Microsoft Purview
This section of the CIS Microsoft 365 Foundations Benchmark v7.0.0 holds 5 controls for Microsoft Purview: audit log search, data loss prevention and sensitivity labels. ConfigCobra scans it read-only and alerts you if one of these settings regresses.
About this section
Section 3 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 covers Microsoft Purview, the compliance and information protection side of Microsoft 365. It is a small section with 5 controls, but each one underpins how well you can investigate incidents and keep sensitive data from leaving the tenant.
The controls fall into three themes. Subsection 3.1 has a single control: Microsoft 365 audit log search should be enabled. Without it, there is no record to review after a suspicious sign-in, a mailbox change or an unexpected file download, so this setting is worth checking first. Subsection 3.2 is about data loss prevention: DLP policies should be enabled and should cover Microsoft Teams. Subsection 3.3 has one control on information protection: sensitivity label policies should be set up and used.
Together these controls answer three practical questions. Can we see what happened? Are rules in place to stop sensitive content from being shared where it should not be? Is content labelled so that those rules have something to act on? Most of the controls are Level 1, and some are tied to E5 licensing, so check the profile column against the licences you actually hold.
A passing result here means the policy exists and is enabled. It does not tell you whether the policy is well tuned for your data, so treat these checks as the foundation and review policy content separately.
How ConfigCobra assesses it. ConfigCobra reads the tenant through read-only Microsoft Graph permissions, with no agents and no admin password sharing, and never changes a setting. A scan returns a result for each of these 5 controls, with a severity estimate that ConfigCobra uses to prioritise remediation (CIS itself publishes no severity). Each failing control comes with a copy-paste remediation script or admin portal steps, and remediation impact analysis shows which users, groups, mailboxes, apps and policies a fix would touch before you apply it. Continuous scanning and drift detection alert you by email when a control regresses, and the PDF report keeps the findings and evidence together for an audit.
The 5 controls
| CIS ID | Check | Profile | Assessment |
|---|---|---|---|
| 3.1.1 | Microsoft 365 audit log search should be enabled | E3 Level 1 | Automated |
| 3.2.1 | DLP policies should be enabled | E3 Level 1 | Automated |
| 3.2.2 | DLP policies should be enabled for Microsoft Teams | E5 Level 1 | Automated |
| 3.2.3 | DLP policies should be published for Copilot users | E5 Level 1 | Automated |
| 3.3.1 | Sensitivity label policies should be set up and used | E3 Level 1 | Automated |
Check all 5 controls on your Microsoft 365
ConfigCobra runs this section with the rest of the CIS Microsoft 365 Foundations Benchmark v7.0.0, read-only.