Microsoft Defender

Section 2 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 covers Microsoft Defender, mainly the email and collaboration protection delivered through Defender for Office 365 and Exchange Online Protection. It contains 21 controls, which makes it the second-largest section of the benchmark after identity.

The largest group of controls, in subsection 2.1, is about mail filtering and authentication. It includes Safe Links for Office applications, Safe Attachments (including for SharePoint, OneDrive and Microsoft Teams), the common attachment types filter, comprehensive attachment filtering, and an anti-phishing policy. It also covers spam handling: administrator notifications, outbound message limits, and avoiding shortcuts such as the connection filter IP allow list, the safe list, or allowed domains in inbound anti-spam policies. Three controls deal with domain authentication, asking for SPF records, DKIM and DMARC records on all Exchange Online domains.

A second theme is protecting the accounts attackers care about most. One control asks that emergency access account activity is monitored. Others ask for priority account protection and Strict protection presets for priority accounts. The remaining controls cover Microsoft Defender for Cloud Apps, zero-hour auto purge for Microsoft Teams, and automated investigation and response remediation.

Many of these protections depend on Defender licensing, so the benchmark marks a good share of them with E5 profiles. Reading the profile column tells you quickly which controls apply to the licences you hold.

How ConfigCobra assesses it. ConfigCobra reads the tenant through read-only Microsoft Graph permissions, with no agents and no admin password sharing, and never changes a setting. A scan returns a result for each of these 21 controls, with a severity estimate that ConfigCobra uses to prioritise remediation (CIS itself publishes no severity). Each failing control comes with a copy-paste remediation script or admin portal steps, and remediation impact analysis shows which users, groups, mailboxes, apps and policies a fix would touch before you apply it. Continuous scanning and drift detection alert you by email when a control regresses, and the PDF report keeps the findings and evidence together for an audit.