Microsoft 365 admin center

Section 1 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 covers the Microsoft 365 admin center, the console where a tenant's accounts, groups, licences and organisation-wide settings are managed. It contains 15 controls. Because the admin center is where the most powerful roles live, many of its checks are about who holds administrative power and how that power is set up.

The controls fall into three themes. The first is administrative accounts: admin accounts should be cloud-only rather than synced from on-premises, two emergency access accounts should be defined, the number of Global Administrators should stay between two and four, and administrators should use a licence with a reduced application footprint. The second is Microsoft 365 Groups and mailboxes: groups should not be publicly visible, and sign-in to shared mailboxes should be blocked. The third is a set of organisation settings: password expiration policy, idle session timeout for unmanaged devices, external calendar sharing, user-owned apps and services, internal phishing protection for Microsoft Forms, Customer Lockbox, third-party storage in Microsoft 365 on the web, Sway sharing outside the organisation, and shared Bookings pages.

Taken together, the section limits the blast radius of a compromised admin account and closes the small tenant-level toggles that quietly widen sharing or exposure. Several of these settings are easy to leave at their defaults, and others are easy to change by accident later, which is why they matter for ongoing monitoring as well as for a first review.

Each control is listed with its CIS Level 1 or Level 2 profile. Level 1 is the safe, minimal-impact baseline and Level 2 is the stricter, security-focused one, so you can decide how far to go in your own tenant.

How ConfigCobra assesses it. ConfigCobra reads the tenant through read-only Microsoft Graph permissions, with no agents and no admin password sharing, and never changes a setting. A scan returns a result for each of these 15 controls, with a severity estimate that ConfigCobra uses to prioritise remediation (CIS itself publishes no severity). Each failing control comes with a copy-paste remediation script or admin portal steps, and remediation impact analysis shows which users, groups, mailboxes, apps and policies a fix would touch before you apply it. Continuous scanning and drift detection alert you by email when a control regresses, and the PDF report keeps the findings and evidence together for an audit.