Security checks
Mito’s assessment engine is based on open-source community checks and published baselines (CIS, CISA SCuBA and Microsoft guidance). This reference lists all 747 checks it ships: 477 for Microsoft 365 and related cloud services and 270 for on-premises Active Directory, which Mito does not run.
Each check has its own page at /tests/<check-id>/, which is where the Learn more link in your Mito report goes. Use search (top of the page) to find a check by ID or keyword.
By suite
Section titled “By suite”| Suite | Checks | About |
|---|---|---|
| Mito | 238 | Checks based on open-source community checks and Microsoft guidance, across Entra ID, Exchange Online, Defender, Intune, Purview, Teams and more. |
| CIS Microsoft 365 Foundations Benchmark | 49 | Checks that implement recommendations of the CIS Microsoft 365 Foundations Benchmark (and a few of the CIS GitHub Benchmark). |
| CISA SCuBA baselines | 79 | Checks that implement the US Cybersecurity and Infrastructure Security Agency (CISA) Secure Cloud Business Applications (SCuBA) baselines for Microsoft 365. |
| EIDSCA | 44 | Entra ID Security Config Analyzer: checks of Entra ID tenant settings against recommended values. |
| ORCA | 67 | Office 365 Recommended Configuration Analyzer: checks of Exchange Online Protection and Defender for Office 365 settings. |
| Active Directory (on-premises) | 270 | Checks of an on-premises Active Directory forest. Mito assesses Microsoft 365 in the cloud and does not run these; they are listed for reference only. |
By product
Section titled “By product”| Product | Checks | Run by Mito |
|---|---|---|
| Entra ID | 179 | 178 |
| Exchange Online | 50 | 50 |
| Defender | 116 | 116 |
| Intune | 25 | 24 |
| Purview | 6 | 6 |
| SharePoint | 14 | 0 |
| Teams | 12 | 12 |
| Microsoft 365 | 11 | 11 |
| Azure | 3 | 0 |
| Azure DevOps | 46 | 0 |
| GitHub | 5 | 0 |
| Active Directory | 270 | 0 |
| Copilot Studio | 10 | 10 |
“Run by Mito” counts the checks whose data Mito’s assessment can read: Microsoft Graph, Exchange Online, Security & Compliance and Teams. The others need a connection Mito does not set up (for example Azure DevOps, GitHub or on-premises Active Directory) and are reported as skipped.
Severity
Section titled “Severity”| Severity | Meaning |
|---|---|
| Critical | An attacker could use this now to take over accounts or data. Fix first. |
| High | A significant gap in a core protection. |
| Medium | A weakness that matters in combination with others. |
| Low | Hardening that reduces risk further. |
| Info | Information about your configuration; not a failure on its own. |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.