All checks
All 477 Microsoft 365 and cloud checks. The 270 on-premises Active Directory checks are on their own page.
Checks Mito runs
Section titled “Checks Mito runs”| ID | Title | Severity | Product | Suite |
|---|---|---|---|---|
| CIS.M365.1.1.1 | Ensure Administrative accounts are cloud-only | High | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.1.3 | Ensure that between two and four global admins are designated | High | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.2.1 | Ensure that only organizationally managed/approved public groups exist | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.2.2 | Ensure sign-in to shared mailboxes is blocked | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.1 | Ensure the ‘Password expiration policy’ is set to ‘Set passwords to never expire (recommended)’ | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.3 | Ensure ‘External sharing’ of calendars is not available | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.4 | Ensure ‘User owned apps and services’ is restricted | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.5 | Ensure internal phishing protection for Forms is enabled | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.6 | Ensure the customer lockbox feature is enabled | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.7 | Ensure ‘third-party storage services’ are restricted in ‘Microsoft 365 on the web’ | Medium | Microsoft 365 | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.1 | Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.2 | Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.3 | Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.4 | Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | High | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.6 | Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.7 | Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.9 | Ensure that DKIM is enabled for all Exchange Online Domains | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.11 | Ensure comprehensive attachment filtering is applied | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.12 | Ensure the connection filter IP allow list is not used (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.13 | Ensure the connection filter safe list is off (Only Checks Default Policy) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.4.4 | Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled) | Medium | Defender | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.3.1.1 | Ensure Microsoft 365 audit log search is Enabled | High | Purview | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.4.1 | Ensure devices without a compliance policy are marked ‘not compliant’ | Medium | Intune | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.2.2 | Ensure users cannot register applications | Medium | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.2.3 | Ensure ‘Restrict non-admin users from creating tenants’ is set to ‘Yes’ | Medium | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.4.6 | Ensure users are restricted from recovering BitLocker keys | Medium | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowed | High | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.5.2 | Ensure the admin consent workflow is enabled | High | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.6.2 | Ensure that guest user access is restricted | Medium | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.2.3.5 | Ensure weak authentication methods are disabled | High | Entra ID | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.6.5.3 | Ensure additional storage providers are restricted in Outlook on the web | Medium | Exchange Online | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.1.1 | Ensure external file sharing in Teams is enabled for only approved cloud storage services | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.2.2 | Ensure communication with unmanaged Teams users is disabled | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.2.3 | Ensure external Teams users cannot initiate conversations | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.4.1 | Ensure app permission policies are configured | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.5.3 | Ensure only people in my org can bypass the lobby | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.8.6.1 | Ensure users can report security concerns in Teams | Medium | Teams | CIS Microsoft 365 Foundations Benchmark |
| CISA.MS.AAD.1.1 | Legacy authentication SHALL be blocked. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.2.1 | Users detected as high risk SHALL be blocked. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.2.2 | A notification SHOULD be sent to the administrator when high-risk users are detected. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.2.3 | Sign-ins detected as high risk SHALL be blocked. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.1 | Phishing-resistant MFA SHALL be enforced for all users. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.2 | If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.3 | If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.4 | The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.5 | The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.6 | Phishing-resistant MFA SHALL be required for highly privileged roles. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.7 | Managed devices SHOULD be required for authentication. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.3.8 | Managed Devices SHOULD be required to register MFA. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.5.1 | Only administrators SHALL be allowed to register applications. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.5.2 | Only administrators SHALL be allowed to consent to applications. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.5.3 | An admin consent workflow SHALL be configured for applications. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.5.4 | Group owners SHALL NOT be allowed to consent to applications. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.6.1 | User passwords SHALL NOT expire. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.1 | A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.2 | Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.3 | Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.4 | Permanent active role assignments SHALL NOT be allowed for highly privileged roles. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.5 | Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.6 | Activation of the Global Administrator role SHALL require approval. | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.7 | Eligible and Active highly privileged role assignments SHALL trigger an alert. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.8 | User activation of the Global Administrator role SHALL trigger an alert. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.7.9 | User activation of other highly privileged roles SHOULD trigger an alert. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.8.1 | Guest users SHOULD have limited or restricted access to Entra ID directory objects. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.8.2 | Only users with the Guest Inviter role SHOULD be able to invite guest users. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.AAD.8.3 | Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. | Medium | Entra ID | CISA SCuBA baselines |
| CISA.MS.EXO.1.1 | Automatic forwarding to external domains SHALL be disabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.2.1 | A list of approved IP addresses for sending mail SHALL be maintained. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.2.2 | An SPF policy SHALL be published for each domain, designating only these addresses as approved senders. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.3.1 | DKIM SHOULD be enabled for all domains. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.4.1 | A DMARC policy SHALL be published for every second-level domain. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.4.2 | The DMARC message rejection option SHALL be p=reject. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.4.3 | The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.5.1 | SMTP AUTH SHALL be disabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.6.1 | Contact folders SHALL NOT be shared with all domains. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.6.2 | Calendar details SHALL NOT be shared with all domains. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.7.1 | External sender warnings SHALL be implemented. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.8.1 | A DLP solution SHALL be used. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.8.2 | The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.8.3 | The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.8.4 | At a minimum, the DLP solution SHALL restrict sharing credit card numbers, U.S. Individual Taxpayer Identification Numbers (ITIN), and U.S. Social Security numbers (SSN) via email. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.9.1 | Emails SHALL be filtered by attachment file types. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.9.2 | The attachment filter SHOULD attempt to determine the true file type and assess the file extension. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.9.3 | Disallowed file types SHALL be determined and enforced. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.9.4 | Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender’s Common Attachment Filter. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.9.5 | At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe). | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.10.1 | Emails SHALL be scanned for malware. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.10.2 | Emails identified as containing malware SHALL be quarantined or dropped. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.10.3 | Email scanning SHALL be capable of reviewing emails after delivery. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.11.1 | Impersonation protection checks SHOULD be used. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.11.2 | User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.11.3 | The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.12.1 | IP allow lists SHOULD NOT be created. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.12.2 | Safe lists SHOULD NOT be enabled. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.13.1 | Mailbox auditing SHALL be enabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.14.1 | A spam filter SHALL be enabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.14.2 | Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.14.3 | Allowed domains SHALL NOT be added to inbound anti-spam protection policies. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.14.4 | If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.15.1 | URL comparison with a block-list SHOULD be enabled. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.15.2 | Direct download links SHOULD be scanned for malware. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.15.3 | User click tracking SHOULD be enabled. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.16.1 | Alerts SHALL be enabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.16.2 | Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.17.1 | Microsoft Purview Audit (Standard) logging SHALL be enabled. | High | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.17.2 | Microsoft Purview Audit (Premium) logging SHALL be enabled. | Medium | Exchange Online | CISA SCuBA baselines |
| CISA.MS.EXO.17.3 | Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C). | Medium | Exchange Online | CISA SCuBA baselines |
| EIDSCA.AF01 | Authentication Method - FIDO2 security key - State. | High | Entra ID | EIDSCA |
| EIDSCA.AF02 | Authentication Method - FIDO2 security key - Allow self-service set up. | High | Entra ID | EIDSCA |
| EIDSCA.AF03 | Authentication Method - FIDO2 security key - Enforce attestation. | High | Entra ID | EIDSCA |
| EIDSCA.AF04 | Authentication Method - FIDO2 security key - Enforce key restrictions. | Medium | Entra ID | EIDSCA |
| EIDSCA.AF05 | Authentication Method - FIDO2 security key - Restricted. | Medium | Entra ID | EIDSCA |
| EIDSCA.AF06 | Authentication Method - FIDO2 security key - Restrict specific keys. | Medium | Entra ID | EIDSCA |
| EIDSCA.AG01 | Authentication Method - General Settings - Manage migration. | High | Entra ID | EIDSCA |
| EIDSCA.AG02 | Authentication Method - General Settings - Report suspicious activity - State. | Medium | Entra ID | EIDSCA |
| EIDSCA.AG03 | Authentication Method - General Settings - Report suspicious activity - Included users/groups. | Medium | Entra ID | EIDSCA |
| EIDSCA.AM01 | Authentication Method - Microsoft Authenticator - State. | High | Entra ID | EIDSCA |
| EIDSCA.AM02 | Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP. | Medium | Entra ID | EIDSCA |
| EIDSCA.AM03 | Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | High | Entra ID | EIDSCA |
| EIDSCA.AM04 | Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | High | Entra ID | EIDSCA |
| EIDSCA.AM06 | Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Medium | Entra ID | EIDSCA |
| EIDSCA.AM07 | Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. | Medium | Entra ID | EIDSCA |
| EIDSCA.AM09 | Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Medium | Entra ID | EIDSCA |
| EIDSCA.AM10 | Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP01 | Default Authorization Settings - Enabled Self service password reset for administrators. | High | Entra ID | EIDSCA |
| EIDSCA.AP04 | Default Authorization Settings - Guest invite restrictions. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP05 | Default Authorization Settings - Sign-up for email based subscription. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP06 | Default Authorization Settings - User can join the tenant by email validation. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP07 | Default Authorization Settings - Guest user access. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP08 | Default Authorization Settings - User consent policy assigned for applications. | High | Entra ID | EIDSCA |
| EIDSCA.AP09 | Default Authorization Settings - Allow user consent on risk-based apps. | High | Entra ID | EIDSCA |
| EIDSCA.AP10 | Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | Medium | Entra ID | EIDSCA |
| EIDSCA.AP14 | Default Authorization Settings - Default User Role Permissions - Allowed to read other users. | Low | Entra ID | EIDSCA |
| EIDSCA.AS04 | Authentication Method - SMS - Use for sign-in. | High | Entra ID | EIDSCA |
| EIDSCA.AT01 | Authentication Method - Temporary Access Pass - State. | Medium | Entra ID | EIDSCA |
| EIDSCA.AT02 | Authentication Method - Temporary Access Pass - One-time. | Medium | Entra ID | EIDSCA |
| EIDSCA.AV01 | Authentication Method - Voice call - State. | High | Entra ID | EIDSCA |
| EIDSCA.CP01 | Default Settings - Consent Policy Settings - Group owner consent for apps accessing data. | High | Entra ID | EIDSCA |
| EIDSCA.CP03 | Default Settings - Consent Policy Settings - Block user consent for risky apps. | High | Entra ID | EIDSCA |
| EIDSCA.CP04 | Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to. | High | Entra ID | EIDSCA |
| EIDSCA.CR01 | Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature. | High | Entra ID | EIDSCA |
| EIDSCA.CR02 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests. | Low | Entra ID | EIDSCA |
| EIDSCA.CR03 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire. | Low | Entra ID | EIDSCA |
| EIDSCA.CR04 | Consent Framework - Admin Consent Request - Consent request duration (days). | Low | Entra ID | EIDSCA |
| EIDSCA.PR01 | Default Settings - Password Rule Settings - Password Protection - Mode. | High | Entra ID | EIDSCA |
| EIDSCA.PR02 | Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | High | Entra ID | EIDSCA |
| EIDSCA.PR03 | Default Settings - Password Rule Settings - Enforce custom list. | Medium | Entra ID | EIDSCA |
| EIDSCA.PR05 | Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. | Medium | Entra ID | EIDSCA |
| EIDSCA.PR06 | Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold. | Medium | Entra ID | EIDSCA |
| EIDSCA.ST08 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Medium | Entra ID | EIDSCA |
| EIDSCA.ST09 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. | Low | Entra ID | EIDSCA |
| MT.1001 | At least one Conditional Access policy is configured with device compliance. | Medium | Entra ID | Mito |
| MT.1002 | App management restrictions on applications and service principals is configured and enabled. | Medium | Entra ID | Mito |
| MT.1003 | At least one Conditional Access policy is configured with All Apps. | High | Entra ID | Mito |
| MT.1004 | At least one Conditional Access policy is configured with All Apps and All Users. | High | Entra ID | Mito |
| MT.1005 | All Conditional Access policies are configured to exclude at least one emergency/break glass account or group. | High | Entra ID | Mito |
| MT.1006 | At least one Conditional Access policy is configured to require MFA for admins. | High | Entra ID | Mito |
| MT.1007 | At least one Conditional Access policy is configured to require MFA for all users. | High | Entra ID | Mito |
| MT.1008 | At least one Conditional Access policy is configured to require MFA for Azure management. | High | Entra ID | Mito |
| MT.1009 | At least one Conditional Access policy is configured to block other legacy authentication. | High | Entra ID | Mito |
| MT.1010 | At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. | High | Entra ID | Mito |
| MT.1011 | At least one Conditional Access policy is configured to secure security info registration only from a trusted location. | High | Entra ID | Mito |
| MT.1012 | At least one Conditional Access policy is configured to require MFA for risky sign-ins. | High | Entra ID | Mito |
| MT.1013 | At least one Conditional Access policy is configured to require new password when user risk is high. | High | Entra ID | Mito |
| MT.1014 | At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins. | High | Entra ID | Mito |
| MT.1015 | At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms. | Medium | Entra ID | Mito |
| MT.1016 | At least one Conditional Access policy is configured to require MFA for guest access. | High | Entra ID | Mito |
| MT.1017 | At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices. | Medium | Entra ID | Mito |
| MT.1018 | At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices. | Medium | Entra ID | Mito |
| MT.1019 | At least one Conditional Access policy is configured to enable application enforced restrictions. | Medium | Entra ID | Mito |
| MT.1020 | All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them. | Medium | Entra ID | Mito |
| MT.1021 | Security Defaults are enabled. | High | Entra ID | Mito |
| MT.1022 | All users utilizing a P1 license should be licensed. | Low | Entra ID | Mito |
| MT.1023 | All users utilizing a P2 license should be licensed. | Low | Entra ID | Mito |
| MT.1024 | Entra recommendations should be completed. | Medium | Entra ID | Mito |
| MT.1025 | No external user with permanent role assignment on Control Plane. | High | Entra ID | Mito |
| MT.1026 | No hybrid user with permanent role assignment on Control Plane. | High | Entra ID | Mito |
| MT.1027 | No Service Principal with Client Secret and permanent role assignment on Control Plane. | High | Entra ID | Mito |
| MT.1028 | No user with mailbox and permanent role assignment on Control Plane. | High | Entra ID | Mito |
| MT.1029 | Stale accounts are not assigned to privileged roles. | High | Entra ID | Mito |
| MT.1030 | Eligible role assignments on Control Plane are in use by administrators. | High | Entra ID | Mito |
| MT.1031 | Privileged role on Control Plane are managed by PIM only. | High | Entra ID | Mito |
| MT.1032 | Limited number of Global Admins are assigned. | High | Entra ID | Mito |
| MT.1033 | Users should be blocked from using legacy authentication. | High | Entra ID | Mito |
| MT.1034 | Emergency access users should not be blocked. | High | Entra ID | Mito |
| MT.1035 | All security groups assigned to Conditional Access Policies should be protected by RMAU. | High | Entra ID | Mito |
| MT.1036 | All excluded objects should have a fallback include in another policy. | Medium | Entra ID | Mito |
| MT.1037 | Only users with Presenter role are allowed to present in Teams meetings | Low | Teams | Mito |
| MT.1038 | Conditional Access policies should not include or exclude deleted groups. | Medium | Entra ID | Mito |
| MT.1039 | Ensure MailTips are enabled for end users | Low | Exchange Online | Mito |
| MT.1041 | Ensure users installing Outlook add-ins is not allowed | Medium | Exchange Online | Mito |
| MT.1042 | Restrict dial-in users from bypassing a meeting lobby | Medium | Teams | Mito |
| MT.1043 | Ensure Spam confidence level (SCL) is configured in mail transport rules with specific domains | Medium | Exchange Online | Mito |
| MT.1044 | Ensure modern authentication for Exchange Online is enabled | High | Exchange Online | Mito |
| MT.1045 | Only invited users should be automatically admitted to Teams meetings | Medium | Teams | Mito |
| MT.1046 | Restrict anonymous users from joining meetings | Medium | Teams | Mito |
| MT.1047 | Restrict anonymous users from starting Teams meetings | Medium | Teams | Mito |
| MT.1048 | Limit external participants from having control in a Teams meeting | Medium | Teams | Mito |
| MT.1049 | Conditional Access policies for User Risk and Sign-in Risk should be configured separately. | High | Entra ID | Mito |
| MT.1050 | Apps with high-risk permissions having a direct path to Global Administrator | High | Entra ID | Mito |
| MT.1051 | Apps with high-risk permissions having an indirect path to Global Administrator | High | Entra ID | Mito |
| MT.1052 | At least one Conditional Access policy is targeting the Device Code authentication flow. | High | Entra ID | Mito |
| MT.1053 | Ensure intune device clean-up rule is configured | Low | Intune | Mito |
| MT.1054 | Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as ‘Not compliant’ | Medium | Intune | Mito |
| MT.1055 | Microsoft 365 Group (and Team) creation should be restricted to approved users. | Medium | Entra ID | Mito |
| MT.1057 | App registrations should no longer use secrets. | Medium | Entra ID | Mito |
| MT.1058 | Exchange application access policies must be configured. | Medium | Entra ID | Mito |
| MT.1059 | Microsoft Defender for Identity health issues should be resolved | Medium | Defender | Mito |
| MT.1060 | Drift folders should match their baseline. | Medium | Microsoft 365 | Mito |
| MT.1061 | Device registration MFA control conflicts with Conditional Access policies. | Medium | Entra ID | Mito |
| MT.1062 | Ensure Direct Send is set to be rejected | Medium | Exchange Online | Mito |
| MT.1063 | All App registration owners should have MFA registered | High | Entra ID | Mito |
| MT.1066 | Conditional Access policies should not reference non-existent users, groups, or roles. | Medium | Entra ID | Mito |
| MT.1067 | Authentication method policies should not reference non-existent groups. | Low | Entra ID | Mito |
| MT.1068 | Restrict non-admin users from creating tenants. | Medium | Entra ID | Mito |
| MT.1069 | Restrict non-admin users from creating security groups. | Low | Entra ID | Mito |
| MT.1070 | Restrict device join to selected users/groups or none. | Medium | Entra ID | Mito |
| MT.1071 | At least one Conditional Access policy explicitly includes Azure DevOps. | Medium | Entra ID | Mito |
| MT.1072 | Conditional Access policies should not use the deprecated Approved Client App grant. | High | Entra ID | Mito |
| MT.1073 | Soft- and hard-matching of synchronized objects should be blocked. | Medium | Entra ID | Mito |
| MT.1074 | Ensure no more than 100 outbound mails per day are sent using the .onmicrosoft.com domain | Low | Exchange Online | Mito |
| MT.1075 | Require explicit assignment of Third Party Entra Apps. | Medium | Entra ID | Mito |
| MT.1076 | MOERA SHOULD NOT be used for sent mail | Low | Exchange Online | Mito |
| MT.1077 | App registrations with privileged API permissions should not have owners. | Medium | Defender | Mito |
| MT.1078 | App registrations with highly privileged directory roles should not have owners. | Medium | Defender | Mito |
| MT.1079 | Privileged API permissions on service principals should not remain unused. | Medium | Defender | Mito |
| MT.1080 | Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints. | Medium | Defender | Mito |
| MT.1081 | Hybrid users should not be assigned Entra ID role assignments. | Medium | Defender | Mito |
| MT.1083 | Ensure Delicensing Resiliency is enabled | Low | Exchange Online | Mito |
| MT.1084 | Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers. | High | Entra ID | Mito |
| MT.1085 | Pending approvals for Critical Asset Management should not be present. | Low | Defender | Mito |
| MT.1086 | Devices should not share both critical and non-critical user credentials. | Low | Defender | Mito |
| MT.1087 | Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE’s. | High | Defender | Mito |
| MT.1088 | Devices with critical credentials should be protected by TPM. | Medium | Defender | Mito |
| MT.1089 | Devices with critical credentials should be protected by Credential Guard. | Medium | Defender | Mito |
| MT.1090 | Global Administrator role should not be added as local administrator on the device during Microsoft Entra join | Medium | Entra ID | Mito |
| MT.1091 | Registering user should not be added as local administrator on the device during Microsoft Entra join | Medium | Entra ID | Mito |
| MT.1092 | Intune APNS certificate should be valid for more than 30 days | High | Intune | Mito |
| MT.1093 | Apple Automated Device Enrollment Tokens should be valid for more than 30 days | High | Intune | Mito |
| MT.1094 | Apple Volume Purchase Program Tokens should be valid for more than 30 days | High | Intune | Mito |
| MT.1095 | Android Enterprise account connection should be healthy | High | Intune | Mito |
| MT.1096 | Ensure at least one Intune Multi Admin Approval policy is configured | Medium | Intune | Mito |
| MT.1097 | Ensure all Intune Certificate Connectors are healthy and running supported versions | High | Intune | Mito |
| MT.1098 | Mobile Threat Defense Connectors should be healthy | High | Intune | Mito |
| MT.1099 | Windows Diagnostic Data Processing should be enabled | Low | Intune | Mito |
| MT.1101 | Default Branding Profile should be customized | Low | Intune | Mito |
| MT.1102 | Windows Feature Update Policy Settings should not reference end of support builds | High | Intune | Mito |
| MT.1103 | Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groups | High | Intune | Mito |
| MT.1105 | Ensure MDM Authority is set to Intune | Low | Intune | Mito |
| MT.1106 | Catalog resources must have valid roles (no stale / removed app roles or SPNs). | Low | Entra ID | Mito |
| MT.1107 | Access packages and catalogs should not reference deleted groups. | Low | Entra ID | Mito |
| MT.1108 | Access packages should not reference inactive or orphaned assignment policies. | Low | Entra ID | Mito |
| MT.1109 | Access package approval workflows must have valid approvers. | Low | Entra ID | Mito |
| MT.1110 | No catalog should contain resources without any associated access packages. | Low | Entra ID | Mito |
| MT.1111 | High privileged user should be linked to an identity. | Low | Defender | Mito |
| MT.1112 | Privileged user accounts should not remain enabled when the linked primary account is disabled. | Medium | Defender | Mito |
| MT.1113 | AI agents should not be shared with broad access control policies. | High | Copilot Studio | Mito |
| MT.1114 | AI agents should require user authentication. | High | Copilot Studio | Mito |
| MT.1115 | AI agents should not have risky HTTP configurations. | Medium | Copilot Studio | Mito |
| MT.1116 | AI agents should not send email with AI-controlled inputs. | High | Copilot Studio | Mito |
| MT.1117 | Published AI agents should not be dormant. | Low | Copilot Studio | Mito |
| MT.1118 | AI agents should not use author (maker) authentication for connections. | Medium | Copilot Studio | Mito |
| MT.1119 | AI agents should not have hard-coded credentials in topics. | High | Copilot Studio | Mito |
| MT.1120 | AI agents should not use MCP server tools without review. | Medium | Copilot Studio | Mito |
| MT.1121 | AI agents with generative orchestration should have custom instructions. | Medium | Copilot Studio | Mito |
| MT.1122 | AI agents should not have orphaned ownership. | Medium | Copilot Studio | Mito |
| MT.1123 | Ensure BitLocker full disk encryption is configured | High | Intune | Mito |
| MT.1147 | Do not sync krbtgt_AzureAD to Entra ID. | High | Entra ID | Mito |
| MT.1148 | Archive Scanning should be enabled. | Medium | Defender | Mito |
| MT.1149 | Behavior Monitoring should be enabled. | High | Defender | Mito |
| MT.1150 | Cloud Protection should be enabled. | High | Defender | Mito |
| MT.1151 | Email Scanning should be enabled. | Medium | Defender | Mito |
| MT.1152 | Script Scanning should be enabled. | High | Defender | Mito |
| MT.1153 | Real-time Monitoring should be enabled. | High | Defender | Mito |
| MT.1154 | Full Scan Removable Drives should be enabled. | Medium | Defender | Mito |
| MT.1155 | Full Scan Mapped Drives should be disabled for performance. | Low | Defender | Mito |
| MT.1156 | Scanning Network Files should be enabled. | Medium | Defender | Mito |
| MT.1157 | CPU Load Factor should be optimized (20-30%). | Low | Defender | Mito |
| MT.1158 | Scan should be scheduled. | Low | Defender | Mito |
| MT.1159 | Quick Scan Time configuration is not required. | Info | Defender | Mito |
| MT.1160 | Signatures should be checked before scan. | Low | Defender | Mito |
| MT.1161 | Cloud Block Level should be High or higher. | Medium | Defender | Mito |
| MT.1162 | Cloud Extended Timeout should be 30-50 seconds. | Low | Defender | Mito |
| MT.1163 | Signature Update Interval should be 1-4 hours. | Low | Defender | Mito |
| MT.1164 | PUA Protection should be enabled. | Medium | Defender | Mito |
| MT.1165 | Network Protection should be enabled. | High | Defender | Mito |
| MT.1166 | Local Admin Merge should be disabled. | Medium | Defender | Mito |
| MT.1167 | Real-Time Scan Direction should cover both directions. | Medium | Defender | Mito |
| MT.1168 | Cleaned Malware should be retained for at least 30 days. | Low | Defender | Mito |
| MT.1169 | Catch-up Full Scan should be disabled. | Low | Defender | Mito |
| MT.1170 | Catch-up Quick Scan should be disabled. | Low | Defender | Mito |
| MT.1171 | Sample Submission should send safe samples automatically. | Medium | Defender | Mito |
| MT.1172 | Unified audit log ingestion is enabled. | High | Purview | Mito |
| MT.1173 | Sensitivity labels are published for files used by Microsoft 365 Copilot. | Medium | Purview | Mito |
| MT.1174 | Insider Risk Management policy for Risky AI usage is enabled. | Medium | Purview | Mito |
| MT.1175 | DLP policy is configured for the Microsoft 365 Copilot location. | High | Purview | Mito |
| MT.1176 | Retention policy is configured for the Microsoft Copilot location. | Medium | Purview | Mito |
| MT.1177 | Ensure LAPS Configuration Policy is properly set. | Medium | Intune | Mito |
| MT.1178 | Ensure ASR Rules are configured correctly. | High | Intune | Mito |
| MT.1179 | Ensure App Control for Business is enabled. | High | Intune | Mito |
| MT.1180 | Ensure Managed Installer Rules are configured correctly. | Medium | Intune | Mito |
| MT.1181 | Conditional Access policy is present that blocks high agent risk sign-ins. | High | Entra ID | Mito |
| MT.1182 | Mature DMARC policy SHALL be published for every Entra managed and verified domain. | Medium | Entra ID | Mito |
| MT.1183 | Temporary bypass for onPremisesObjectIdentifier updates should be disabled. | Medium | Entra ID | Mito |
| MT.1184 | Conditional Access policy without any target resources configured. | Medium | Entra ID | Mito |
| MT.1185 | Block legacy MSOnline (MSOL) PowerShell module. | Medium | Entra ID | Mito |
| MT.1186 | Require explicit assignment of high-privilege first-party Entra Apps. | Medium | Entra ID | Mito |
| MT.1187 | The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled. | Medium | Entra ID | Mito |
| MT.1188 | Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device. | Medium | Entra ID | Mito |
| MT.1189 | Groups assigned to Global Secure Access traffic forwarding profiles should not be nested. | Medium | Entra ID | Mito |
| MT.1190 | Entra Private Access applications should not use the Default connector group. | Low | Entra ID | Mito |
| MT.1191 | Break-glass accounts should be excluded from the Compliant Network Conditional Access policy. | Medium | Entra ID | Mito |
| MT.1192 | Groups assigned to Entra Private Access applications should not be nested. | Low | Entra ID | Mito |
| MT.1193 | Entra Private Access application segments should avoid broad or risky destinations. | Medium | Entra ID | Mito |
| MT.1194 | The baseline Global Secure Access security profile should enforce a threat-intelligence floor. | Medium | Entra ID | Mito |
| MT.1195 | The Quick Access app should not be subject to a sign-in frequency Conditional Access control. | Low | Entra ID | Mito |
| MT.1196 | Review who can change attributes used by dynamic group rules. | Medium | Entra ID | Mito |
| MT.1197 | Remove memberOf rules. | Medium | Entra ID | Mito |
| MT.1198 | App registration certificates should not have excessive validity periods. | Medium | Entra ID | Mito |
| MT.1199 | App registration credentials should not be expired or expiring soon. | Low | Entra ID | Mito |
| MT.1200 | Agent Identities should have an active Agent Identity Blueprint Principal (Preview). | Medium | Entra ID | Mito |
| MT.1201 | Agent Users should have an existing parent Agent Identity (Preview). | Medium | Entra ID | Mito |
| MT.1203 | Agent Identity Blueprint Principals should have an existing Blueprint (Preview). | Medium | Entra ID | Mito |
| MT.1204 | Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview). | Medium | Entra ID | Mito |
| MT.1205 | Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview). | Medium | Entra ID | Mito |
| MT.1206 | Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview). | Medium | Entra ID | Mito |
| MT.1207 | Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview). | High | Entra ID | Mito |
| MT.1208 | Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview). | Medium | Entra ID | Mito |
| MT.1209 | Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview). | High | Entra ID | Mito |
| MT.1210 | Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview). | High | Entra ID | Mito |
| MT.1211 | Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview). | High | Entra ID | Mito |
| MT.1212 | Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview). | Medium | Entra ID | Mito |
| MT.1213 | Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview). | High | Entra ID | Mito |
| MT.1214 | Ensure macOS compliance policy requires System Integrity Protection. | Medium | Intune | Mito |
| MT.1215 | Ensure Gatekeeper restricts macOS app download locations. | Medium | Intune | Mito |
| MT.1216 | Ensure macOS compliance policy requires a Defender machine risk score level. | Medium | Intune | Mito |
| MT.1217 | Ensure macOS LAPS is configured on Automated Device Enrollment profiles. | High | Intune | Mito |
| MT.1223 | Agent Identities should not have high-risk Microsoft Graph permissions (Preview). | High | Entra ID | Mito |
| MT.1224 | Microsoft-managed Conditional Access policies should not be left in report-only mode. | Low | Entra ID | Mito |
| ORCA.100 | Bulk Complaint Level threshold is between 4 and 6. | Low | Defender | ORCA |
| ORCA.101 | Bulk is marked as spam. | Low | Defender | ORCA |
| ORCA.102 | Advanced Spam filter options are turned off. | Low | Defender | ORCA |
| ORCA.103 | Outbound spam filter policy settings configured. | Medium | Defender | ORCA |
| ORCA.104 | High Confidence Phish action set to Quarantine message. | High | Defender | ORCA |
| ORCA.105 | Safe Links Synchronous URL detonation is enabled. | Medium | Defender | ORCA |
| ORCA.106 | Quarantine retention period is 30 days. | Low | Defender | ORCA |
| ORCA.107 | End-user spam notification is enabled. | Low | Defender | ORCA |
| ORCA.108 | DKIM signing is set up for all your custom domains. | Medium | Defender | ORCA |
| ORCA.108.1 | DNS Records have been set up to support DKIM. | Medium | Defender | ORCA |
| ORCA.109 | Senders are not being allow listed in an unsafe manner. | Medium | Defender | ORCA |
| ORCA.110 | Internal Sender notifications are disabled. | Low | Defender | ORCA |
| ORCA.111 | Anti-phishing policy exists and EnableUnauthenticatedSender is true. | Medium | Defender | ORCA |
| ORCA.112 | Anti-spoofing protection action is configured to Move message to the recipients’ Junk Email folders in Anti-phishing policy. | Medium | Defender | ORCA |
| ORCA.113 | AllowClickThrough is disabled in Safe Links policies. | Medium | Defender | ORCA |
| ORCA.114 | No IP Allow Lists have been configured. | Medium | Defender | ORCA |
| ORCA.115 | Mailbox intelligence based impersonation protection is enabled in anti-phishing policies. | Medium | Defender | ORCA |
| ORCA.116 | Mailbox intelligence based impersonation protection action set to move message to junk mail folder. | Medium | Defender | ORCA |
| ORCA.118.1 | Domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | Defender | ORCA |
| ORCA.118.2 | Domains are not being allow listed in an unsafe manner in Transport Rules. | High | Defender | ORCA |
| ORCA.118.3 | Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | Defender | ORCA |
| ORCA.118.4 | Your own domains are not being allow listed in an unsafe manner in Transport Rules. | High | Defender | ORCA |
| ORCA.119 | Similar Domains Safety Tips is enabled. | Info | Defender | ORCA |
| ORCA.120.1 | Zero Hour Autopurge Enabled for Phish. | Medium | Defender | ORCA |
| ORCA.120.2 | Zero Hour Autopurge Enabled for Malware. | Medium | Defender | ORCA |
| ORCA.120.3 | Zero Hour Autopurge Enabled for Spam. | Medium | Defender | ORCA |
| ORCA.121 | Supported filter policy action used. | Medium | Defender | ORCA |
| ORCA.123 | Unusual Characters Safety Tips is enabled. | Info | Defender | ORCA |
| ORCA.124 | Safe attachments unknown malware response set to block messages. | High | Defender | ORCA |
| ORCA.139 | Spam action set to move message to junk mail folder or quarantine. | Low | Defender | ORCA |
| ORCA.140 | High Confidence Spam action set to Quarantine message. | Medium | Defender | ORCA |
| ORCA.141 | Bulk action set to Move message to Junk Email Folder. | Low | Defender | ORCA |
| ORCA.142 | Phish action set to Quarantine message. | Medium | Defender | ORCA |
| ORCA.143 | Safety Tips are enabled. | Info | Defender | ORCA |
| ORCA.156 | Safe Links Policies are tracking when user clicks on safe links. | Medium | Defender | ORCA |
| ORCA.158 | Safe Attachments is enabled for SharePoint and Teams. | Medium | Defender | ORCA |
| ORCA.179 | Safe Links is enabled intra-organization. | Medium | Defender | ORCA |
| ORCA.180 | Anti-phishing policy exists and EnableSpoofIntelligence is true. | Medium | Defender | ORCA |
| ORCA.189 | Safe Attachments is not bypassed. | Medium | Defender | ORCA |
| ORCA.189.2 | Safe Links is not bypassed. | High | Defender | ORCA |
| ORCA.205 | Common attachment type filter is enabled. | Medium | Defender | ORCA |
| ORCA.220 | Advanced Phish filter Threshold level is adequate. | Medium | Defender | ORCA |
| ORCA.221 | Mailbox intelligence is enabled in anti-phishing policies. | Medium | Defender | ORCA |
| ORCA.222 | Domain Impersonation action is set to move to Quarantine. | Medium | Defender | ORCA |
| ORCA.223 | User impersonation action is set to move to Quarantine. | Medium | Defender | ORCA |
| ORCA.224 | Similar Users Safety Tips is enabled. | Info | Defender | ORCA |
| ORCA.225 | Safe Documents is enabled for Office clients. | Medium | Defender | ORCA |
| ORCA.226 | Each domain has a Safe Link policy applied to it. | Medium | Defender | ORCA |
| ORCA.227 | Each domain has a Safe Attachments policy applied to it. | Medium | Defender | ORCA |
| ORCA.228 | No trusted senders in Anti-phishing policy. | Medium | Defender | ORCA |
| ORCA.229 | No trusted domains in Anti-phishing policy. | Medium | Defender | ORCA |
| ORCA.230 | Each domain has a Anti-phishing policy applied to it, or the default policy is being used. | Low | Defender | ORCA |
| ORCA.231 | Each domain has a anti-spam policy applied to it, or the default policy is being used. | Low | Defender | ORCA |
| ORCA.232 | Each domain has a malware filter policy applied to it, or the default policy is being used. | Low | Defender | ORCA |
| ORCA.233 | Domains are pointed directly at EOP or enhanced filtering is used. | Medium | Defender | ORCA |
| ORCA.233.1 | Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors. | Medium | Defender | ORCA |
| ORCA.234 | Click through is disabled for Safe Documents. | Medium | Defender | ORCA |
| ORCA.235 | SPF records is set up for all your custom domains. | Medium | Defender | ORCA |
| ORCA.236 | Safe Links is enabled for emails. | Medium | Defender | ORCA |
| ORCA.237 | Safe Links is enabled for teams messages. | Medium | Defender | ORCA |
| ORCA.238 | Safe Links is enabled for office documents. | Medium | Defender | ORCA |
| ORCA.239 | No exclusions for the built-in protection policies. | High | Defender | ORCA |
| ORCA.240 | Outlook is configured to display external tags for external emails. | Medium | Defender | ORCA |
| ORCA.241 | Anti-phishing policy exists and EnableFirstContactSafetyTips is true. | Medium | Defender | ORCA |
| ORCA.242 | Important protection alerts responsible for AIR activities are enabled. | High | Defender | ORCA |
| ORCA.243 | Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO. | Medium | Defender | ORCA |
| ORCA.244 | Policies are configured to honor sending domains DMARC. | Medium | Defender | ORCA |
Checks that need another connection
Section titled “Checks that need another connection”These 70 checks read Azure DevOps, GitHub, Azure subscriptions or SharePoint Online PowerShell, which Mito’s assessment does not connect to. They are reported as skipped.
| ID | Title | Severity | Product | Suite |
|---|---|---|---|---|
| AZDO.1000 | Azure DevOps OAuth apps can access resources in your organization through OAuth. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1001 | Identities can connect to your organization’s Git repos through SSH. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1002 | Log Audit Events. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1003 | Restrict public projects. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1004 | Additional protections when using public package registries. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1005 | IP Conditional Access policy validation. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1006 | External Users access. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1007 | Team and project administrator are allowed to invite new users. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1008 | Request access to Azure DevOps by e-mail notifications to administrators. (not run by Mito) | Low | Azure DevOps | Mito |
| AZDO.1009 | Feedback Collection. (not run by Mito) | Info | Azure DevOps | Mito |
| AZDO.1010 | Audit streaming. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1011 | Project Resource Limits. (not run by Mito) | Info | Azure DevOps | Mito |
| AZDO.1012 | Work Items Tags Limits. (not run by Mito) | Info | Azure DevOps | Mito |
| AZDO.1013 | Organization Owner should not be an individual. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1014 | Anonymous access to pipeline badges. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1015 | Limit variables that can be set at queue time. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1016 | Limit job authorization scope to current project for non-release pipelines. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1017 | Limit job authorization scope to current project for classic release pipelines. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1018 | Protect access to repositories in YAML pipelines. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1019 | Stage chooser. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1020 | Creation of classic build pipelines. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1021 | Creation of classic release pipelines. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1022 | Limit building pull requests from forked GitHub repositories. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1023 | Disable Marketplace tasks. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1024 | Disable Node 6 tasks. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1025 | Enable shell tasks arguments validation. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1026 | Enable automatic enrollment to Advanced Security for Azure DevOps. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1027 | Disable showing Gravatar images for users outside of your enterprise. (not run by Mito) | Low | Azure DevOps | Mito |
| AZDO.1028 | Disable creation of TFVC repositories. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1029 | Storage Usage Limit. (not run by Mito) | Info | Azure DevOps | Mito |
| AZDO.1030 | Project Collection Administrators. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1031 | Validate SSH Key Expiration. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1032 | (Tenant) Restrict creation of global Personal Access Tokens. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1033 | (Tenant) Enable automatic revocation of leaked Personal Access Tokens. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1034 | (Tenant) Restrict creation of new Azure DevOps organizations. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1035 | (Tenant) Restrict Personal Access Token lifespan. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1036 | (Tenant) Restrict Personal Access Token full scope. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1037 | (Organization) Restrict Personal Access Token creation. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1038 | (Organization) Disallow extensions from accessing resources on the local network. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1039 | (Organization) Secret Protection: new repositories enrolled automatically. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1040 | (Organization) Secret Protection: existing repositories enrolled. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1041 | (Organization) Secret Protection: push protection blocks secret commits. (not run by Mito) | High | Azure DevOps | Mito |
| AZDO.1042 | (Organization) Code Security: new repositories enrolled automatically. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1043 | (Organization) Code Security: existing repositories enrolled. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1044 | (Organization) Code Security: dependency and CodeQL alerts enabled. (not run by Mito) | Medium | Azure DevOps | Mito |
| AZDO.1045 | (Organization) Copilot code review: allowed for repositories. (not run by Mito) | Info | Azure DevOps | Mito |
| CIS.GH.1.2.2 | Ensure repository creation is limited to specific members (not run by Mito) | Medium | GitHub | CIS Microsoft 365 Foundations Benchmark |
| CIS.GH.1.2.3 | Ensure repository deletion is limited to specific users (not run by Mito) | High | GitHub | CIS Microsoft 365 Foundations Benchmark |
| CIS.GH.1.2.4 | Ensure issue deletion is limited to specific users (not run by Mito) | Medium | GitHub | CIS Microsoft 365 Foundations Benchmark |
| CIS.GH.1.3.2 | Ensure team creation is limited to specific members (not run by Mito) | Medium | GitHub | CIS Microsoft 365 Foundations Benchmark |
| CIS.GH.1.3.8 | Ensure strict base permissions are set for repositories (not run by Mito) | High | GitHub | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.2.2 | Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.2.5 | Ensure that SharePoint guest users cannot share items they don’t own (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.2.7 | Ensure link sharing is restricted in SharePoint and OneDrive (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.2.9 | Ensure guest access to a site or OneDrive will expire automatically (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.2.11 | Ensure the SharePoint default sharing link permission is set (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.7.3.1 | Ensure Office 365 SharePoint infected files are disallowed for download (not run by Mito) | Medium | SharePoint | CIS Microsoft 365 Foundations Benchmark |
| CISA.MS.AAD.4.1 | Security logs SHALL be sent to the agency’s security operations center for monitoring. (not run by Mito) | High | Entra ID | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.1.1 | External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.1.2 | External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.1.3 | External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs. (not run by Mito) | High | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.2.1 | File and folder default sharing scope SHALL be set to Specific People. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.2.2 | File and folder default sharing permissions SHALL be set to View only. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.3.1 | Expiration days for Anyone links SHALL be set to 30 days or less. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.3.2 | Allowable file and folder permissions for Anyone links SHALL be set to View only. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| CISA.MS.SHAREPOINT.3.3 | Reauthentication days for people who use a verification code SHALL be set to 30 days or less. (not run by Mito) | Medium | SharePoint | CISA SCuBA baselines |
| MT.1056 | Ensure that no person has permanent access to all Azure subscriptions at the root scope (not run by Mito) | High | Azure | Mito |
| MT.1064 | Ensure that write permissions are required to create new management groups (not run by Mito) | Medium | Azure | Mito |
| MT.1065 | Ensure all Recovery Services Vaults have soft delete enabled (not run by Mito) | High | Azure | Mito |
| MT.1100 | Intune Diagnostic Settings should include Audit Logs (not run by Mito) | High | Intune | Mito |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.