9 | DKIM should be enabled for all Exchange Online domains | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.10 | DMARC records should be published for all Exchange Online domains | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.11 | Comprehensive attachment filtering should be applied | Microsoft Defender | E3 Level 2 | Automated |
| 2.1.12 | The connection filter IP allow list should not be used | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.13 | The connection filter safe list should be turned off | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.14 | Inbound anti-spam policies should not contain allowed domains | Microsoft Defender | E3 Level 1 | Automated |
| 2.1.15 | Outbound anti-spam message limits should be in place | Microsoft Defender | E3 Level 1 | Automated |
| 2.2.1 | Emergency access account activity is monitored | Microsoft Defender | E5 Level 1 | Manual |
| 2.4.1 | Priority account protection should be enabled and configured | Microsoft Defender | E5 Level 1 | Automated |
| 2.4.2 | Priority accounts should have Strict protection presets applied | Microsoft Defender | E5 Level 1 | Automated |
| 2.4.3 | Microsoft Defender for Cloud Apps is enabled and configured | Microsoft Defender | E5 Level 2 | Manual |
| 2.4.4 | Zero-hour auto purge for Microsoft Teams should be enabled | Microsoft Defender | E5 Level 1 | Automated |
| 2.4.5 | 'AIR' remediation is enabled | Microsoft Defender | E5 Level 1 | Manual |
| 3.1.1 | Microsoft 365 audit log search should be enabled | Microsoft Purview | E3 Level 1 | Automated |
| 3.2.1 | DLP policies should be enabled | Microsoft Purview | E3 Level 1 | Automated |
| 3.2.2 | DLP policies should be enabled for Microsoft Teams | Microsoft Purview | E5 Level 1 | Automated |
| 3.2.3 | DLP policies should be published for Copilot users | Microsoft Purview | E5 Level 1 | Automated |
| 3.3.1 | Sensitivity label policies should be set up and used | Microsoft Purview | E3 Level 1 | Automated |
| 4.1 | Devices with no compliance policy should be marked not compliant | Microsoft Intune | E3 Level 1 | Automated |
| 4.2 | Device enrollment for personally owned devices should be blocked | Microsoft Intune | E3 Level 1 | Automated |
| 5.1.2.1 | 'Per-user MFA' is disabled | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.1.2.2 | Users should not be allowed to register third-party applications | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.2.3 | Non-admin users should not be allowed to create tenants | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.2.4 | Access to the Entra admin center is restricted | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.1.2.5 | The option to remain signed in is hidden | Microsoft Entra (Identity) | E3 Level 2 | Manual |
| 5.1.2.6 | 'LinkedIn account connections' is disabled | Microsoft Entra (Identity) | E3 Level 2 | Manual |
| 5.1.3.1 | Users should not be allowed to create security groups | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.3.2 | That 'Restrict user ability to access groups features in My Groups' is set to 'Yes' | Microsoft Entra (Identity) | E3 Level 2 | Manual |
| 5.1.3.3 | That 'Owners can manage group membership requests in My Groups' is set to 'No' | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.1.3.4 | Microsoft 365 group creation should be limited to administrators | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.4.1 | The ability to join devices to Entra should be restricted | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.4.2 | Maximum number of devices per user should be limited | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.4.3 | Global Administrators should not be added as local admin during Entra join | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.4.4 | Local admin assignment during Entra join should be restricted | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.4.5 | Local Administrator Password Solution (LAPS) should be enabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.4.6 | Users should be restricted from reading BitLocker keys for owned devices | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.5.1 | User consent to apps accessing company data should not be allowed | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.5.2 | The admin consent workflow should be enabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.5.3 | Password addition should be blocked for applications | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.5.4 | Password lifetime for applications should not exceed 180 days | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.5.5 | Custom password addition should be blocked for applications | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.5.6 | Certificate lifetime for applications should not exceed 180 days | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.6.1 | Collaboration invitations should be sent to allowed domains only | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.6.2 | Guest user access should be restricted | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.1.6.3 | Guest invitations should be limited to the Guest Inviter role | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.1.8.1 | Password hash sync should be enabled for hybrid deployments | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.1 | MFA should be required for all users in administrative roles | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.2 | MFA should be required for all users | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.3 | Legacy authentication should be blocked via Conditional Access | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.4 | Sign-in frequency and persistent browser for admins should be enforced | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.5 | Phishing-resistant MFA strength should be required for administrators | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.2.2.6 | Identity Protection user risk policies should be enabled | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 5.2.2.7 | Identity Protection sign-in risk policies should be enabled | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 5.2.2.8 | Sign-in risk should be blocked for medium and high risk levels | Microsoft Entra (Identity) | E5 Level 2 | Automated |
| 5.2.2.9 | A managed device should be required for authentication | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.10 | A managed device should be required for MFA registration | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.11 | Sign-in frequency for Intune enrollment should be set to every time | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.12 | The device code sign-in flow should be blocked | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.13 | Periodic reauthentication should be required for all users | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.2.14 | Named locations should be defined and trusted | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.2.2.15 | Exclusionary geographic access controls should be used | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.2.2.16 | Token protection should be enforced for session tokens | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.2.2.17 | Authentication transfer should be blocked | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.1 | Microsoft Authenticator should be configured to protect against MFA fatigue | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.2 | Custom banned passwords should be configured | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.3 | Password protection for on-premises AD should be enabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.4 | All member users should be MFA capable | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.5 | Weak authentication methods (SMS, Voice) should be disabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.6 | System-preferred multifactor authentication should be enabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.7 | Email OTP authentication method should be disabled | Microsoft Entra (Identity) | E3 Level 2 | Automated |
| 5.2.3.8 | Account lockout threshold should be 10 or less | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.9 | Account lockout duration should be at least 60 seconds | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.3.10 | Microsoft Authenticator on companion applications should be disabled | Microsoft Entra (Identity) | E3 Level 1 | Automated |
| 5.2.4.1 | 'Self service password reset enabled' is set to 'All' | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.2.4.2 | That 2 methods are required for password reset | Microsoft Entra (Identity) | E3 Level 2 | Manual |
| 5.2.4.3 | SSPR registration and authentication re-confirmation are required | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.2.4.4 | That users are notified on password resets | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.2.4.5 | All admins are notified when other admins reset their password | Microsoft Entra (Identity) | E3 Level 1 | Manual |
| 5.3.1 | Privileged role assignments should be activated not permanent | Microsoft Entra (Identity) | E5 Level 2 | Automated |
| 5.3.2 | Access reviews for guest users should be configured | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 5.3.3 | Access reviews for privileged roles should be configured | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 5.3.4 | Approval should be required for Global Administrator role activation | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 5.3.5 | Approval should be required for Privileged Role Administrator activation | Microsoft Entra (Identity) | E5 Level 1 | Automated |
| 6.1.1 | Ensure 'AuditDisabled' organizationally is set to 'False' | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.1.2 | Ensure mailbox audit actions are configured | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.1.3 | Ensure 'AuditBypassEnabled' is not enabled on mailboxes | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.2.1 | Ensure all forms of mail forwarding are blocked and/or disabled | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.2.2 | Ensure mail transport rules do not whitelist specific domains | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.2.3 | Ensure email from external senders is identified | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.3.1 | Ensure users installing Outlook add-ins is not allowed | Microsoft Exchange Online | E3 Level 2 | Automated |
| 6.3.2 | Ensure the ability to add personal email accounts and calendars is disabled | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.5.1 | Modern authentication for Exchange Online should be enabled | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.5.2 | Ensure MailTips are enabled for end users | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.5.3 | Ensure additional storage providers are restricted in Outlook on the web | Microsoft Exchange Online | E3 Level 2 | Automated |
| 6.5.4 | Ensure SMTP AUTH is disabled | Microsoft Exchange Online | E3 Level 1 | Automated |
| 6.5.5 | Ensure Direct Send submissions are rejected | Microsoft Exchange Online | E3 Level 2 | Automated |
| 7.2.1 | Ensure modern authentication for SharePoint applications is required | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.2 | Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.3 | Ensure external content sharing is restricted | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.4 | Ensure OneDrive content sharing is restricted | Microsoft SharePoint Online & OneDrive | E3 Level 2 | Automated |
| 7.2.5 | Ensure that SharePoint guest users cannot share items they don't own | Microsoft SharePoint Online & OneDrive | E3 Level 2 | Automated |
| 7.2.6 | Ensure SharePoint external sharing is managed through domain whitelist/blacklists | Microsoft SharePoint Online & OneDrive | E3 Level 2 | Automated |
| 7.2.7 | Ensure link sharing is restricted in SharePoint and OneDrive | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.8 | Ensure external sharing is restricted by security group | Microsoft SharePoint Online & OneDrive | E3 Level 2 | Automated |
| 7.2.9 | Ensure guest access to a site or OneDrive will expire automatically | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.10 | Ensure reauthentication with verification code is restricted | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.2.11 | Ensure the SharePoint default sharing link permission is set | Microsoft SharePoint Online & OneDrive | E3 Level 1 | Automated |
| 7.3.1 | Ensure Office 365 SharePoint infected files are disallowed for download | Microsoft SharePoint Online & OneDrive | E5 Level 2 | Automated |
| 8.1.1 | Ensure external file sharing in Teams is enabled for only approved cloud storage services | Microsoft Teams | E3 Level 2 | Automated |
| 8.1.2 | Ensure users can't send emails to a channel email address | Microsoft Teams | E3 Level 1 | Automated |
| 8.2.1 | Ensure external domains are restricted in the Teams admin center | Microsoft Teams | E3 Level 2 | Automated |
| 8.2.2 | Ensure communication with unmanaged Teams users is disabled | Microsoft Teams | E3 Level 1 | Automated |
| 8.2.3 | Ensure external Teams users cannot initiate conversations | Microsoft Teams | E3 Level 1 | Automated |
| 8.2.4 | Ensure the organization cannot communicate with accounts in trial Teams tenants | Microsoft Teams | E3 Level 1 | Automated |
| 8.4.1 | App permission policies are configured | Microsoft Teams | E3 Level 1 | Manual |
| 8.5.1 | Ensure anonymous users can't join a meeting | Microsoft Teams | E3 Level 2 | Automated |
| 8.5.2 | Ensure anonymous users and dial-in callers can't start a meeting | Microsoft Teams | E3 Level 1 | Automated |
| 8.5.3 | Ensure only people in my org can bypass the lobby | Microsoft Teams | E3 Level 1 | Automated |
| 8.5.4 | Ensure users dialing in can't bypass the lobby | Microsoft Teams | E3 Level 1 | Automated |
| 8.5.5 | Ensure meeting chat does not allow anonymous users | Microsoft Teams | E3 Level 2 | Automated |
| 8.5.6 | Ensure only organizers and co-organizers can present | Microsoft Teams | E3 Level 2 | Automated |
| 8.5.7 | Ensure external participants can't give or request control | Microsoft Teams | E3 Level 1 | Automated |
| 8.5.8 | Ensure external meeting chat is off | Microsoft Teams | E3 Level 2 | Automated |
| 8.5.9 | Ensure meeting recording is off by default | Microsoft Teams | E3 Level 2 | Automated |
| 8.6.1 | Ensure users can report security concerns in Teams | Microsoft Teams | E5 Level 1 | Automated |
| 9.1.1 | Ensure guest user access is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.2 | Ensure external user invitations are restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.3 | Ensure guest access to content is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.4 | Ensure 'Publish to web' is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.5 | Ensure 'Interact with and share R and Python' visuals is 'Disabled' | Microsoft Fabric / Power BI | E3 Level 2 | Automated |
| 9.1.6 | Ensure 'Allow users to apply sensitivity labels for content' is 'Enabled' | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.7 | Ensure shareable links are restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.8 | Ensure enabling of external data sharing is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.9 | Ensure 'Block ResourceKey Authentication' is 'Enabled' | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.10 | Ensure access to APIs by service principals is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.11 | Ensure service principals cannot create and use profiles | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
| 9.1.12 | Ensure service principals ability to create workspaces, connections and pipelines is restricted | Microsoft Fabric / Power BI | E3 Level 1 | Automated |
5 of 160 checks have their own page so far. Check titles are ConfigCobra wording with CIS numbering.