Your 85 gaps are not 85 problems: they come down to four root causes. Address them in order and you neutralize the bulk of the risk with focused effort, without redoing everything.
One proof, three readers. This file is designed to be presented to a cyber insurer (underwriting format), to a principal contractor requiring proof of your posture (supply chain trickle-down, NIS2 Art. 21 - shareable version), and to a statutory auditor or external auditor. Every finding below is verifiable in your own Microsoft logs: enforceable, not declarative.
195 compliant control(s) out of 280 assessed controls - the verifiable baseline that can already be presented to an insurer, point by point, with supporting evidence. Posture rated C, without flattery, based solely on assessed items.
85 non-conformity(ies) found and 63 unmeasured control(s) remain an exposure not covered by enforceable proof: as long as the root causes below are not addressed, this exposure cannot be attested.
| Benchmark | Control point | Severity |
|---|---|---|
| M365SEC:2.4.2M365SAT, Monkey365 | MEx 2.4.2 - Priority accounts do not have 'Strict protection' presets applied | High |
| M365SEC:7.3.2M365SAT, Monkey365 | MSp 7.3.2 - OneDrive for Business sync from unmanaged devices is not blocked | High |
| MT.1037Maester | Only users with Presenter role are allowed to present in Teams meetings | High |
| MT.1034Maester | MT.1034.$($EmergencyAccessUsers.IndexOf($_)): Emergency access users should not be blocked ($($_.userPrincipalName)) | To be remediated |
| M365SEC:5.2.2.2M365SAT, Monkey365 | MAz 5.2.2.2 - MultiFactor Authentication (MFA) is not enabled for all users non-administrative roles | Critical |
| CISA:MS.AAD.3.2Maester, ScubaGear | If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | Critical |
| M365SEC:5.1.5.2M365SAT, Maester, Monkey365 | CISMAz 5.1.5.2 - User consent to apps accessing company data on their behalf is allowed! | High |
| M365SEC:5.2.3.4M365SAT, Monkey365 | MAz 5.2.3.4 - Not all member users are 'MFA capable' | High |
| ORCA.140Maester | High Confidence Spam action set to Quarantine message. | High |
| ORCA.189.2Maester | Safe Links is not bypassed. | High |
| Benchmark | Control point | Status |
|---|---|---|
| M365SEC:1.3.5M365SAT, Maester, Monkey365 | MOff 1.3.5 - Internal phishing protection for Forms is disabled | Not measured |
| M365SEC:2.4.1M365SAT, Monkey365 | MEx 2.4.1 - Priority account protection is not enabled and configured! | Not measured |
| M365SEC:3.2.1M365SAT, Monkey365 | MEx 3.2.1 - DLP Policy is not enabled! | Not measured |
| M365SEC:7.2.7M365SAT, Maester, Monkey365 | MSp 7.2.7 - Ensure link sharing is not restricted in SharePoint and OneDrive! | Not measured |
| CISA:MS.AAD.4.1Maester, ScubaGear | Security logs SHALL be sent to the agency's security operations center for monitoring. | Not measured |
| M365SEC:6.2.1M365SAT, Monkey365 | MEx 6.2.1 - Forms of mail forwarding are not blocked and/or not disabled | Not measured |
| CISA:MS.EXO.13.1Maester, ScubaGear | Mailbox auditing SHALL be enabled. | Not measured |
| M365SEC:4.2Monkey365 | Devices enrollment personal devices not blocked | Not measured |
| M365SEC:7.2.11Maester, Monkey365 | Ensure the SharePoint default sharing link permission is set | Not measured |
| MT.1027Maester | No Service Principal with Client Secret and permanent role assignment on Control Plane. | Not measured |
| Benchmark | Control point | Severity |
|---|---|---|
| ANSSI R13ANSSI/NIS2 ANSSI R13 | ANSSI R13 | Compliant |
| ANSSI R14ANSSI/NIS2 ANSSI R14 | ANSSI R14 | Compliant |
| ANSSI R16ANSSI/NIS2 ANSSI R16 | ANSSI R16 | Compliant |
| ANSSI R24ANSSI/NIS2 ANSSI R24 | ANSSI R24 | Compliant |
| ANSSI R29ANSSI/NIS2 ANSSI R29 | ANSSI R29 | Compliant |
| ANSSI R36ANSSI/NIS2 ANSSI R36 | ANSSI R36 | Compliant |
| ANSSI R5ANSSI/NIS2 ANSSI R5 | ANSSI R5 | Compliant |
| ANSSI R8ANSSI/NIS2 ANSSI R8 | ANSSI R8 | Compliant |
| M365SEC:5.1.1.1M365SAT CISMAz5111 | CISMAz 5.1.1.1 - The Security Defaults are enabled on Azure Active Directory Tenant | Compliant |
| M365SEC:6.1.4M365SAT CISMEx614 | MEx 6.1.4 - Des boîtes aux lettres portent-elles 'AuditBypassEnabled', qui les exclut du journal d'audit ? | Compliant |
| CISA:MS.EXO.10.1Maester CISA.MS.EXO.10.1 | Emails SHALL be scanned for malware. | Compliant |
| CISA:MS.EXO.10.2Maester CISA.MS.EXO.10.2 | Emails identified as containing malware SHALL be quarantined or dropped. | Compliant |
| CISA:MS.EXO.10.3Maester CISA.MS.EXO.10.3 | Email scanning SHALL be capable of reviewing emails after delivery. | Compliant |
| CISA:MS.EXO.11.1Maester CISA.MS.EXO.11.1 | Impersonation protection checks SHOULD be used. | Compliant |
| CISA:MS.EXO.11.2Maester CISA.MS.EXO.11.2 | User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. | Compliant |
| CISA:MS.EXO.11.3Maester CISA.MS.EXO.11.3 | The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. | Compliant |
| CISA:MS.EXO.12.1Maester CISA.MS.EXO.12.1 | IP allow lists SHOULD NOT be created. | Compliant |
| CISA:MS.EXO.14.1Maester CISA.MS.EXO.14.1 | A spam filter SHALL be enabled. | Compliant |
| CISA:MS.EXO.14.2Maester CISA.MS.EXO.14.2 | Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. | Compliant |
| CISA:MS.EXO.14.3Maester CISA.MS.EXO.14.3 | Allowed domains SHALL NOT be added to inbound anti-spam protection policies. | Compliant |
| CISA:MS.EXO.15.1Maester CISA.MS.EXO.15.1 | URL comparison with a block-list SHOULD be enabled. | Compliant |
| CISA:MS.EXO.15.2Maester CISA.MS.EXO.15.2 | Direct download links SHOULD be scanned for malware. | Compliant |
| CISA:MS.EXO.15.3Maester CISA.MS.EXO.15.3 | User click tracking SHOULD be enabled. | Compliant |
| CISA:MS.EXO.16.1Maester CISA.MS.EXO.16.1 | Alerts SHALL be enabled. | Compliant |
| CISA:MS.EXO.16.2Maester CISA.MS.EXO.16.2 | Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. | Compliant |
| CISA:MS.EXO.17.1Maester CISA.MS.EXO.17.1 | Microsoft Purview Audit (Standard) logging SHALL be enabled. | Compliant |
| CISA:MS.EXO.2.1Maester CISA.MS.EXO.2.1 | A list of approved IP addresses for sending mail SHALL be maintained. | Compliant |
| EIDSCA.AF01Maester EIDSCA.AF01 | Authentication method - FIDO2 security key - State. | Compliant |
| EIDSCA.AF02Maester EIDSCA.AF02 | Authentication Method - FIDO2 security key - Allow self-service set up. | Compliant |
| EIDSCA.AF03Maester EIDSCA.AF03 | Authentication method - FIDO2 security key - Enforce attestation. | Compliant |
| EIDSCA.AF04Maester EIDSCA.AF04 | Authentication method - FIDO2 security key - Enforce key restrictions. | Compliant |
| EIDSCA.AF05Maester EIDSCA.AF05 | Authentication method - FIDO2 security key - Restricted. | Compliant |
| EIDSCA.AF06Maester EIDSCA.AF06 | Authentication Method - FIDO2 security key - Restrict specific keys. | Compliant |
| EIDSCA.AG01Maester EIDSCA.AG01 | Authentication method - General settings - Manage migration. | Compliant |
| EIDSCA.AG02Maester EIDSCA.AG02 | Authentication method - General settings - Report suspicious activity - State. | Compliant |
| EIDSCA.AM01Maester EIDSCA.AM01 | Authentication method - Microsoft Authenticator - State. | Compliant |
| EIDSCA.AM02Maester EIDSCA.AM02 | Authentication method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP. | Compliant |
| EIDSCA.AM03Maester EIDSCA.AM03 | Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | Compliant |
| EIDSCA.AM04Maester EIDSCA.AM04 | Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | Compliant |
| EIDSCA.AM06Maester EIDSCA.AM06 | Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Compliant |
| EIDSCA.AM07Maester EIDSCA.AM07 | Authentication method - Microsoft Authenticator - Users and groups included for showing the application name in push and passwordless notifications. | Compliant |
| EIDSCA.AM09Maester EIDSCA.AM09 | Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Compliant |
| EIDSCA.AM10Maester EIDSCA.AM10 | Authentication method - Microsoft Authenticator - Users and groups included for showing the geographic location in push and passwordless notifications. | Compliant |
| EIDSCA.AP01Maester EIDSCA.AP01 | Default authorization settings - Self-service password reset enabled for administrators. | Compliant |
| EIDSCA.AP04Maester EIDSCA.AP04 | Default Authorization Settings - Guest invite restrictions. | Compliant |
| EIDSCA.AP06Maester EIDSCA.AP06 | Default Authorization Settings - User can join the tenant by email validation. | Compliant |
| EIDSCA.AP08Maester EIDSCA.AP08 | Default authorization settings - User consent policy assigned for applications. | Compliant |
| EIDSCA.AP10Maester EIDSCA.AP10 | Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | Compliant |
| EIDSCA.AS04Maester EIDSCA.AS04 | Authentication Method - SMS - Use for sign-in. | Compliant |
| EIDSCA.AT01Maester EIDSCA.AT01 | Authentication method - Temporary Access Pass - State. | Compliant |
| EIDSCA.AT02Maester EIDSCA.AT02 | Authentication method - Temporary Access Pass - One-time use. | Compliant |
| EIDSCA.AV01Maester EIDSCA.AV01 | Authentication method - Voice call - State. | Compliant |
| EIDSCA.CP01Maester EIDSCA.CP01 | Default settings - Consent policy settings - Group owner consent for apps accessing data. | Compliant |
| EIDSCA.CP03Maester EIDSCA.CP03 | Default Settings - Consent Policy Settings - Block user consent for risky apps. | Compliant |
| EIDSCA.PR02Maester EIDSCA.PR02 | Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | Compliant |
| EIDSCA.PR03Maester EIDSCA.PR03 | Default settings - Password rule settings - Enforce custom list. | Compliant |
| EIDSCA.PR05Maester EIDSCA.PR05 | Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. | Compliant |
| EIDSCA.PR06Maester EIDSCA.PR06 | Default settings - Password rule settings - Smart Lockout - Lockout threshold. | Compliant |
| EIDSCA.ST08Maester EIDSCA.ST08 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Compliant |
| EIDSCA.ST09Maester EIDSCA.ST09 | Default settings - Classification and M365 groups - M365 groups - Allow guests to access group content. | Compliant |
| M365SEC:1.1.1Maester M365.1.1.1 | MOff 1.1.1 - Ensure Administrative accounts are separate and cloud-only | Compliant |
| M365SEC:1.1.3Maester M365.1.1.3 | Ensure that between two and four global admins are designated | Compliant |
| M365SEC:1.3.1Maester M365.1.3.1 | Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' | Compliant |
| M365SEC:1.3.3Maester M365.1.3.3 | Ensure 'External sharing' of calendars is not available | Compliant |
| M365SEC:1.3.4Maester M365.1.3.4 | MOff 1.3.4 - User owned apps and services are not restricted | Compliant |
| M365SEC:2.1.1Maester M365.2.1.1 | Ensure Safe Links for Office Applications is Enabled (Only Checks Default Policy) | Compliant |
| M365SEC:2.1.11Maester M365.2.1.11 | Ensure comprehensive attachment filtering is applied | Compliant |
| M365SEC:2.1.2Maester M365.2.1.2 | Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Compliant |
| M365SEC:2.1.3Maester M365.2.1.3 | Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Compliant |
| M365SEC:2.1.4Maester M365.2.1.4 | Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | Compliant |
| M365SEC:2.1.5Maester M365.2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Compliant |
| M365SEC:2.1.6Maester M365.2.1.6 | Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Compliant |
| M365SEC:2.1.7Maester M365.2.1.7 | Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Compliant |
| M365SEC:3.1.1Maester M365.3.1.1 | MEx 3.1.1 - Microsoft 365 audit log search is Disabled! | Compliant |
| M365SEC:4.1Maester M365.4.1 | Ensure devices without a compliance policy are marked | Compliant |
| M365SEC:5.1.2.2Maester M365.5.1.2.2 | MAz 5.1.2.2 - Third party integrated applications are allowed! | Compliant |
| M365SEC:5.1.5.1Maester M365.5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowed | Compliant |
| M365SEC:5.1.6.2Maester M365.5.1.6.2 | Ensure that guest user access is restricted | Compliant |
| M365SEC:5.2.3.5Maester M365.5.2.3.5 | Ensure weak authentication methods are disabled | Compliant |
| M365SEC:7.2.2Maester M365.7.2.2 | MSp 7.2.2 - SharePoint and OneDrive integration with Azure AD B2B is not enabled! | Compliant |
| M365SEC:7.2.5Maester M365.7.2.5 | Ensure that SharePoint guest users cannot share items they don | Compliant |
| M365SEC:7.2.9Maester M365.7.2.9 | MSp 7.2.9 - Guest access to a site or OneDrive does not expire automatically | Compliant |
| M365SEC:7.3.1Maester M365.7.3.1 | MSp 7.3.1 - Office 365 SharePoint infected files are NOT disallowed for download | Compliant |
| M365SEC:8.4.1Maester M365.8.4.1 | Ensure all or a majority of third-party and custom apps are blocked | Compliant |
| M365SEC:8.6.1Maester M365.8.6.1 | Ensure users can report security concerns in Teams to internal destination | Compliant |
| MT.1003Maester MT.1003 | At least one Conditional Access policy is configured with All Apps. | Compliant |
| MT.1004Maester MT.1004 | At least one Conditional Access policy is configured with All Apps and All Users. | Compliant |
| MT.1006Maester MT.1006 | At least one Conditional Access policy is configured to require MFA for administrators. | Compliant |
| MT.1007Maester MT.1007 | At least one Conditional Access policy is configured to require MFA for all users. | Compliant |
| MT.1008Maester MT.1008 | At least one Conditional Access policy is configured to require MFA for Azure management. | Compliant |
| MT.1009Maester MT.1009 | At least one Conditional Access policy is configured to block other legacy authentication. | Compliant |
| MT.1010Maester MT.1010 | At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. | Compliant |
| MT.1011Maester MT.1011 | At least one Conditional Access policy is configured to secure security info registration only from a trusted location. | Compliant |
| MT.1014Maester MT.1014 | At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for administrators. | Compliant |
| MT.1015Maester MT.1015 | At least one Conditional Access policy is configured to block access from unknown or unsupported device platforms. | Compliant |
| MT.1016Maester MT.1016 | At least one Conditional Access policy is configured to require MFA for guest access. | Compliant |
| MT.1020Maester MT.1020 | All Conditional Access policies are configured to exclude directory synchronisation accounts, or do not target them. | Compliant |
| MT.1022Maester MT.1022 | MT.1022 | Compliant |
| MT.1025Maester MT.1025 | No external user with permanent role assignment on Control Plane. | Compliant |
| MT.1026Maester MT.1026 | No hybrid user with permanent role assignment on Control Plane. | Compliant |
| MT.1031Maester MT.1031 | Control Plane privileged roles are managed by PIM only. | Compliant |
| MT.1032Maester MT.1032 | A limited number of Global Administrators is assigned. | Compliant |
| MT.1044Maester MT.1044 | Ensure modern authentication for Exchange Online is enabled | Compliant |
| MT.1045Maester MT.1045 | Only guest users should be admitted automatically to Teams meetings | Compliant |
| MT.1050Maester MT.1050 | Applications with high-risk permissions having a direct path to Global Administrator. | Compliant |
| MT.1051Maester MT.1051 | Applications with high-risk permissions having an indirect path to Global Administrator. | Compliant |
| MT.1052Maester MT.1052 | At least one Conditional Access policy targets the Device Code authentication flow. | Compliant |
| MT.1061Maester MT.1061 | The device registration MFA control conflicts with Conditional Access policies. | Compliant |
| MT.1066Maester MT.1066 | Conditional Access policies should not include or exclude deleted users, groups or roles. | Compliant |
| MT.1071Maester MT.1071 | At least one Conditional Access policy explicitly includes Azure DevOps. | Compliant |
| MT.1072Maester MT.1072 | Conditional Access policies should not use the deprecated Approved Client App grant. | Compliant |
| MT.1075Maester MT.1075 | Third-party Entra applications should have explicitly assigned users rather than All Users. | Compliant |
| MT.1105Maester MT.1105 | The MDM authority should be set to Microsoft Intune | Compliant |
| ORCA.101Maester ORCA.101 | Bulk is marked as spam. | Compliant |
| ORCA.102Maester ORCA.102 | Advanced Spam filter options are turned off. | Compliant |
| ORCA.104Maester ORCA.104 | High Confidence Phish action set to Quarantine message. | Compliant |
| ORCA.108.1Maester ORCA.108.1 | DNS Records have been set up to support DKIM. | Compliant |
| ORCA.109Maester ORCA.109 | Senders are not unsafely allow listed. | Compliant |
| ORCA.111Maester ORCA.111 | Anti-phishing policy exists and EnableUnauthenticatedSender is true. | Compliant |
| ORCA.112Maester ORCA.112 | Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy. | Compliant |
| ORCA.118.1Maester ORCA.118.1 | Domains are not unsafely allow listed in anti-spam policies. | Compliant |
| ORCA.118.3Maester ORCA.118.3 | Your own domains are not unsafely allow listed in anti-spam policies. | Compliant |
| ORCA.121Maester ORCA.121 | A supported filter policy action is in use. | Compliant |
| ORCA.124Maester ORCA.124 | Safe Attachments unknown malware response is set to block messages. | Compliant |
| ORCA.139Maester ORCA.139 | The spam action is set to move the message to the Junk Email folder or to quarantine. | Compliant |
| ORCA.141Maester ORCA.141 | Bulk action set to Move message to Junk Email Folder. | Compliant |
| ORCA.143Maester ORCA.143 | Safety Tips are enabled. | Compliant |
| ORCA.158Maester ORCA.158 | Safe Attachments is enabled for SharePoint and Teams. | Compliant |
| ORCA.180Maester ORCA.180 | Anti-phishing policy exists and EnableSpoofIntelligence is true. | Compliant |
| ORCA.221Maester ORCA.221 | Mailbox Intelligence is enabled in anti-phishing policies. | Compliant |
| ORCA.225Maester ORCA.225 | Safe Documents is enabled for Office clients. | Compliant |
| ORCA.226Maester ORCA.226 | Every domain has a Safe Links policy applied to it. | Compliant |
| ORCA.227Maester ORCA.227 | Every domain has a Safe Attachments policy applied to it. | Compliant |
| ORCA.228Maester ORCA.228 | No trusted senders in Anti-phishing policy. | Compliant |
| ORCA.229Maester ORCA.229 | No trusted domains in Anti-phishing policy. | Compliant |
| ORCA.230Maester ORCA.230 | Each domain has a Anti-phishing policy applied to it, or the default policy is being used. | Compliant |
| ORCA.231Maester ORCA.231 | Each domain has a anti-spam policy applied to it, or the default policy is being used. | Compliant |
| ORCA.232Maester ORCA.232 | Each domain has a malware filter policy applied to it, or the default policy is being used. | Compliant |
| ORCA.234Maester ORCA.234 | Click through is disabled for Safe Documents. | Compliant |
| ORCA.236Maester ORCA.236 | Safe Links is enabled for emails. | Compliant |
| ORCA.237Maester ORCA.237 | Safe Links is enabled for teams messages. | Compliant |
| ORCA.238Maester ORCA.238 | Safe Links is enabled for office documents. | Compliant |
| ORCA.240Maester ORCA.240 | Outlook is configured to display external tags for external emails. | Compliant |
| ORCA.242Maester ORCA.242 | The significant protection alerts responsible for AIR activity are enabled. | Compliant |
| ORCA.244Maester ORCA.244 | Policies are configured to honour the DMARC policy of sending domains. | Compliant |
| M365SEC:5.2.2.3Monkey365 eid-cap-block-legacy-authentication-not-enabled | MAz 5.2.2.3 - No Conditional Access policies to block legacy authentication | Compliant |
| M365SEC:5.2.2.4Monkey365 eid-cap-lack-sign-in-frequency-browser-persistent-session | MAz 5.2.2.4 - Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users | Compliant |
| M365SEC:5.2.2.12Monkey365 eid-device-code-sign-in-flow-not-enabled | Eid device code sign in flow not enabled | Compliant |
| M365SEC:5.2.2.1Monkey365 eid-ensure-mfa-for-high-privileged-users-missing-cap | MAz 5.2.2.1 - MultiFactor Authentication (MFA) is not enabled for all users in administrative roles | Compliant |
| M365SEC:5.2.2.5Monkey365 eid-ensure-phishing-resistant-mfa-for-high-privileged-users-missing-cap | MAz 5.2.2.5 - Phishing-resistant MFA strength must be required for Administrators | Compliant |
| M365SEC:5.1.6.3Monkey365 eid-guest-invite-restriction-disabled | Eid guest invite restriction disabled | Compliant |
| M365SEC:5.2.3.1Monkey365 eid-microsoft-authenticator-lack-mfa-fatigue-protection | MAz 5.2.3.1 - Microsoft Authenticator is not configured to protect against MFA fatigue | Compliant |
| M365SEC:5.1.8.1Monkey365 eid-password-hash-sync-disabled | MAz 5.1.8.1 - Password Synchronization Disabled | Compliant |
| M365SEC:5.2.2.9Monkey365 eid-require-device-compliant-all-apps-missing-cap | Eid require device compliant all apps missing cap | Compliant |
| M365SEC:5.2.2.10Monkey365 eid-require-device-compliant-to-register-security-info-missing-cap | Eid require device compliant to register security info missing cap | Compliant |
| M365SEC:5.1.6.1Monkey365 eid-restrict-collaboration-specific-domains-disabled | MAz 5.1.6.1 - Collaboration invitations are not sent to allowed domains only | Compliant |
| M365SEC:5.2.2.11Monkey365 eid-sign-in-frequency-intune-enrollment-missing-cap | Eid sign in frequency intune enrollment missing cap | Compliant |
| M365SEC:5.2.4.1Monkey365 eid-sspr-enabled-set-to-all | MAz 5.2.4.1 - Self Service Password Reset is not set to be enabled for all users | Compliant |
| M365SEC:6.1.3Monkey365 exchange-audit-bypass-enabled | Exchange audit bypass enabled | Compliant |
| M365SEC:6.1.1Monkey365 exchange-audit-enabled-globally | MEx 6.1.1 - Mailbox auditing is not Enabled for all users | Compliant |
| M365SEC:6.2.3Monkey365 exchange-external-email-sender-configured | MEx 6.2.3 - Email from external senders cannot be identified | Compliant |
| M365SEC:6.5.1Monkey365 exchange-modern-authentication-disabled | Exchange modern authentication disabled | Compliant |
| M365SEC:2.1.14Monkey365 exhange-inbound-anti-spam-policies-allowed-domains | MEx 2.1.14 - No comprehensive attachment filtering is applied! | Compliant |
| M365SEC:7.2.8Monkey365 sharepoint-external-sharing-not-restricted-by-security-group | MSp 7.2.8 - Ensure external sharing is restricted by security group! | Compliant |
| M365SEC:7.2.1Monkey365 sharepoint-modern-authentication-required | SharePoint modern authentication required | Compliant |
| M365SEC:8.5.1Monkey365 teams-anonymous-users-cant-join-meeting | CISM Tm 8.5.1 - Anonymous users can join a meeting | Compliant |
| CISA:MS.AAD.1.1ScubaGear MS.AAD.1.1v1 | Legacy authentication SHALL be blocked. | Compliant |
| CISA:MS.AAD.3.1ScubaGear MS.AAD.3.1v1 | Phishing-resistant MFA SHALL be enforced for all users. | Compliant |
| CISA:MS.AAD.3.3ScubaGear MS.AAD.3.3v2 | If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. | Compliant |
| CISA:MS.AAD.3.4ScubaGear MS.AAD.3.4v1 | The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | Compliant |
| CISA:MS.AAD.3.6ScubaGear MS.AAD.3.6v1 | Phishing-resistant MFA SHALL be required for highly privileged roles. | Compliant |
| CISA:MS.AAD.3.7ScubaGear MS.AAD.3.7v1 | Managed devices SHOULD be required for authentication. | Compliant |
| CISA:MS.AAD.3.8ScubaGear MS.AAD.3.8v1 | Managed Devices SHOULD be required to register MFA. | Compliant |
| CISA:MS.AAD.3.9ScubaGear MS.AAD.3.9v1 | Device code authentication SHOULD be blocked. | Compliant |
| CISA:MS.AAD.5.1ScubaGear MS.AAD.5.1v1 | Only administrators SHALL be allowed to register applications. | Compliant |
| CISA:MS.AAD.5.2ScubaGear MS.AAD.5.2v1 | Only administrators SHALL be allowed to consent to applications. | Compliant |
| CISA:MS.AAD.6.1ScubaGear MS.AAD.6.1v1 | User passwords SHALL NOT expire. | Compliant |
| CISA:MS.AAD.7.1ScubaGear MS.AAD.7.1v1 | A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. | Compliant |
| CISA:MS.AAD.7.2ScubaGear MS.AAD.7.2v1 | Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. | Compliant |
| CISA:MS.AAD.7.4ScubaGear MS.AAD.7.4v1 | Permanent active role assignments SHALL NOT be allowed for highly privileged roles. | Compliant |
| CISA:MS.AAD.8.1ScubaGear MS.AAD.8.1v1 | Guest users SHOULD have limited or restricted access to Microsoft Entra ID directory objects. | Compliant |
| CISA:MS.AAD.8.2ScubaGear MS.AAD.8.2v1 | Only users with the Guest Inviter role SHOULD be able to invite guest users. | Compliant |
| CISA:MS.AAD.8.3ScubaGear MS.AAD.8.3v1 | Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. | Compliant |
| CISA:MS.DEFENDER.2.2ScubaGear MS.DEFENDER.2.2v1 | Domain impersonation protection SHOULD be enabled for agency-owned domains in standard and strict policies. | Compliant |
| CISA:MS.DEFENDER.2.3ScubaGear MS.DEFENDER.2.3v1 | Domain impersonation protection SHOULD be added for key suppliers and partners in standard and strict policies. | Compliant |
| CISA:MS.DEFENDER.3.1ScubaGear MS.DEFENDER.3.1v1 | Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams. | Compliant |
| CISA:MS.DEFENDER.5.1ScubaGear MS.DEFENDER.5.1v1 | Alerts required by Exchange Online baseline SHALL be enabled at minimum. | Compliant |
| CISA:MS.DEFENDER.5.2ScubaGear MS.DEFENDER.5.2v1 | Alerts SHOULD be sent to a monitored address or incorporated into SIEM. | Compliant |
| CISA:MS.DEFENDER.6.1ScubaGear MS.DEFENDER.6.1v1 | Unified Audit logging SHALL be enabled. | Compliant |
| CISA:MS.EXO.1.1ScubaGear MS.EXO.1.1v2 | Automatic forwarding to external domains SHALL be disabled. | Compliant |
| CISA:MS.EXO.6.1ScubaGear MS.EXO.6.1v1 | Contact folders SHALL NOT be shared with all domains. | Compliant |
| CISA:MS.EXO.6.2ScubaGear MS.EXO.6.2v1 | Calendar details SHALL NOT be shared with all domains. | Compliant |
| CISA:MS.EXO.7.1ScubaGear MS.EXO.7.1v1 | External sender warnings SHALL be implemented. | Compliant |
| CISA:MS.SHAREPOINT.1.3ScubaGear MS.SHAREPOINT.1.3v1 | External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. | Compliant |
| CISA:MS.TEAMS.1.3ScubaGear MS.TEAMS.1.3v1 | Anonymous users and dial-in callers SHOULD NOT be admitted automatically. | Compliant |
Verifiable proof is the argument. This diagnostic has never seen your data: only configuration settings were read, never personal content. Every finding above is verifiable in your own Microsoft logs, and therefore enforceable - whether the reader is an insurer, a principal contractor auditing you, or a statutory auditor.