Tenantkeep Posture

Check catalog

Every check the product evaluates, by domain. The pass logic, remediation and framework mappings are part of the product; this page lists what is checked and the licence each check needs.

Identity and privileged access (15)

ID	Check	Severity	Licence	What it means
ID-001	Global Administrator count between two and five	High	none	Every Global Administrator is a full tenant takeover away from any phishing kit or malware on that person's machine. Microsoft recommends fewer than five, and two is the floor because the break-glass accounts hold the role. Counts above that usually come from convenience assignments that nobody revisited.
ID-002	No permanent privileged assignments outside break-glass	High	P2	A standing privileged role is a standing target. Eligible assignments mean the role exists only for the hours it is activated, every activation is logged with a reason, and an attacker who lands in the account outside that window gets a normal user. This is what Entra ID P2 is for.
ID-003	No administrators synced from on-premises AD	High	none	A synced account's password and status are controlled from on-premises Active Directory. If a domain controller falls, every synced administrator falls with it, and the attacker reaches the cloud without touching it. Microsoft's guidance for protecting Microsoft 365 from on-premises attacks starts with cloud-only privileged accounts.
ID-004	Administrator accounts are unlicensed, separate identities	Medium	none	An administrator who reads mail and browses with the same account exposes the role to every phishing message and drive-by download. A separate, unlicensed admin account has no mailbox to phish and no Office session to hijack. Licenses on it are the tell that it doubles as a daily account.
ID-005	Break-glass accounts exist, are cloud-only and enabled	High	none	When MFA, federation or a policy misfire locks every administrator out, the break-glass accounts are the only way back in. They must be cloud-only so an on-premises outage cannot take them, enabled so they work, and excluded from blocking policies so the lockout does not apply to them.
ID-006	PIM activation settings on the top roles	High	P2	Eligible assignments only help if activation is harder than a click. MFA on activation stops a stolen session from elevating, a duration cap limits how long an activated role lives, and approval on Global Administrator puts a second person between an attacker and the tenant.
ID-007	No service principal holds Global Administrator	High	none	A service principal with a directory role is an administrator with no MFA, no sign-in frequency and usually a secret somewhere in a pipeline. Global Administrator on one of them is the most direct path from a leaked secret to full tenant control.
ID-008	User consent limited to admin consent or verified low-impact apps	High	none	Consent phishing asks a user to approve an app that reads their mail and files. If users can consent to any permission, one click gives the attacker a persistent OAuth grant that survives password changes and MFA. Restricting consent closes the door; the workflow keeps legitimate requests moving.
ID-009	Admin consent workflow enabled with reviewers	Medium	none	Once user consent is restricted, users need a way to ask. Without the workflow they ask by email or not at all, and administrators grant tenant-wide consent to get them unblocked, which is worse than the user consent that was removed.
ID-010	No expired or soon-to-expire application credentials	Medium	none	An expired credential on a live integration is an outage waiting for the next token refresh. Expired credentials left in place also hide which ones are actually in use. Thirty days is the window in which rotation can be scheduled rather than done in an incident.
ID-011	High-privilege application permissions justified	High	none	An application permission applies to every mailbox, site or user in the tenant with no user present. Directory.ReadWrite.All or Mail.ReadWrite on a forgotten app is a complete data exfiltration path that bypasses Conditional Access entirely. Each one should have a name next to it.
ID-012	No guests inactive beyond the threshold	Medium	P1	A guest who has not signed in for months still holds whatever was shared with them, under an identity another organisation controls. Inactive guests are the longest-lived access in most tenants and the least looked at.
ID-013	Cross-tenant inbound access reviewed, not default-open	Medium	none	The default cross-tenant settings allow any external user to be invited to any application. That is fine for an organisation that has decided it, and a gap for one that never looked. The check fails on the untouched default so the decision gets made.
ID-014	Sign-in and audit logs exported to Log Analytics or a SIEM	High	none	Entra keeps sign-in logs for seven to thirty days depending on license. An incident discovered later than that has no evidence to investigate. Exporting the logs is a one-time setting and the difference between knowing what happened and guessing.
ID-015	No high-risk users left unaddressed	High	P2	A user flagged high risk has leaked credentials or attacker-pattern sign-ins. A week without action means either nobody is watching the report or the user-risk policy is missing. Either way the account is still usable by whoever triggered the detection.

Authentication methods (9)

ID	Check	Severity	Licence	What it means
AU-001	SMS and voice disabled or scoped to a migration group	High	none	SMS and voice are the weakest second factors: SIM swaps, SS7 interception and social engineering of carriers all defeat them, and they cannot be made phishing-resistant. Leaving them enabled for all users means an attacker who needs a second factor picks the easiest one.
AU-002	Authenticator shows app and location context	Medium	none	MFA fatigue attacks spam approvals until the user taps one. Number matching made the tap deliberate; showing the requesting app and the sign-in location tells the user that the request from another country for an app they are not using is not theirs.
AU-003	Passkeys enabled	High	none	Passkeys are the phishing-resistant method most users can actually adopt: no code to type, nothing to relay, bound to the site. If the method is disabled nothing else in the phishing-resistant story can start.
AU-004	Legacy MFA and SSPR policies migrated	Medium	none	While the migration is in progress, three policies decide which methods a user can register and the effective result is the union of them. Finishing the migration makes the authentication methods policy the one place that matters, which is what every other check here assumes.
AU-005	Temporary Access Pass enabled, one-time by default	Low	none	A Temporary Access Pass is how a new user or someone with a lost phone registers a passkey without a password-only window. A reusable pass with a long lifetime is itself a credential worth stealing, so one-time use is the default to keep.
AU-006	MFA registered for every member	High	none	An MFA policy only protects users who have a method registered; the rest are prompted to register at their next sign-in, which an attacker with the password is happy to do. The registered percentage is the real coverage number behind every MFA policy.
AU-007	Passwordless-capable share of members at target	Low	none	Passwordless-capable users can sign in without a password at all, which removes the credential phishing steals. The number is reported here and compared against the target the organisation sets, since a sensible target depends on where the rollout is.
AU-008	Every administrator has a phishing-resistant method registered	Critical	none	The phishing-resistant policy for administrators (CA-003) can only be enforced once every administrator has a method that satisfies it. This check is the readiness gate: who still signs in with a push notification or a code that an adversary-in-the-middle kit can relay.
AU-009	No users on legacy per-user MFA	Medium	none	Per-user MFA predates Conditional Access and prompts on every sign-in regardless of risk, device or app. Users on it get MFA fatigue, administrators get no policy control, and it cannot require a phishing-resistant method. It is the tell of a tenant that was set up before 2019 and never revisited.

Conditional Access (15)

ID	Check	Severity	Licence	What it means
CA-001	Legacy authentication blocked	Critical	P1	Legacy protocols such as basic-auth IMAP, POP and SMTP cannot complete a multifactor prompt, so a password spray or a stolen password signs in without any second factor. Blocking them is the single control that removes most password-only sign-ins from the tenant. A policy in report-only mode or with a broad exclusion group leaves the door open for exactly the accounts an attacker will try.
CA-002	MFA required for all users	Critical	P1	A tenant-wide MFA policy is the baseline every other control assumes. Per-user MFA and security defaults cover fewer scenarios and cannot be scoped or reported on. Every account excluded from the policy is an account that signs in with a password alone, which is why the check counts a policy as passing only when its exclusions are limited to the break-glass accounts.
CA-003	Phishing-resistant authentication for administrator roles	Critical	P1	Push notifications and one-time codes can be relayed by an adversary-in-the-middle kit, which captures the session as soon as the administrator approves. Phishing-resistant methods bind the credential to the site, so the relayed prompt fails. Administrators are the accounts those kits are aimed at, and the roles listed here are the ones Microsoft recommends protecting first.
CA-004	Risk-based policies for sign-in risk and user risk	High	P2	Identity Protection scores sign-ins and users on leaked credentials, anonymous networks, impossible travel and attacker infrastructure. Without a policy that acts on the score, the detections are a report nobody reads until after the incident. Requiring MFA on risky sign-ins and a password change on risky users turns the detection into an automatic response.
CA-005	Compliant device required for Office 365 on Windows and macOS	High	P1, Intune	A stolen password with a valid MFA approval still lands on whatever machine the attacker chooses. Requiring a compliant device ties access to a managed, patched, encrypted endpoint with endpoint protection reporting in, which is the control that keeps session theft and credential phishing from turning into data access.
CA-006	No policy left in report-only mode	Medium	P1	Report-only mode exists to measure impact before enforcing. A policy that stays in it for months protects nothing while looking like a control on the policy list. The pileup is a common finding in tenants where a rollout stalled, and it usually hides the policies that would matter most.
CA-007	Exclusion groups under the size threshold	High	P1	Every member of an exclusion group is outside the policy entirely. Groups created for a migration or a vendor tend to grow and never shrink, and an attacker who lands in one of those accounts faces no MFA at all. The size threshold is the point at which an exclusion stops being an exception and becomes a second, weaker policy.
CA-008	No MFA bypass for trusted locations	High	P1	Skipping MFA from the office network treats the network as the credential. Anyone on the wireless, a compromised device on the LAN, or a VPN session from a stolen laptop then signs in with a password alone. Zero trust guidance drops the location bypass because the perimeter is the easiest control to get behind.
CA-009	Sign-in frequency and non-persistent browser for administrators	Medium	P1	An administrator session that persists for weeks is a token worth stealing. Limiting how long the session lives and preventing the browser from keeping it caps what a stolen cookie is worth, and it is the control that makes a token replay noticeable rather than silent.
CA-010	Token protection in use	Medium	P1	Token protection binds the sign-in token to the device it was issued to, so a session cookie copied from a phished or malware-infected machine stops working elsewhere. It closes the gap that MFA leaves open once the user has already signed in. Client support is still growing, which is why report-only with a date counts here.
CA-011	Microsoft-managed policies not silently disabled	Medium	P1	Microsoft creates managed policies in tenants for the controls it considers baseline, such as MFA for administrators and for risky sign-ins, and enables them after a notice period. Disabling one without an equivalent policy removes a control the tenant was about to gain, and the state is easy to miss because the policy stays on the list.
CA-012	Break-glass accounts excluded from every blocking policy	High	P1	A blocking policy that applies to the break-glass accounts can lock every administrator out of the tenant at once, typically during the incident the policy was written for. A policy misfire, an MFA outage or a mistaken location change then has no way back in. Excluding the emergency accounts from every Block is what keeps Conditional Access recoverable.
CA-013	No policy references a deleted object	High	P1	When a group, user or named location a policy references is deleted, the policy keeps the orphaned id and silently stops covering or excluding whoever it pointed at. The portal shows nothing wrong. The result is a policy that reads correctly and does something different, which is the worst kind of drift.
CA-014	No policy left disabled past the threshold	Low	P1	Disabled policies accumulate from pilots and emergencies and make the policy list hard to read, which is how a reviewer misses the one that matters. A disabled policy can also be re-enabled by mistake with stale assignments. Either it is needed, and should be enabled, or it is not, and should go.
CA-015	Policy names follow the naming convention	Low	P1	A naming convention is what lets a reviewer read a policy list and know what each policy is for without opening it. Tenants whose policies are named by whoever created them tend to have duplicates and gaps nobody noticed. With a pattern in the profile the check enforces it; without one it looks for a prefix-and-number structure across the names, and free-text names are the finding.

Devices (14)

ID	Check	Severity	Licence	What it means
DEV-001	Intune compliance rate at target	High	Intune	The compliance rate is the fraction of managed devices meeting the policy: encrypted, current, protected, healthy. It is what the compliant-device Conditional Access control enforces, so the number is both a hygiene measure and the size of the population a device-based policy would lock out. The per-platform split is in the facts.
DEV-002	No stale Entra devices, or a cleanup rule is on	Medium	none	A device object that has not signed in for months still satisfies device-based Conditional Access if someone can use its credential, and it inflates every device count the report relies on. Stale objects are the inventory debt that makes join-type and compliance numbers unreliable.
DEV-003	Join type mix: hybrid share within target	Low	none	Entra joined, hybrid joined and registered devices get different controls and different attack surfaces. The mix is reported here so the trend is visible across runs; the threshold lets a migration set its own pace.
DEV-004	Autopilot share of the Windows fleet at target	Low	Intune	Autopilot-provisioned devices arrive Entra joined, enrolled and policy-bound before a user touches them. The share of the Windows fleet that came through Autopilot is a proxy for how much of it was built to the standard rather than migrated into it.
DEV-005	BitLocker recovery keys escrowed for every Windows device	High	none	A Windows device without an escrowed recovery key is either unencrypted or encrypted with a key nobody holds, and the difference only shows up when the disk needs recovering. Key presence in Entra is the one signal that both encryption happened and the organisation can get the data back.
DEV-006	FileVault enabled on every managed Mac	High	Intune	A lost MacBook without FileVault is a readable disk. Intune reports whether each managed Mac is encrypted; escrow of the recovery key is the second half, so that a locked-out user does not become a wiped machine.
DEV-007	No Windows 10 devices left in the fleet	High	Intune	An unsupported operating system gets no security fixes. Every Windows 10 device without ESU is a known-vulnerable endpoint on the network, and the count is the first thing an auditor or an insurer asks about.
DEV-008	Apple push certificate and VPP tokens well before expiry	High	Intune	When the Apple push certificate lapses, every iPhone, iPad and Mac silently stops receiving management. If it is renewed with a different Apple ID, all of them must be re-enrolled by hand. It expires yearly and the person who created it has often left.
DEV-009	Personal Windows devices blocked from enrollment	Medium	Intune	With personal Windows enrollment open, anyone with a work account can enroll their home PC, which then counts as managed, may satisfy compliance, and pulls corporate data onto hardware nobody controls. The restriction keeps the managed fleet the organisation's own.
DEV-010	Endpoint security policies present and assigned	High	Intune	The five endpoint security policy types are how Intune tells devices to run Defender properly, encrypt the disk, keep the firewall on, block the common attack techniques and report to Defender for Endpoint. A missing type means that control is whatever the device defaulted to.
DEV-011	Windows LAPS policy assigned	High	Intune	Without LAPS every Windows device shares the same local administrator password, or has one nobody knows. Either way a single compromised machine gives lateral movement to all of them. LAPS makes each password unique, rotated and retrievable only through an audited read.
DEV-012	Defender for Endpoint connector enabled in Intune	High	MDE1, MDE2, MDEBusiness	The connector is what lets Intune onboard devices to Defender for Endpoint automatically and use device risk in compliance. Without it, onboarding is manual and a device under attack still reports compliant.
DEV-013	Device cleanup rule enabled	Low	Intune	Without a cleanup rule, every device that was ever enrolled stays in the console, and the compliance and encryption percentages drift toward meaningless. The rule is a one-time setting that keeps the inventory honest.
DEV-014	Linux endpoints enrolled in Intune	Medium	Intune	Linux desktops are usually the developers' machines with the most access and the least management. The count enrolled is reported here because zero is the common answer, and at scale zero is a finding.

Endpoint security (25)

ID	Check	Severity	Licence	What it means
EP-001	Security baselines deployed: Windows, Defender for Endpoint, Edge	Medium	Intune	The baselines carry several hundred hardening settings Microsoft maintains. Without them a tenant depends on whatever a custom profile happened to include. Version currency is not checked here yet.
EP-002	BitLocker policy: required, XTS-AES 256, silent, TPM, keys escrowed	High	Intune	A lost laptop with no encryption is a breach; with encryption and no escrowed key it is a brick with no way back. Silent enablement is what makes the policy reach every device rather than the ones whose users clicked through.
EP-003	Windows Firewall on for domain, private and public profiles	High	Intune	The host firewall is what stands between a laptop on hotel Wi-Fi and lateral movement. A profile left unmanaged can be turned off by any local admin or a legacy GPO.
EP-004	Windows LAPS: backup to Entra, password reset after use	High	Intune	A shared local administrator password is the oldest lateral movement path there is. LAPS gives every device its own, stored where it can be audited and rotated after each use.
EP-005	Defender Antivirus: real-time, cloud, PUA, sample submission, scheduled scan	High	Intune	Defender's defaults are good; a policy makes them stick and makes them auditable. Cloud protection is where the detection logic actually lives, so a device with it off is running last year's engine.
EP-006	Tamper protection on	High	MDE1, MDE2, MDEBusiness	Malware that lands with admin rights first turns off the antivirus. Tamper protection takes that option away from everything except Intune and the Defender portal.
EP-007	Network protection in block mode	Medium	MDE1, MDE2, MDEBusiness	Network protection blocks outbound connections to known malicious hosts from any process, not only the browser. In audit mode it reports and lets the traffic through.
EP-008	Attack surface reduction rules: every rule blocking, none off	High	MDE1, MDE2, MDEBusiness	ASR rules stop the techniques phishing payloads use: Office spawning processes, scripts launching downloaded executables, credential theft from LSASS. Audit mode generates events and stops nothing. The effective state per device is a later collector; this is the policy.
EP-009	No ASR-only exclusions, or each documented	Medium	MDE1, MDE2, MDEBusiness	An exclusion turns the rules off for a path. Attackers know the common ones.
EP-010	SmartScreen on in the shell, override blocked	Medium	Intune	SmartScreen checks downloaded files and installers against reputation before they run. The override setting is what stops a user from clicking Run anyway.
EP-011	Office macros from the internet blocked	High	Intune	Microsoft blocks internet macros by default since 2022, but a user or an old GPO can turn that back on. A policy makes it enforced.
EP-012	Windows Hello for Business enabled	Medium	Intune	Hello for Business replaces the password at the device with a key bound to the TPM. It is the phishing-resistant method most users can have today.
EP-013	Cloud Kerberos trust configured for hybrid sign-in	Medium	Intune	Without cloud Kerberos trust, hybrid-joined devices need certificates or key trust to reach on-premises resources after a Hello sign-in, which is where most hybrid Hello deployments stall.
EP-014	Update rings with a quality update deadline, feature update profile assigned	Medium	Intune	A ring without a deadline is a suggestion. The deadline is what gets the patch installed on the laptop that never reboots.
EP-015	macOS FileVault policy with recovery key escrow	High	Intune	Same reasoning as BitLocker: the policy makes encryption universal and the escrow makes recovery possible. Rotation after a reveal is an effective-state check for later.
EP-016	macOS hardening: Gatekeeper, firewall, SIP required	Medium	Intune	Gatekeeper and SIP are on by default and can be turned off by any admin user, which on most Macs is the user. The compliance policy is what notices.
EP-017	Platform SSO deployed on macOS	Low	Intune	Platform SSO gives the Mac a device-bound credential the way Hello does on Windows, and makes the local account follow the Entra password. The mode in use is not recorded yet.
EP-018	Mobile: app protection assigned, jailbroken and rooted devices blocked	High	Intune	App protection is what keeps company data inside managed apps on a phone the company does not own. Jailbreak detection is the compliance signal Conditional Access needs for the corporate ones. The check applies whenever a mobile platform is in scope, whatever the stated BYOD stance: phones reach mail either way.
EP-019	Defender for Endpoint onboarded on the Intune fleet	High	MDE1, MDE2, MDEBusiness	Policy state said every device gets the EDR policy; this is the share that actually reports to Defender. The gap between the two is the finding the spec asks for. Joined on the Entra device id.
EP-020	Defender sensors healthy: none inactive or impaired over 7 days	High	MDE1, MDE2, MDEBusiness	An onboarded device whose sensor is silent is unprotected and still counts as covered in every dashboard. Seven days is Microsoft's own inactive threshold.
EP-021	Defender Antivirus active on every device	High	MDE1, MDE2, MDEBusiness	Passive mode means another product is the antivirus and Defender only observes. Disabled means nothing is. Both are invisible in policy state, which says the antivirus settings are configured.
EP-022	Attack surface reduction rules effective on the fleet	High	MDE2	The policy check says the rules are set to block; the secure configuration assessment says which devices are actually enforcing each rule. Both views are in the report.
EP-023	Tamper protection and real-time protection effective on the fleet	High	MDE2	Effective state for the controls that matter most: tamper protection, real-time protection, cloud-delivered protection, network protection, as the devices report them rather than as the policy says.
EP-024	No critical vulnerabilities open beyond 30 days	High	MDE2	Critical means a working exploit path. Thirty days after publication is past any reasonable patch cycle. Defender Vulnerability Management counts them per device; the summary counts distinct CVEs and devices.
EP-025	No Defender incidents open beyond 7 days without an owner	Medium	E5, MDE2	An unassigned incident older than a week is one nobody is working. It says more about the operation than any single detection.

Email security (21)

ID	Check	Severity	Licence	What it means
EM-001	EOP preset security policy assigned to everyone	High	none	Preset policies carry Microsoft's recommended anti-spam, anti-malware and anti-phishing settings and update as the recommendations change. A tenant on hand-tuned custom policies drifts; one on the preset with no scope restrictions is protected by default.
EM-002	Defender for Office 365 preset policy assigned to everyone	High	MDO1, MDO2	The MDO half of the preset is a separate rule. Tenants often enable the EOP preset and never the MDO one, which leaves Safe Links and Safe Attachments on custom policies or off.
EM-003	Anti-phishing: spoof intelligence on and DMARC honoured	High	none	Spoof intelligence catches senders using your domains or trusted partners' domains without authorisation. Honouring DMARC applies the sender's own published policy instead of the tenant's spam verdict.
EM-004	Impersonation protection for executives and owned domains	Medium	MDO1, MDO2	Business email compromise starts with a lookalike display name or domain. Impersonation protection needs the names it should protect; a policy with an empty list protects nobody.
EM-005	Safe Links and Safe Attachments on for mail, Teams and Office	High	MDO1, MDO2	URL rewriting and detonation at click time, plus attachment detonation, are the controls that stop the payload after the lure got through. Each needs its own policy switch.
EM-006	Zero-hour auto purge for spam, phish and malware	Medium	none	ZAP retroactively moves messages already delivered once the verdict changes. Off, a message that was clean at delivery and malicious an hour later stays in the inbox.
EM-007	Quarantine: admin-only release for high-confidence phish, user notifications on	Medium	none	A user who can release high-confidence phish to themselves defeats the filter. Notifications let users request release of legitimate mail without an admin.
EM-008	Automatic external forwarding blocked	High	none	Attackers who get a mailbox set a forward and read quietly for months. Blocking it at the tenant level stops both inbox rules and mailbox forwarding from leaving the tenant.
EM-009	Connection filter IP allow list empty	Medium	none	An IP on the allow list skips spam filtering entirely. Legacy entries for a long-gone gateway or a shared cloud range are an open door.
EM-010	No unscoped SCL -1 transport rules	Medium	none	A rule that sets SCL -1 on all mail from a domain or a scope turns filtering off for anything that claims to come from it. Spoofed senders pass straight through.
EM-011	Enhanced Filtering on every partner inbound connector	Medium	none	With a gateway in front, every message arrives from the gateway's IP, SPF fails and spoof intelligence is blind. Enhanced Filtering restores the original connecting IP.
EM-012	DKIM signing enabled on every custom domain	High	none	DKIM proves the message body was sent by the domain owner's infrastructure and survives forwarding, which SPF does not. DMARC alignment on outbound mail depends on it.
EM-013	DMARC at the target policy with reporting	High	none	DMARC tells receivers what to do with mail that fails SPF and DKIM alignment. p=none is monitoring only; without rua nobody sees the reports.
EM-014	SPF valid, under the lookup limit, hard fail	High	none	SPF names the servers allowed to send for the domain. ~all asks receivers to be lenient; more than ten lookups makes the record permanently fail evaluation. The lookup count here is the top-level record only.
EM-015	MTA-STS and TLS-RPT published	Low	none	MTA-STS makes senders refuse to deliver to the domain without a valid TLS connection, closing the downgrade. TLS-RPT is how failures get reported.
EM-016	No mailboxes forwarding externally	High	none	Mailbox-level forwarding is the second place an attacker persists after inbox rules. Forwarding to a recipient object is listed for verification because the target can be an external contact.
EM-017	Legacy protocols off: SMTP AUTH org-wide, POP and IMAP per mailbox	Medium	none	Basic authentication for these protocols is retired, but the protocols themselves still work with modern auth and bypass the clients Conditional Access expects. SMTP AUTH is the one that still accepts a password.
EM-018	Shared mailboxes blocked from sign-in	Medium	none	The account behind a shared mailbox is created enabled with a random password. Enabled, it is a licence-free, usually MFA-free account anyone who resets the password can use.
EM-019	Mailbox auditing on and the unified audit log enabled	High	none	Without the audit log there is no investigation: who read, moved or forwarded what. Mailbox auditing is on by default only while the organisation switch stays off.
EM-020	Attack simulation campaign in the last 90 days	Low	MDO2	Users are the last filter. A tenant with the licence and no campaigns has the tooling and not the practice.
EM-021	ARC trusted sealers configured for the gateway	Medium	none	A gateway that modifies mail breaks DKIM and SPF for the next hop. ARC lets the gateway vouch for the original results; the tenant has to trust the sealer for that to count.

Data protection (8)

ID	Check	Severity	Licence	What it means
PV-001	Unified audit log on, with a retention policy where the licence allows one	High	none	The default retention is 180 days. An investigation that starts later than that has nothing to read. The licence decides what can be kept longer; the policy is what keeps it.
PV-002	Sensitivity labels defined and published to all users	High	E3, E5, BusinessPremium, Purview	Labels are what every other data control hangs off: DLP, auto-labeling, Copilot grounding, container access. Defined but published to a pilot group is the common half-done state.
PV-003	Auto-labeling policy in enforcement	Medium	E5, Purview	Users label a fraction of what they create. Auto-labeling is how the taxonomy reaches the files already there. A policy left in simulation protects nothing.
PV-004	Container labels enabled and applied to sites	Medium	E3, E5, BusinessPremium, Purview	A container label sets the site's privacy, external sharing and Conditional Access in one move, and it is what the Copilot oversharing controls key off. Enabled with no sites labeled is the finding.
PV-005	DLP enforced on every workload	High	E3, E5, BusinessPremium, Purview	DLP in test mode reports and lets the message through. Each workload is a separate location in the policy; a tenant usually has Exchange covered and the rest not.
PV-006	Retention policies enabled across Exchange and SharePoint	Medium	E3, E5, BusinessPremium, Purview	Retention is a decision either way: keep for the schedule, delete after it. No policy means the default of forever for some workloads and the deleted-items window for others.
PV-007	Insider Risk Management policy enabled	Low	E5, Purview	The licence is present; the policy is what turns the signals into cases. Departing-user data theft is the one every organisation has.
PV-008	Purview compliance administrators within the limit	Medium	none	Purview has its own role groups outside Entra PIM. Standing compliance administrators can read eDiscovery results and change DLP, so the list belongs reviewed like the Global Administrators.

Collaboration and oversharing (14)

ID	Check	Severity	Licence	What it means
CL-001	Tenant external sharing level below Anyone	High	none	Anyone links need no sign-in, so the link is the credential: forwarded, pasted into a chat, indexed from a document, it keeps working. Guest sharing keeps an identity on every access.
CL-002	Anonymous links disabled or expiring within the threshold	High	none	An Anyone link without an expiry lives until someone finds and removes it. Expiry puts a bound on the exposure of every link ever created.
CL-003	Default sharing link is Specific people with View	Medium	none	The default is what most people pick. Specific people with View makes the common case the safe case; Edit for everyone in the organisation makes every share an overshare.
CL-004	Sharing domain restrictions in place	Medium	none	The profile says external collaboration is locked or governed. Without a domain list, governed means a guest from any domain, including personal mailboxes.
CL-005	Everyone, Everyone except external users and All Users hidden from the people picker	Medium	none	A site shared with Everyone except external users is shared with every account in the tenant, and with Copilot. Hiding the claim stops new ones; the existing grants are the oversharing report the licensed tier adds.
CL-006	Guest access expires within the threshold	Medium	none	Guests outlive projects. Expiration is the only automatic removal SharePoint and OneDrive offer without an access review licence.
CL-007	No ownerless sites or Microsoft 365 groups	Medium	none	Nobody can approve access, review sharing or delete an ownerless site. They accumulate when the owner leaves and the offboarding does not reassign them.
CL-008	Restricted access control enabled	Low	SAM	Restricted access control binds a site to a security group regardless of how the content was shared. It is the fix for oversharing that cannot be unwound link by link.
CL-009	Microsoft 365 group expiration policy enabled	Low	P1	Teams and sites created for a quarter stay forever without it. Expiration with automatic renewal on activity removes only the ones nobody uses.
CL-010	Teams federation limited to an allow list, or off	Medium	none	Open federation lets any Teams tenant start a chat with your users, which is the delivery path for Teams phishing. An allow list keeps the partners and drops the rest.
CL-011	Teams consumer and Skype accounts blocked	Medium	none	Personal accounts have no tenant behind them to hold accountable. Blocking them removes the cheapest impersonation path.
CL-012	Teams guest access governed or disabled	Medium	none	Guests in Teams reach the files behind every channel they are in. Governed means they leave on a schedule unless someone renews them.
CL-013	Meeting lobby for external and anonymous participants	Medium	none	Everyone bypassing the lobby means a leaked meeting link is an open door. Anonymous join itself is often needed; the lobby is what makes it safe.
CL-014	Third-party Teams apps restricted to an allow list	Low	none	A Teams app is an OAuth grant plus a surface inside every chat. Allowing all third-party apps lets any user consent to any of them. (verify) app centric management replaces this policy on newer tenants.

Copilot readiness (18)

ID	Check	Severity	Licence	What it means
CP-001	Audit log on, Copilot interactions retained	High	none	Without the audit log there is no record of what Copilot read or who asked. It is the first hard gate because every later question about Copilot exposure needs it.
CP-002	SharePoint Advanced Management available	High	none	The oversharing baseline, restricted access control and restricted content discovery all sit behind this licence. Without it the stopgaps are not available.
CP-003	Oversharing baseline run within 90 days	High	SAM	The baseline is the list of sites Copilot would surface too widely. Everything after this gate works that list.
CP-004	Default sharing link is Specific people	High	none	Organisation-wide links are what Copilot grounds on: a file shared to everyone in the organisation by default is a file Copilot will quote to anyone who asks.
CP-005	Anonymous links disabled or expiring	Medium	none	Anyone links are outside every identity control; Copilot does not surface them, but the same oversharing habit that creates them creates the internal exposure.
CP-006	Sensitivity labels published with an encrypting top tier and container labels	High	E3, E5, BusinessPremium, Purview	Copilot honours labels: an encrypted file it cannot read, it cannot quote. Labels are the end state the stopgaps buy time for.
CP-007	Restricted access control on every top-tier site	Medium	SAM	Restricted access control binds a site to a group regardless of how its content was shared. On the top tier it stops Copilot surfacing the site to anyone outside that group while owners clean up.
CP-008	Restricted content discovery on sites pending review	Medium	SAM	Restricted content discovery hides a site from Copilot and organisation-wide search without changing permissions. (verify) PnP exposes the site flag.
CP-009	Restricted SharePoint Search off, or on with an allow list	Low	none	Restricted search is the bluntest stopgap: Copilot and search see only the allow list. On with an empty list means nobody finds anything.
CP-010	Site access reviews initiated from the baseline	Medium	SAM	The review is where the site owner decides who should still have access. Completion percentage is the progress measure for the readiness page.
CP-011	Recurring Entra access reviews on privileged roles and guests	Medium	P2	Copilot widens what a stale permission reaches. Recurring reviews are how permissions stay current after the clean-up.
CP-012	Access packages for standard access	Low	P2	Ad hoc sharing is the source of the oversharing baseline; packages replace it with requested, approved, time-bound access.
CP-013	DLP policy for the Copilot location	Medium	E5, Purview	The Copilot DLP location stops Copilot summarising or quoting files that carry the excluded labels. (verify) how the policy exposes that location in PowerShell.
CP-014	DSPM for AI reviewed	Low	E5, Copilot	DSPM for AI is Microsoft's own view of Copilot exposure. There is no read API; the review is recorded as portal evidence.
CP-015	Copilot settings governed	Low	Copilot	Web grounding, agents and connectors each widen what Copilot can reach. The decisions belong recorded; the API to read them is not there yet (verify).
CP-016	Label inheritance verified by test	Low	E3, E5, BusinessPremium, Purview	The test proves the taxonomy survives Copilot: output labeled as restrictively as the most restrictive source.
CP-017	Copilot not deployed ahead of the oversharing baseline	Low	Copilot	A tenant that licensed Copilot before baselining its sharing is exposed today; the row says so and dates it.
CP-018	No ownerless sites	Medium	none	Site access reviews need a site owner to answer them. Ownerless sites are the ones the clean-up cannot reach.

Governance and lifecycle (11)

ID	Check	Severity	Licence	What it means
GV-001	Enabled members inactive beyond the threshold within the limit	Medium	P1	An enabled account nobody uses is an account nobody watches. The share of enabled members with no sign-in in the stale window is the backlog the leaver process left behind.
GV-002	Recurring access reviews on privileged roles	High	P2	Privileged roles accrete. A recurring review is the only control that removes an admin role nobody asked to keep. Entra P2 includes it; most tenants that have it have never run one.
GV-003	Recurring access reviews on guests	Medium	P2	Guests arrive for a project and stay. A recurring review puts the decision in front of the person who knows whether the project is still running.
GV-004	Access packages in use for guest and cross-team access	Low	P2	Entitlement management is the licensed way to make access requestable, approved and time-bound. A tenant with guests and no packages is granting access by hand.
GV-005	Joiner and leaver lifecycle workflows enabled	Medium	EntraSuite	The leaver workflow is what makes the deprovisioning SLA true without a ticket. It needs the Governance licence, which the tenant has.
GV-006	PIM for Groups on role-assignable groups	Medium	P2	A role-assignable group carries admin roles to everyone in it. Permanent membership in such a group is a permanent admin, however the role itself is configured.
GV-007	Password-based single sign-on within the limit	Low	none	The protocol mix across enterprise applications says how much of the estate Conditional Access really governs. Password SSO is a stored credential, not federation.
GV-008	No SAML signing certificates expiring within the warning window	High	none	An expired SAML certificate is an outage for every user of that application, usually discovered on a Monday morning. The expiry calendar in the report lists these with the other expiring secrets.
GV-009	Administrative units at scale	Low	P1	Above a thousand users, a tenant-wide helpdesk administrator can reset the password of anyone in the company. Administrative units scope that to the people the helpdesk actually supports.
GV-010	Every enterprise application has an owner	Medium	none	An ownerless application is one nobody renews, reviews or removes. The owner is who the expiry notice goes to.
GV-011	HR-driven provisioning connector present	Low	P1	When HR is the source of truth, a leaver is disabled the day HR says so. The check looks for a known HR connector by name and cannot see a custom integration; an exception documents one. (verify) connector names.

Operations and monitoring (7)

ID	Check	Severity	Licence	What it means
OP-001	SIEM in place with Microsoft 365, Entra, Intune and Defender sources	High	none	Without a SIEM the logs live in each portal for their default retention and nobody correlates them. The answer comes from the profile; the Azure collector will later confirm the diagnostic settings behind it.
OP-002	Microsoft 365 backup decision recorded	Medium	none	Microsoft keeps the service running; it does not restore what a user or an attacker deleted beyond the retention windows. The decision is the control, whichever way it goes.
OP-003	Break-glass accounts tested within the window	Medium	none	A break-glass account that has not been tested is a password in a safe that may no longer open the door. Twice a year is the common bar.
OP-004	Message Center triage owner named	Low	none	Microsoft retires features and changes defaults on a schedule published in the Message Center. An unread Message Center is how a tenant learns about a change from its users.
OP-005	Secure Score at or above Microsoft's all-tenant average	Low	none	Secure Score is Microsoft's view and it moves when Microsoft changes the weights. It is reported here beside the posture score, with the differences explained, and never as the grade.
OP-006	Nothing on the expiry calendar within the warning window	High	none	One calendar for every expiry that takes a service down: application secrets, SAML signing certificates, the Apple push certificate, VPP tokens. Entra Connect and domain renewals join it when their collectors exist.
OP-007	Entra Connect Health enabled with alerts routed	Medium	P1	Sync stops quietly. Connect Health is the alert that says passwords stopped flowing before the helpdesk queue does. Read through Azure once the Azure collector exists.

Azure (22)

ID	Check	Severity	Licence	What it means
AZ-001	Management group hierarchy, no subscription at the tenant root	Low	none	A subscription at the tenant root inherits nothing: no benchmark, no policy, no standing-access rules. Management groups are where those are set once.
AZ-002	Microsoft cloud security benchmark assigned on every subscription	High	none	The benchmark is the policy set behind Azure Secure Score and every Defender for Cloud recommendation. A subscription without it is unevaluated, not clean.
AZ-003	Defender for Cloud plans on where the resource types exist	High	none	The plans are the paid detections: runtime threat detection on VMs, malware scanning on storage, anomalous Key Vault access. Off on a subscription that holds the resource is the finding; off elsewhere is fine and noted.
AZ-004	Defender CSPM enabled	Low	none	Defender CSPM adds attack path analysis and the identity findings Entra Permissions Management used to carry. Without it those rows are not evaluated.
AZ-005	Security contact with alert notifications on every subscription	Medium	none	Defender for Cloud alerts that nobody is emailed about sit in the portal. The contact is who finds out.
AZ-006	Activity log exported from every subscription	High	none	The activity log holds every control-plane change and is kept 90 days on its own. The export is what makes an investigation older than that possible.
AZ-007	Delete locks on Key Vaults and Recovery Services vaults	Medium	none	A Key Vault or backup vault deleted by mistake, or by an attacker with Contributor, is the outage and the ransomware scenario in one. The lock is cheap.
AZ-008	Policy coverage beyond the benchmark on every subscription	Low	none	The benchmark audits. The organisation's own deny policies are what stop a misconfiguration from being created at all.
AZ-009	Owner and environment tags on the fleet	Low	none	A resource with no owner tag is a resource nobody will answer for when the finding lands. Tags are the join key between the posture report and the people.
AZ-010	No orphaned resources	Low	none	Orphans cost money and carry data: an unattached disk still holds the VM's contents. The counts are the clean-up list.
AZ-011	Owners per subscription within the limit, none synced from AD	High	none	Owner on a subscription is full control including the right to grant it. Owners inherited from the root or a management group count too; synced accounts tie the subscription's fate to on-premises AD.
AZ-012	No standing Owner or User Access Administrator at root or management group	High	P2	A permanent Owner at the root scope owns every subscription that exists and every one created later. Eligible is the only acceptable state for that role.
AZ-013	No guest users with Azure role assignments	Medium	none	A guest with an Azure role is a partner's account, governed by the partner's MFA and lifecycle, with rights in your subscription.
AZ-014	Service principals with Owner or Contributor justified	Medium	none	A service principal with Contributor is a credential that can rebuild the subscription. Pipelines need it; the question is which ones and at what scope.
AZ-015	No orphaned role assignments	Medium	none	An assignment to a deleted principal is noise now and a grant to whoever recreates the object id later. They accumulate with every leaver.
AZ-016	No custom roles with wildcard actions	Medium	none	Wildcard actions in a custom role defeat the point of the custom role and hide an Owner-equivalent grant from every review that looks for Owner.
AZ-017	No classic administrators	Medium	none	Classic administrators sit outside RBAC and PIM. Microsoft retired the type; a tenant that still has them has access nobody reviews.
AZ-018	Role assignments to individual users at resource scope within the limit	Low	none	Hundreds of per-user grants on individual resources are unreviewable. Groups at resource group scope are the maintainable shape.
AZ-019	Key Vaults on the RBAC model with purge protection, soft delete and no public access	High	none	Key Vault holds the secrets everything else depends on. Access policies are the legacy model nobody reviews; purge protection is what stops an attacker deleting the keys for good.
AZ-020	Storage accounts without shared keys, anonymous blobs or HTTP	High	none	A storage account key is a password to every byte in the account, and anonymous blob access is the classic public-bucket leak. Both are off by one switch each.
AZ-021	Azure SQL servers on Entra-only authentication	Medium	none	SQL authentication is a password in a connection string. Entra-only removes it as a path, the same move as disabling shared keys on storage.
AZ-022	Conditional Access covers the Azure management plane	High	P1	The portal, CLI and ARM API are all the management plane. A policy on all cloud apps covers it; a tenant with app-specific policies often leaves it out.

Hybrid identity and on-premises AD (25)

ID	Check	Severity	Licence	What it means
HY-001	Password hash sync on	High	none	Without the hashes in Entra, leaked credential detection has nothing to compare and a federation outage is a sign-in outage.
HY-002	Hard and soft match takeover protection on	High	none	An on-premises account that matches a cloud admin by UPN or source anchor takes it over on the next sync. The two switches close that path.
HY-003	No federated domains, or a dated migration plan	Medium	none	ADFS is a Tier 0 server farm whose only purpose Entra now performs natively. Every federated domain keeps it alive.
HY-004	Entra Connect Health with no open alerts	Medium	P1	Sync errors, an aging sync server and a stale export show up in Connect Health first, long before users notice.
HY-010	Domain Admins within the limit	High	none	Every Domain Admin is a path to every system. Service accounts and daily-use accounts in the group are the usual excess.
HY-011	Enterprise Admins and Schema Admins empty	High	none	Neither group has a day-to-day purpose. Standing members are standing forest-wide control.
HY-012	Operator groups empty or justified	Medium	none	These groups grant quiet paths to domain control: a Backup Operator can read the AD database, a DnsAdmin can load a DLL on a DC.
HY-013	Admin accounts hardened: Protected Users, no delegation, no SPN, no mailbox, fresh password	High	none	adminCount=1 marks the accounts AdminSDHolder protects. Each listed issue is a way an attacker turns one of them into domain control.
HY-014	krbtgt password rotated within the window	High	none	A krbtgt password from years ago means any golden ticket ever forged still works.
HY-015	Built-in Administrator and Guest controlled	Medium	none	RID 500 cannot be locked out and is the first account any attacker tries.
HY-016	Machine account quota zero	Medium	none	The default lets any user create ten computer accounts, the first step of several Kerberos relay and delegation attacks.
HY-017	No unconstrained delegation outside domain controllers	High	none	A server trusted for unconstrained delegation holds the tickets of everyone who connects to it, including Domain Admins.
HY-018	No Kerberoastable user accounts	High	none	Any domain user can request a ticket for an SPN and crack the password offline. A user account with an SPN and an old password is already lost.
HY-019	No AS-REP roastable accounts	Medium	none	Without pre-authentication an attacker gets crackable material for the account without a password.
HY-020	Windows LAPS on member computers	High	none	Without LAPS the local administrator password is shared across the fleet and one workstation compromise is every workstation.
HY-021	Forest and domain functional level 2016 or higher	Medium	none	Older levels keep older Kerberos and replication behaviours alive, and block Protected Users and the Recycle Bin features.
HY-022	Domain controllers on supported Windows Server, two or more	High	none	An unsupported domain controller is an unpatched Tier 0 server. One domain controller is a single point of failure for every sign-in.
HY-023	AD Recycle Bin enabled	Low	none	Deleted objects come back with their attributes and group membership instead of from backup.
HY-024	No stale enabled users beyond the window	Medium	none	Stale enabled accounts are the leavers the process missed; each one is a valid credential nobody watches.
HY-025	Password policy: 14 characters, lockout on, no reversible encryption	High	none	The default domain policy is what every account without a fine-grained policy inherits.
HY-026	No human accounts with password never expires	Medium	none	Password never expires on a human account is a password that will never be rotated after it leaks.
HY-027	SID filtering on every external trust	High	none	A trust without SID filtering lets the other forest inject your privileged SIDs into its tokens.
HY-028	Seamless SSO key rotated within the window	Medium	none	The seamless SSO computer account's key signs Kerberos tickets for Entra; an old key is a long-lived forgery path.
HY-029	No AD CS templates open to ESC1	High	none	A published template that lets the requester name the subject and issues client authentication certificates lets any enrollee become any user, including a Domain Admin.
HY-030	No credentials in Group Policy	High	none	The cpassword encryption key has been public since 2012; any domain user can read SYSVOL.

204 checks. Generated by build.ps1 -Task Catalog from checks/; never edited by hand.