SYAGA Audit

Rapport for tredjepartsattestering
Uten å se dine data · Ref. SYAGA-DEMO-QUESTIONNAIRE-0001

Vurdering av Microsoft 365-posisjonDatert og verifiserbart dokument

Revidert enhet
Entreprise Démonstration (exemple, non client) (tenant d3m0a1b2-c3d4-4e5f-8a9b-0c1d2e3f4a5b)

Revisjonsdato
17 juillet 2026

Utsteder
SYAGA CONSULTING · SIREN 518 489 471

Verifiserbart i
dine egne Microsoft-revisjonslogger · syaga.eu

Konklusjonen, før bevisdokumentet

Fire strukturelle svakheter utsetter din forsikringsbarhet for Microsoft 365.

Dine 85 avvik er ikke 85 problemer: de kan tilbakeføres til fire rotårsak(er). Behandle dem i rekkefølge, og du nøytraliserer det meste av risikoen med konsentrert innsats, uten å gjøre alt på nytt.

Forsikringsbarhetsposisjon

70/100

Å styrke

et brukbart grunnlag, men noen sårbarheter står fortsatt åpne

Ett bevis, tre lesere. Dette dokumentet er utformet for å presenteres for en cyberforsikringsselskap (tegningsformat), en oppdragsgiver som krever bevis på din posisjon (ringvirkning i leverandørkjeden, NIS2 art. 21 - delbar versjon), og en revisor eller ekstern kontrollør. Hvert funn nedenfor kan verifiseres i dine egne Microsoft-logger: rettskraftig, ikke bare erklært.

195

Samsvarende kontroller

Rotårsaker som belaster forsikringsbarheten

Ikke-samsvar konstatert til dags dato

Det som kan bevises i dag

195 samsvarende kontroll(er) av 280 avgjorte kontroller - det verifiserbare grunnlaget som allerede kan presenteres for en forsikringsgiver, punkt for punkt, med bevis. Posisjonen vurdert til C, uten smiger, kun basert på det avgjorte grunnlaget.

Det som eksponerer din sak

85 konstatert(e) ikke-samsvar og 63 ikke-målt(e) kontroll(er) forblir en eksponering uten rettskraftig bevis: så lenge rotårsakene nedenfor ikke er behandlet, kan denne eksponeringen ikke attesteres.

Herding av konfigurasjonen

34 gruppert(e) avvik - Konfigurasjon og samsvar

Eksponeringen: en uherdet grunnkonfigurasjon utvider angrepsflaten i stillhet, uten synlig varsel.
I dag: For dette temaet er følgende samsvarskrav ikke oppfylt: S'assurer que les comptes prioritaires bénéficient des paramètres prédéfinis de protection stricte (Strict protection) ; S'assurer que la synchronisation OneDrive est restreinte pour les appareils non gérés ; Seuls les utilisateurs ayant le rôle Présentateur sont autorisés à présenter dans les réunions Teams ; Les comptes d'accès d'urgence (break-glass) ne doivent pas être bloqués.
Det revisjonen avdekket: Sensibiliser les utilisateurs aux bonnes pratiques élémentaires (hameçonnage, gestion des mots de passe, MFA, signalement) par des campagnes récurrentes et des simulations ; mesure principalement organisationnelle. Appliquer le preset de protection Strict aux comptes prioritaires pour leur garantir le niveau de filtrage le plus élevé. Bloquer la synchronisation OneDrive depuis les appareils non gérés via une politique d'accès conditionnel (AllowLimitedAccess) limitant l'accès au web sans téléchargement/synchronisation.

Innsats MiddelsEffekt Moderat

Identitet og tilgang

31 gruppert(e) avvik - Identitet og tilgang

Eksponeringen: kontoovertakelse er den vanligste angrepsveien; dette er det eneste temaet der begrenset innsats lukker en hel risikoklasse på én gang.
I dag: For dette temaet er følgende samsvarskrav ikke oppfylt: S'assurer que l'authentification multifacteur est activée pour tous les utilisateurs ; La MFA DOIT être imposée pour tous les utilisateurs ; S'assurer que le flux de consentement administrateur est activé ; S'assurer que tous les utilisateurs membres sont 'compatibles MFA' (MFA capable).
Det revisjonen avdekket: Le MFA doit être exigé pour l'ensemble des utilisateurs via une politique d'accès conditionnel afin de bloquer la grande majorité des attaques par compromission d'identité. Activer le flux de consentement administrateur dans Entra ID pour qu'une demande d'accès bloquée côté utilisateur soit routée vers un réviseur plutôt que simplement rejetée sans suite. Au moins deux comptes d'accès d'urgence (break-glass) cloud-only en *.onmicrosoft.com, exclus des politiques CA bloquantes, doivent être définis pour éviter un verrouillage total de l'administration.

Innsats LavEffekt Alvorlig

III

Overvåking og logging

14 gruppert(e) avvik - Deteksjon og overvåking

Eksponeringen: uten aktiv deteksjon eller fullstendig logg kan et angrep lykkes uten å bli blokkert, oppdaget i tide eller bevist i etterkant: en direkte ulempe ved en skadesak, en regulatorisk kontroll eller en forsikringssak.
I dag: For dette temaet er følgende samsvarskrav ikke oppfylt: L'action pour le spam à haut niveau de confiance (High Confidence Spam) est définie sur Mettre le message en quarantaine ; Les liens sûrs (Safe Links) ne sont pas contournés ; L'action en cas d'usurpation de domaine (Domain Impersonation) est définie sur déplacer vers la quarantaine ; L'action en cas d'usurpation d'identité d'utilisateur (User impersonation) est définie sur déplacer vers la quarantaine.
Det revisjonen avdekket: Inclure tous les utilisateurs dans la protection Defender for Office 365 via le preset de sécurité Standard ou Strict. Configurer la politique Anti-courrier indésirable (anti-spam) pour appliquer le réglage cible : « Durée de rétention en quarantaine portée à 30 jours ». Configurer la politique Anti-hameçonnage pour appliquer le réglage cible : « Mise en quarantaine des messages détectés comme hameçonnage ».

Innsats LavEffekt Høy

Dataeksponering

6 gruppert(e) avvik - Data og eksponering

Eksponeringen: en opplysning som forlater virksomheten uten sikkerhetstiltak er den mest banale lekkasjeveien, og den dyreste både omdømmemessig og regulatorisk.
I dag: For dette temaet er følgende samsvarskrav ikke oppfylt: S'assurer que les stratégies d'étiquettes de confidentialité Information Protection sont publiées ; S'assurer que le partage de contenu OneDrive est restreint ; Une solution de prevention des pertes de données (DLP) DOIT être utilisée ; L'action de la politique personnalisée DEVRAIT être configurée pour bloquer le partage d'informations sensibles avec tout le monde.
Det revisjonen avdekket: Publier au moins une politique d'étiquettes de sensibilité (sensitivity labels) auprès des utilisateurs ou groupes cibles, afin de permettre la classification et la protection des documents selon leur niveau de confidentialité. Restreindre le partage de contenu OneDrive au niveau le plus restrictif approprié (au plus 'Invités existants'), sachant qu'OneDrive peut être plus restrictif que SharePoint mais jamais plus permissif. Mettre en place une solution de prévention des pertes de données (DLP) couvrant Exchange Online.

Innsats MiddelsEffekt Høy

Ikke-samsvar som belaster forsikringsbarheten

Faktiske funn knyttet til rotårsakene

Referanse	Kontrollpunkt	Alvorlighetsgrad
M365SEC:2.4.2M365SAT, Monkey365	MEx 2.4.2 - Priority accounts do not have 'Strict protection' presets applied	Høy
M365SEC:7.3.2M365SAT, Monkey365	MSp 7.3.2 - OneDrive for Business sync from unmanaged devices is not blocked	Høy
MT.1037Maester	Only users with Presenter role are allowed to present in Teams meetings	Høy
MT.1034Maester	MT.1034.$($EmergencyAccessUsers.IndexOf($_)): Emergency access users should not be blocked ($($_.userPrincipalName))	Å utbedre
M365SEC:5.2.2.2M365SAT, Monkey365	MAz 5.2.2.2 - MultiFactor Authentication (MFA) is not enabled for all users non-administrative roles	Kritisk
CISA:MS.AAD.3.2Maester, ScubaGear	If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users.	Kritisk
M365SEC:5.1.5.2M365SAT, Maester, Monkey365	CISMAz 5.1.5.2 - User consent to apps accessing company data on their behalf is allowed!	Høy
M365SEC:5.2.3.4M365SAT, Monkey365	MAz 5.2.3.4 - Not all member users are 'MFA capable'	Høy
ORCA.140Maester	High Confidence Spam action set to Quarantine message.	Høy
ORCA.189.2Maester	Safe Links is not bypassed.	Høy

Blindsoner: ikke dekket av rettskraftig bevis så lenge de ikke er målt

63 ikke-målt(e) kontroll(er) i katalogen

Referanse	Kontrollpunkt	Status
M365SEC:1.3.5M365SAT, Maester, Monkey365	MOff 1.3.5 - Internal phishing protection for Forms is disabled	Ikke målt
M365SEC:2.4.1M365SAT, Monkey365	MEx 2.4.1 - Priority account protection is not enabled and configured!	Ikke målt
M365SEC:3.2.1M365SAT, Monkey365	MEx 3.2.1 - DLP Policy is not enabled!	Ikke målt
M365SEC:7.2.7M365SAT, Maester, Monkey365	MSp 7.2.7 - Ensure link sharing is not restricted in SharePoint and OneDrive!	Ikke målt
CISA:MS.AAD.4.1Maester, ScubaGear	Security logs SHALL be sent to the agency's security operations center for monitoring.	Ikke målt
M365SEC:6.2.1M365SAT, Monkey365	MEx 6.2.1 - Forms of mail forwarding are not blocked and/or not disabled	Ikke målt
CISA:MS.EXO.13.1Maester, ScubaGear	Mailbox auditing SHALL be enabled.	Ikke målt
M365SEC:4.2Monkey365	Devices enrollment personal devices not blocked	Ikke målt
M365SEC:7.2.11Maester, Monkey365	Ensure the SharePoint default sharing link permission is set	Ikke målt
MT.1027Maester	No Service Principal with Client Secret and permanent role assignment on Control Plane.	Ikke målt

Rekkefølgen for å bygge forsikringsbarhetsdokumentet

Først

Grunnkonfigurasjonen. Det sterkeste forholdet mellom eliminert risiko og innsats. Så lenge dette ikke er gjort, beskytter resten et hus med åpen dør.

Deretter

Identiteten. Når det første tiltaket er gjennomført, reduserer vi overflaten der risikoen kan materialisere seg.

Deretter

Overvåkingen. Det gjenstår å forankre disse resultatene over tid: styring, regelmessige gjennomganger og bevarte bevis, slik at posisjonen holder over tid og ikke bare på revisjonsdagen.

Under konsolidering

Gjenstående grunnleggende prosjekter. ekstern eksponering: å konsolidere når toppen av prioritetslisten er tatt.

Det denne trinnvise fremgangsmåten unngår

Driftsavbrudd. en kapret konto som lammer driften.

Lekkasje. kundedata som forsvinner uten spor.

Ikke-samsvar. et rettskraftig GDPR- eller NIS2-avvik ved en kontroll.

Avslag på forsikring. en skadesak uten dekning grunnet manglende bevis.

De 195 kontrollene som er oppfylt, én for én

Dere trenger ikke tro oss på en totalsum. Hver linje nedenfor bærer sin referanse og det offentlige rammeverket den bygger på: forsikringsselskapet deres, oppdragsgiveren deres eller revisoren deres kan kontrollere dem én for én i deres egne Microsoft-logger.

Referanse	Kontrollpunkt	Alvorlighetsgrad
ANSSI R13ANSSI/NIS2 ANSSI R13	ANSSI R13	Samsvarende
ANSSI R14ANSSI/NIS2 ANSSI R14	ANSSI R14	Samsvarende
ANSSI R16ANSSI/NIS2 ANSSI R16	ANSSI R16	Samsvarende
ANSSI R24ANSSI/NIS2 ANSSI R24	ANSSI R24	Samsvarende
ANSSI R29ANSSI/NIS2 ANSSI R29	ANSSI R29	Samsvarende
ANSSI R36ANSSI/NIS2 ANSSI R36	ANSSI R36	Samsvarende
ANSSI R5ANSSI/NIS2 ANSSI R5	ANSSI R5	Samsvarende
ANSSI R8ANSSI/NIS2 ANSSI R8	ANSSI R8	Samsvarende
M365SEC:5.1.1.1M365SAT CISMAz5111	CISMAz 5.1.1.1 - The Security Defaults are enabled on Azure Active Directory Tenant	Samsvarende
M365SEC:6.1.4M365SAT CISMEx614	MEx 6.1.4 - Des boîtes aux lettres portent-elles 'AuditBypassEnabled', qui les exclut du journal d'audit ?	Samsvarende
CISA:MS.EXO.10.1Maester CISA.MS.EXO.10.1	Emails SHALL be scanned for malware.	Samsvarende
CISA:MS.EXO.10.2Maester CISA.MS.EXO.10.2	Emails identified as containing malware SHALL be quarantined or dropped.	Samsvarende
CISA:MS.EXO.10.3Maester CISA.MS.EXO.10.3	Email scanning SHALL be capable of reviewing emails after delivery.	Samsvarende
CISA:MS.EXO.11.1Maester CISA.MS.EXO.11.1	Impersonation protection checks SHOULD be used.	Samsvarende
CISA:MS.EXO.11.2Maester CISA.MS.EXO.11.2	User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.	Samsvarende
CISA:MS.EXO.11.3Maester CISA.MS.EXO.11.3	The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence.	Samsvarende
CISA:MS.EXO.12.1Maester CISA.MS.EXO.12.1	IP allow lists SHOULD NOT be created.	Samsvarende
CISA:MS.EXO.14.1Maester CISA.MS.EXO.14.1	A spam filter SHALL be enabled.	Samsvarende
CISA:MS.EXO.14.2Maester CISA.MS.EXO.14.2	Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.	Samsvarende
CISA:MS.EXO.14.3Maester CISA.MS.EXO.14.3	Allowed domains SHALL NOT be added to inbound anti-spam protection policies.	Samsvarende
CISA:MS.EXO.15.1Maester CISA.MS.EXO.15.1	URL comparison with a block-list SHOULD be enabled.	Samsvarende
CISA:MS.EXO.15.2Maester CISA.MS.EXO.15.2	Direct download links SHOULD be scanned for malware.	Samsvarende
CISA:MS.EXO.15.3Maester CISA.MS.EXO.15.3	User click tracking SHOULD be enabled.	Samsvarende
CISA:MS.EXO.16.1Maester CISA.MS.EXO.16.1	Alerts SHALL be enabled.	Samsvarende
CISA:MS.EXO.16.2Maester CISA.MS.EXO.16.2	Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.	Samsvarende
CISA:MS.EXO.17.1Maester CISA.MS.EXO.17.1	Microsoft Purview Audit (Standard) logging SHALL be enabled.	Samsvarende
CISA:MS.EXO.2.1Maester CISA.MS.EXO.2.1	A list of approved IP addresses for sending mail SHALL be maintained.	Samsvarende
EIDSCA.AF01Maester EIDSCA.AF01	Authentication method - FIDO2 security key - State.	Samsvarende
EIDSCA.AF02Maester EIDSCA.AF02	Authentication Method - FIDO2 security key - Allow self-service set up.	Samsvarende
EIDSCA.AF03Maester EIDSCA.AF03	Authentication method - FIDO2 security key - Enforce attestation.	Samsvarende
EIDSCA.AF04Maester EIDSCA.AF04	Authentication method - FIDO2 security key - Enforce key restrictions.	Samsvarende
EIDSCA.AF05Maester EIDSCA.AF05	Authentication method - FIDO2 security key - Restricted.	Samsvarende
EIDSCA.AF06Maester EIDSCA.AF06	Authentication Method - FIDO2 security key - Restrict specific keys.	Samsvarende
EIDSCA.AG01Maester EIDSCA.AG01	Authentication method - General settings - Manage migration.	Samsvarende
EIDSCA.AG02Maester EIDSCA.AG02	Authentication method - General settings - Report suspicious activity - State.	Samsvarende
EIDSCA.AM01Maester EIDSCA.AM01	Authentication method - Microsoft Authenticator - State.	Samsvarende
EIDSCA.AM02Maester EIDSCA.AM02	Authentication method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP.	Samsvarende
EIDSCA.AM03Maester EIDSCA.AM03	Authentication Method - Microsoft Authenticator - Require number matching for push notifications.	Samsvarende
EIDSCA.AM04Maester EIDSCA.AM04	Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications.	Samsvarende
EIDSCA.AM06Maester EIDSCA.AM06	Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications.	Samsvarende
EIDSCA.AM07Maester EIDSCA.AM07	Authentication method - Microsoft Authenticator - Users and groups included for showing the application name in push and passwordless notifications.	Samsvarende
EIDSCA.AM09Maester EIDSCA.AM09	Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications.	Samsvarende
EIDSCA.AM10Maester EIDSCA.AM10	Authentication method - Microsoft Authenticator - Users and groups included for showing the geographic location in push and passwordless notifications.	Samsvarende
EIDSCA.AP01Maester EIDSCA.AP01	Default authorization settings - Self-service password reset enabled for administrators.	Samsvarende
EIDSCA.AP04Maester EIDSCA.AP04	Default Authorization Settings - Guest invite restrictions.	Samsvarende
EIDSCA.AP06Maester EIDSCA.AP06	Default Authorization Settings - User can join the tenant by email validation.	Samsvarende
EIDSCA.AP08Maester EIDSCA.AP08	Default authorization settings - User consent policy assigned for applications.	Samsvarende
EIDSCA.AP10Maester EIDSCA.AP10	Default Authorization Settings - Default User Role Permissions - Allowed to create Apps.	Samsvarende
EIDSCA.AS04Maester EIDSCA.AS04	Authentication Method - SMS - Use for sign-in.	Samsvarende
EIDSCA.AT01Maester EIDSCA.AT01	Authentication method - Temporary Access Pass - State.	Samsvarende
EIDSCA.AT02Maester EIDSCA.AT02	Authentication method - Temporary Access Pass - One-time use.	Samsvarende
EIDSCA.AV01Maester EIDSCA.AV01	Authentication method - Voice call - State.	Samsvarende
EIDSCA.CP01Maester EIDSCA.CP01	Default settings - Consent policy settings - Group owner consent for apps accessing data.	Samsvarende
EIDSCA.CP03Maester EIDSCA.CP03	Default Settings - Consent Policy Settings - Block user consent for risky apps.	Samsvarende
EIDSCA.PR02Maester EIDSCA.PR02	Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.	Samsvarende
EIDSCA.PR03Maester EIDSCA.PR03	Default settings - Password rule settings - Enforce custom list.	Samsvarende
EIDSCA.PR05Maester EIDSCA.PR05	Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds.	Samsvarende
EIDSCA.PR06Maester EIDSCA.PR06	Default settings - Password rule settings - Smart Lockout - Lockout threshold.	Samsvarende
EIDSCA.ST08Maester EIDSCA.ST08	Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner.	Samsvarende
EIDSCA.ST09Maester EIDSCA.ST09	Default settings - Classification and M365 groups - M365 groups - Allow guests to access group content.	Samsvarende
M365SEC:1.1.1Maester M365.1.1.1	MOff 1.1.1 - Ensure Administrative accounts are separate and cloud-only	Samsvarende
M365SEC:1.1.3Maester M365.1.1.3	Ensure that between two and four global admins are designated	Samsvarende
M365SEC:1.3.1Maester M365.1.3.1	Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'	Samsvarende
M365SEC:1.3.3Maester M365.1.3.3	Ensure 'External sharing' of calendars is not available	Samsvarende
M365SEC:1.3.4Maester M365.1.3.4	MOff 1.3.4 - User owned apps and services are not restricted	Samsvarende
M365SEC:2.1.1Maester M365.2.1.1	Ensure Safe Links for Office Applications is Enabled (Only Checks Default Policy)	Samsvarende
M365SEC:2.1.11Maester M365.2.1.11	Ensure comprehensive attachment filtering is applied	Samsvarende
M365SEC:2.1.2Maester M365.2.1.2	Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy)	Samsvarende
M365SEC:2.1.3Maester M365.2.1.3	Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy)	Samsvarende
M365SEC:2.1.4Maester M365.2.1.4	Ensure Safe Attachments policy is enabled (Only Checks Default Policy)	Samsvarende
M365SEC:2.1.5Maester M365.2.1.5	Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled	Samsvarende
M365SEC:2.1.6Maester M365.2.1.6	Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy)	Samsvarende
M365SEC:2.1.7Maester M365.2.1.7	Ensure that an anti-phishing policy has been created (Only Checks Default Policy)	Samsvarende
M365SEC:3.1.1Maester M365.3.1.1	MEx 3.1.1 - Microsoft 365 audit log search is Disabled!	Samsvarende
M365SEC:4.1Maester M365.4.1	Ensure devices without a compliance policy are marked	Samsvarende
M365SEC:5.1.2.2Maester M365.5.1.2.2	MAz 5.1.2.2 - Third party integrated applications are allowed!	Samsvarende
M365SEC:5.1.5.1Maester M365.5.1.5.1	Ensure user consent to apps accessing company data on their behalf is not allowed	Samsvarende
M365SEC:5.1.6.2Maester M365.5.1.6.2	Ensure that guest user access is restricted	Samsvarende
M365SEC:5.2.3.5Maester M365.5.2.3.5	Ensure weak authentication methods are disabled	Samsvarende
M365SEC:7.2.2Maester M365.7.2.2	MSp 7.2.2 - SharePoint and OneDrive integration with Azure AD B2B is not enabled!	Samsvarende
M365SEC:7.2.5Maester M365.7.2.5	Ensure that SharePoint guest users cannot share items they don	Samsvarende
M365SEC:7.2.9Maester M365.7.2.9	MSp 7.2.9 - Guest access to a site or OneDrive does not expire automatically	Samsvarende
M365SEC:7.3.1Maester M365.7.3.1	MSp 7.3.1 - Office 365 SharePoint infected files are NOT disallowed for download	Samsvarende
M365SEC:8.4.1Maester M365.8.4.1	Ensure all or a majority of third-party and custom apps are blocked	Samsvarende
M365SEC:8.6.1Maester M365.8.6.1	Ensure users can report security concerns in Teams to internal destination	Samsvarende
MT.1003Maester MT.1003	At least one Conditional Access policy is configured with All Apps.	Samsvarende
MT.1004Maester MT.1004	At least one Conditional Access policy is configured with All Apps and All Users.	Samsvarende
MT.1006Maester MT.1006	At least one Conditional Access policy is configured to require MFA for administrators.	Samsvarende
MT.1007Maester MT.1007	At least one Conditional Access policy is configured to require MFA for all users.	Samsvarende
MT.1008Maester MT.1008	At least one Conditional Access policy is configured to require MFA for Azure management.	Samsvarende
MT.1009Maester MT.1009	At least one Conditional Access policy is configured to block other legacy authentication.	Samsvarende
MT.1010Maester MT.1010	At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync.	Samsvarende
MT.1011Maester MT.1011	At least one Conditional Access policy is configured to secure security info registration only from a trusted location.	Samsvarende
MT.1014Maester MT.1014	At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for administrators.	Samsvarende
MT.1015Maester MT.1015	At least one Conditional Access policy is configured to block access from unknown or unsupported device platforms.	Samsvarende
MT.1016Maester MT.1016	At least one Conditional Access policy is configured to require MFA for guest access.	Samsvarende
MT.1020Maester MT.1020	All Conditional Access policies are configured to exclude directory synchronisation accounts, or do not target them.	Samsvarende
MT.1022Maester MT.1022	MT.1022	Samsvarende
MT.1025Maester MT.1025	No external user with permanent role assignment on Control Plane.	Samsvarende
MT.1026Maester MT.1026	No hybrid user with permanent role assignment on Control Plane.	Samsvarende
MT.1031Maester MT.1031	Control Plane privileged roles are managed by PIM only.	Samsvarende
MT.1032Maester MT.1032	A limited number of Global Administrators is assigned.	Samsvarende
MT.1044Maester MT.1044	Ensure modern authentication for Exchange Online is enabled	Samsvarende
MT.1045Maester MT.1045	Only guest users should be admitted automatically to Teams meetings	Samsvarende
MT.1050Maester MT.1050	Applications with high-risk permissions having a direct path to Global Administrator.	Samsvarende
MT.1051Maester MT.1051	Applications with high-risk permissions having an indirect path to Global Administrator.	Samsvarende
MT.1052Maester MT.1052	At least one Conditional Access policy targets the Device Code authentication flow.	Samsvarende
MT.1061Maester MT.1061	The device registration MFA control conflicts with Conditional Access policies.	Samsvarende
MT.1066Maester MT.1066	Conditional Access policies should not include or exclude deleted users, groups or roles.	Samsvarende
MT.1071Maester MT.1071	At least one Conditional Access policy explicitly includes Azure DevOps.	Samsvarende
MT.1072Maester MT.1072	Conditional Access policies should not use the deprecated Approved Client App grant.	Samsvarende
MT.1075Maester MT.1075	Third-party Entra applications should have explicitly assigned users rather than All Users.	Samsvarende
MT.1105Maester MT.1105	The MDM authority should be set to Microsoft Intune	Samsvarende
ORCA.101Maester ORCA.101	Bulk is marked as spam.	Samsvarende
ORCA.102Maester ORCA.102	Advanced Spam filter options are turned off.	Samsvarende
ORCA.104Maester ORCA.104	High Confidence Phish action set to Quarantine message.	Samsvarende
ORCA.108.1Maester ORCA.108.1	DNS Records have been set up to support DKIM.	Samsvarende
ORCA.109Maester ORCA.109	Senders are not unsafely allow listed.	Samsvarende
ORCA.111Maester ORCA.111	Anti-phishing policy exists and EnableUnauthenticatedSender is true.	Samsvarende
ORCA.112Maester ORCA.112	Anti-spoofing protection action is configured to Move message to the recipients' Junk Email folders in Anti-phishing policy.	Samsvarende
ORCA.118.1Maester ORCA.118.1	Domains are not unsafely allow listed in anti-spam policies.	Samsvarende
ORCA.118.3Maester ORCA.118.3	Your own domains are not unsafely allow listed in anti-spam policies.	Samsvarende
ORCA.121Maester ORCA.121	A supported filter policy action is in use.	Samsvarende
ORCA.124Maester ORCA.124	Safe Attachments unknown malware response is set to block messages.	Samsvarende
ORCA.139Maester ORCA.139	The spam action is set to move the message to the Junk Email folder or to quarantine.	Samsvarende
ORCA.141Maester ORCA.141	Bulk action set to Move message to Junk Email Folder.	Samsvarende
ORCA.143Maester ORCA.143	Safety Tips are enabled.	Samsvarende
ORCA.158Maester ORCA.158	Safe Attachments is enabled for SharePoint and Teams.	Samsvarende
ORCA.180Maester ORCA.180	Anti-phishing policy exists and EnableSpoofIntelligence is true.	Samsvarende
ORCA.221Maester ORCA.221	Mailbox Intelligence is enabled in anti-phishing policies.	Samsvarende
ORCA.225Maester ORCA.225	Safe Documents is enabled for Office clients.	Samsvarende
ORCA.226Maester ORCA.226	Every domain has a Safe Links policy applied to it.	Samsvarende
ORCA.227Maester ORCA.227	Every domain has a Safe Attachments policy applied to it.	Samsvarende
ORCA.228Maester ORCA.228	No trusted senders in Anti-phishing policy.	Samsvarende
ORCA.229Maester ORCA.229	No trusted domains in Anti-phishing policy.	Samsvarende
ORCA.230Maester ORCA.230	Each domain has a Anti-phishing policy applied to it, or the default policy is being used.	Samsvarende
ORCA.231Maester ORCA.231	Each domain has a anti-spam policy applied to it, or the default policy is being used.	Samsvarende
ORCA.232Maester ORCA.232	Each domain has a malware filter policy applied to it, or the default policy is being used.	Samsvarende
ORCA.234Maester ORCA.234	Click through is disabled for Safe Documents.	Samsvarende
ORCA.236Maester ORCA.236	Safe Links is enabled for emails.	Samsvarende
ORCA.237Maester ORCA.237	Safe Links is enabled for teams messages.	Samsvarende
ORCA.238Maester ORCA.238	Safe Links is enabled for office documents.	Samsvarende
ORCA.240Maester ORCA.240	Outlook is configured to display external tags for external emails.	Samsvarende
ORCA.242Maester ORCA.242	The significant protection alerts responsible for AIR activity are enabled.	Samsvarende
ORCA.244Maester ORCA.244	Policies are configured to honour the DMARC policy of sending domains.	Samsvarende
M365SEC:5.2.2.3Monkey365 eid-cap-block-legacy-authentication-not-enabled	MAz 5.2.2.3 - No Conditional Access policies to block legacy authentication	Samsvarende
M365SEC:5.2.2.4Monkey365 eid-cap-lack-sign-in-frequency-browser-persistent-session	MAz 5.2.2.4 - Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users	Samsvarende
M365SEC:5.2.2.12Monkey365 eid-device-code-sign-in-flow-not-enabled	Eid device code sign in flow not enabled	Samsvarende
M365SEC:5.2.2.1Monkey365 eid-ensure-mfa-for-high-privileged-users-missing-cap	MAz 5.2.2.1 - MultiFactor Authentication (MFA) is not enabled for all users in administrative roles	Samsvarende
M365SEC:5.2.2.5Monkey365 eid-ensure-phishing-resistant-mfa-for-high-privileged-users-missing-cap	MAz 5.2.2.5 - Phishing-resistant MFA strength must be required for Administrators	Samsvarende
M365SEC:5.1.6.3Monkey365 eid-guest-invite-restriction-disabled	Eid guest invite restriction disabled	Samsvarende
M365SEC:5.2.3.1Monkey365 eid-microsoft-authenticator-lack-mfa-fatigue-protection	MAz 5.2.3.1 - Microsoft Authenticator is not configured to protect against MFA fatigue	Samsvarende
M365SEC:5.1.8.1Monkey365 eid-password-hash-sync-disabled	MAz 5.1.8.1 - Password Synchronization Disabled	Samsvarende
M365SEC:5.2.2.9Monkey365 eid-require-device-compliant-all-apps-missing-cap	Eid require device compliant all apps missing cap	Samsvarende
M365SEC:5.2.2.10Monkey365 eid-require-device-compliant-to-register-security-info-missing-cap	Eid require device compliant to register security info missing cap	Samsvarende
M365SEC:5.1.6.1Monkey365 eid-restrict-collaboration-specific-domains-disabled	MAz 5.1.6.1 - Collaboration invitations are not sent to allowed domains only	Samsvarende
M365SEC:5.2.2.11Monkey365 eid-sign-in-frequency-intune-enrollment-missing-cap	Eid sign in frequency intune enrollment missing cap	Samsvarende
M365SEC:5.2.4.1Monkey365 eid-sspr-enabled-set-to-all	MAz 5.2.4.1 - Self Service Password Reset is not set to be enabled for all users	Samsvarende
M365SEC:6.1.3Monkey365 exchange-audit-bypass-enabled	Exchange audit bypass enabled	Samsvarende
M365SEC:6.1.1Monkey365 exchange-audit-enabled-globally	MEx 6.1.1 - Mailbox auditing is not Enabled for all users	Samsvarende
M365SEC:6.2.3Monkey365 exchange-external-email-sender-configured	MEx 6.2.3 - Email from external senders cannot be identified	Samsvarende
M365SEC:6.5.1Monkey365 exchange-modern-authentication-disabled	Exchange modern authentication disabled	Samsvarende
M365SEC:2.1.14Monkey365 exhange-inbound-anti-spam-policies-allowed-domains	MEx 2.1.14 - No comprehensive attachment filtering is applied!	Samsvarende
M365SEC:7.2.8Monkey365 sharepoint-external-sharing-not-restricted-by-security-group	MSp 7.2.8 - Ensure external sharing is restricted by security group!	Samsvarende
M365SEC:7.2.1Monkey365 sharepoint-modern-authentication-required	SharePoint modern authentication required	Samsvarende
M365SEC:8.5.1Monkey365 teams-anonymous-users-cant-join-meeting	CISM Tm 8.5.1 - Anonymous users can join a meeting	Samsvarende
CISA:MS.AAD.1.1ScubaGear MS.AAD.1.1v1	Legacy authentication SHALL be blocked.	Samsvarende
CISA:MS.AAD.3.1ScubaGear MS.AAD.3.1v1	Phishing-resistant MFA SHALL be enforced for all users.	Samsvarende
CISA:MS.AAD.3.3ScubaGear MS.AAD.3.3v2	If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.	Samsvarende
CISA:MS.AAD.3.4ScubaGear MS.AAD.3.4v1	The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.	Samsvarende
CISA:MS.AAD.3.6ScubaGear MS.AAD.3.6v1	Phishing-resistant MFA SHALL be required for highly privileged roles.	Samsvarende
CISA:MS.AAD.3.7ScubaGear MS.AAD.3.7v1	Managed devices SHOULD be required for authentication.	Samsvarende
CISA:MS.AAD.3.8ScubaGear MS.AAD.3.8v1	Managed Devices SHOULD be required to register MFA.	Samsvarende
CISA:MS.AAD.3.9ScubaGear MS.AAD.3.9v1	Device code authentication SHOULD be blocked.	Samsvarende
CISA:MS.AAD.5.1ScubaGear MS.AAD.5.1v1	Only administrators SHALL be allowed to register applications.	Samsvarende
CISA:MS.AAD.5.2ScubaGear MS.AAD.5.2v1	Only administrators SHALL be allowed to consent to applications.	Samsvarende
CISA:MS.AAD.6.1ScubaGear MS.AAD.6.1v1	User passwords SHALL NOT expire.	Samsvarende
CISA:MS.AAD.7.1ScubaGear MS.AAD.7.1v1	A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.	Samsvarende
CISA:MS.AAD.7.2ScubaGear MS.AAD.7.2v1	Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.	Samsvarende
CISA:MS.AAD.7.4ScubaGear MS.AAD.7.4v1	Permanent active role assignments SHALL NOT be allowed for highly privileged roles.	Samsvarende
CISA:MS.AAD.8.1ScubaGear MS.AAD.8.1v1	Guest users SHOULD have limited or restricted access to Microsoft Entra ID directory objects.	Samsvarende
CISA:MS.AAD.8.2ScubaGear MS.AAD.8.2v1	Only users with the Guest Inviter role SHOULD be able to invite guest users.	Samsvarende
CISA:MS.AAD.8.3ScubaGear MS.AAD.8.3v1	Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.	Samsvarende
CISA:MS.DEFENDER.2.2ScubaGear MS.DEFENDER.2.2v1	Domain impersonation protection SHOULD be enabled for agency-owned domains in standard and strict policies.	Samsvarende
CISA:MS.DEFENDER.2.3ScubaGear MS.DEFENDER.2.3v1	Domain impersonation protection SHOULD be added for key suppliers and partners in standard and strict policies.	Samsvarende
CISA:MS.DEFENDER.3.1ScubaGear MS.DEFENDER.3.1v1	Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams.	Samsvarende
CISA:MS.DEFENDER.5.1ScubaGear MS.DEFENDER.5.1v1	Alerts required by Exchange Online baseline SHALL be enabled at minimum.	Samsvarende
CISA:MS.DEFENDER.5.2ScubaGear MS.DEFENDER.5.2v1	Alerts SHOULD be sent to a monitored address or incorporated into SIEM.	Samsvarende
CISA:MS.DEFENDER.6.1ScubaGear MS.DEFENDER.6.1v1	Unified Audit logging SHALL be enabled.	Samsvarende
CISA:MS.EXO.1.1ScubaGear MS.EXO.1.1v2	Automatic forwarding to external domains SHALL be disabled.	Samsvarende
CISA:MS.EXO.6.1ScubaGear MS.EXO.6.1v1	Contact folders SHALL NOT be shared with all domains.	Samsvarende
CISA:MS.EXO.6.2ScubaGear MS.EXO.6.2v1	Calendar details SHALL NOT be shared with all domains.	Samsvarende
CISA:MS.EXO.7.1ScubaGear MS.EXO.7.1v1	External sender warnings SHALL be implemented.	Samsvarende
CISA:MS.SHAREPOINT.1.3ScubaGear MS.SHAREPOINT.1.3v1	External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.	Samsvarende
CISA:MS.TEAMS.1.3ScubaGear MS.TEAMS.1.3v1	Anonymous users and dial-in callers SHOULD NOT be admitted automatically.	Samsvarende

Det verifiserbare beviset er argumentet. Denne diagnosen har aldri sett dine data: kun konfigurasjonsparametre er lest, aldri personlig innhold. Hvert funn ovenfor kan verifiseres i dine egne Microsoft-logger, dermed rettskraftig - enten leseren er en forsikringsgiver, en oppdragsgiver som reviderer deg, eller en revisor.

Metode & bevis

Direkte lesning, null-kunnskap

Microsoft 365-konfigurasjon lest via Graph-API (katalog, Exchange, Teams, SharePoint, Purview): ingen data (e-post, fil) leses, kun innstillinger. Ingen lagring av data utover produksjonen av rapporten.

Kryssede rammeverk

M365-sikkerhetsgrunnlagCISA SCuBAMaesterMonkey365M365SATSYAGA-kontroller

Grunnlag omformulert av SYAGA basert på åpne kildekode-verktøy, krysset med CISA SCuBA-standarden.

Vurdert omfang

280

avgjorte kontroller i SYAGA-katalogen

420 = 280 avgjort + 44 med assistert dekning + 63 ikke målt + 24 non applicables (licence) + 6 erklærende (organisatorisk) + 3 en lecture seule

SYAGA CONSULTING attesterer at funnene ovenfor er resultat av en direkte lesning av konfigurasjonen til den reviderte leietakeren på den angitte datoen, i henhold til den beskrevne null-kunnskap-metoden, og uten lagring av data utover produksjonen av denne rapporten.

Referanse: SYAGA-DEMO-QUESTIONNAIRE-0001

Score = contrôles conformes / contrôles tranchés (conformes + non conformes), sans pondération ; les contrôles non collectés et non applicables sont exclus du score.

Valgfritt SharePoint-tillegg (3 kontroll(er))

Complément optionnel : Microsoft ne propose pas de mode lecture seule pour ces réglages SharePoint par site - y accéder exige un droit d'écriture (limite Microsoft, pas la nôtre). Désactivé par défaut, disponible en option de votre côté, et hors score tant que non activé.

Disse kontrollene teller VERKEN som samsvarende, ELLER som ikke-samsvarende, ELLER som ikke innsamlet: de forblir utenfor poengsum så lenge du ikke aktiverer tillegget (på ditt eget initiativ, hos deg, aldri hos oss).

Ikke relevant: funksjon ikke til stede på leietakeren (24 kontroll(er))

Disse kontrollene gjelder ikke din leietaker: den aktuelle funksjonen (Microsoft Entra ID P2/Governance-lisens, eller produkt som Copilot, Sentinel, Defender for Endpoint, Power Platform...) er ikke til stede der. Det er derfor ingenting å måle: det er verken en feil eller en blindsone.

Disse kontrollene teller VERKEN som samsvarende, ELLER som ikke-samsvarende: det er en konstatering, ikke en feil. Vi oppfordrer deg ikke til å kjøpe en ekstra lisens: sikkerhetsmålet kan ofte nås på andre måter (konfigurasjon, intern prosedyre, eller et tredjepartsverktøy, noen ganger åpen kildekode og rimeligere). De ville igjen blitt målbare dersom ressursen var til stede på din leietaker.

6 point(s) de vigilance organisationnels

Disse kravene (fysisk sikring, nettverkssegmentering, bevisstgjøring, styring) hører til organisasjonen og kan IKKE måles med en skrivebeskyttet Microsoft 365-skanning. De rapporteres separat, utenfor poengsummen og utenfor antallet avvik: må kontrolleres ved en intern gjennomgang.

SYAGA Audit · utgitt av SYAGA CONSULTINGVerifiserbar revisjon, aldri en sertifisering