Microsoft 365
11 checks from CIS Microsoft 365 Foundations Benchmark, Mito: 2 High, 9 Medium.
| ID | Title | Severity | Suite |
|---|---|---|---|
| CIS.M365.1.1.1 | Ensure Administrative accounts are cloud-only | High | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.1.3 | Ensure that between two and four global admins are designated | High | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.2.1 | Ensure that only organizationally managed/approved public groups exist | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.2.2 | Ensure sign-in to shared mailboxes is blocked | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.1 | Ensure the ‘Password expiration policy’ is set to ‘Set passwords to never expire (recommended)’ | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.3 | Ensure ‘External sharing’ of calendars is not available | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.4 | Ensure ‘User owned apps and services’ is restricted | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.5 | Ensure internal phishing protection for Forms is enabled | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.6 | Ensure the customer lockbox feature is enabled | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.1.3.7 | Ensure ‘third-party storage services’ are restricted in ‘Microsoft 365 on the web’ | Medium | CIS Microsoft 365 Foundations Benchmark |
| MT.1060 | Drift folders should match their baseline. | Medium | Mito |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.