Check catalog
636 checks, every one backed by golden fixtures: 1,829 fixtures, 0 failures on the run that gated module v2.48.0.
By platform
Active Directory (211 checks)
AD ACL & Delegation (16)
- ADACL-001: Critical Object ACL Audit Critical
- ADACL-002: GenericAll Permissions on Critical Objects Critical
- ADACL-003: GenericWrite Permissions on Critical Objects High
- ADACL-004: WriteDACL Permissions on Critical Objects Critical
- ADACL-005: WriteOwner Permissions on Critical Objects Critical
- ADACL-006: ForceChangePassword Rights High
- ADACL-007: Excessive Delegation to Broad Groups Critical
- ADACL-008: OU Delegation Analysis Medium
- ADACL-009: Machine Account Quota High
- ADACL-010: Extended Rights Audit Critical
- ADACL-011: Ownership of Critical Objects High
- ADACL-012: Non-Default Domain Root Permissions High
- ADACL-013: GPO Link Permissions High
- ADACL-014: GPO Edit Permissions High
- ADACL-015: Shadow Admins Detection Critical
- ADACL-016: Attack Path Enumeration Critical
AD Certificate Services (19)
- ADCS-001: CA Server Inventory Info
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name Critical
- ADCS-003: ESC2 - Any Purpose Extended Key Usage Critical
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1 High
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2 High
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs Critical
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership Critical
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs High
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag Critical
- ADCS-010: ESC7 - Vulnerable CA ACLs Critical
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints Critical
- ADCS-012: ESC9 - No Security Extension High
- ADCS-013: ESC11 - RPC Relay Without Encryption High
- ADCS-014: ESC13 - Issuance Policy OID Group Link High
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates Medium
- ADCS-016: ESC16 - UPN SAN Misconfiguration High
- ADCS-017: EKEUwu - Extended Key Usage Abuse High
- ADCS-018: CA Auditing Configuration High
- ADCS-019: Certificate Template Enumeration Info
AD Domain & Forest Configuration (20)
- ADDOM-001: Forest Functional Level High
- ADDOM-002: Domain Functional Level High
- ADDOM-003: Schema Version Identification Medium
- ADDOM-004: Domain Controller Inventory High
- ADDOM-005: Obsolete OS on Domain Controllers Critical
- ADDOM-006: FSMO Role Holder Identification Info
- ADDOM-007: AD Replication Health High
- ADDOM-008: Tombstone Lifetime Configuration Medium
- ADDOM-009: AD Recycle Bin Status Medium
- ADDOM-010: Sites and Subnets Configuration Medium
- ADDOM-011: Site Link Configuration Low
- ADDOM-012: DNS Zone Security High
- ADDOM-013: LDAP Signing Requirements Critical
- ADDOM-014: LDAP Channel Binding High
- ADDOM-015: SMB Signing Requirements Critical
- ADDOM-016: NTLMv1 Usage Detection Critical
- ADDOM-017: NTLMv2 Enforcement High
- ADDOM-018: Null Session Enumeration High
- ADDOM-019: Print Spooler on Domain Controllers High
- ADDOM-020: DSRM Password Configuration Medium
AD Group Policy (24)
- ADGPO-001: GPO Inventory with Link Status Info
- ADGPO-002: Empty GPOs Low
- ADGPO-003: Unlinked GPOs Low
- ADGPO-004: Disabled GPOs with Content Low
- ADGPO-005: Duplicated GPOs Low
- ADGPO-006: GPOs with Broken Links Medium
- ADGPO-007: GPO Permission Inconsistencies High
- ADGPO-008: GPOs Not Applied Due to WMI Filters Medium
- ADGPO-009: GPOs with No Apply Permission Medium
- ADGPO-010: SYSVOL/AD GPO Version Mismatch Medium
- ADGPO-011: GPO Settings Security Analysis High
- ADGPO-012: cPassword/GPP Password Detection Critical
- ADGPO-013: Scripts in GPOs Analysis High
- ADGPO-014: MSI Packages in GPOs Medium
- ADGPO-015: Scheduled Tasks in GPOs High
- ADGPO-016: Registry Settings Security Review Medium
- ADGPO-017: Restricted Groups Analysis High
- ADGPO-018: Audit Policy Configuration via GPO High
- ADGPO-019: Windows Firewall Configuration via GPO Medium
- ADGPO-020: PowerShell Execution Policy via GPO Medium
- ADGPO-021: PowerShell Logging Configuration High
- ADGPO-022: AppLocker/WDAC Policy Assessment Medium
- ADGPO-023: LAPS GPO Configuration High
- ADGPO-024: GPO WMI Filter Review Low
AD Kerberos Security (11)
- ADKERB-001: Kerberoastable Accounts High
- ADKERB-002: Kerberoastable with Weak Encryption Critical
- ADKERB-003: AS-REP Roastable Accounts High
- ADKERB-004: Unconstrained Delegation - Computers Critical
- ADKERB-005: Unconstrained Delegation - Users Critical
- ADKERB-006: Constrained Delegation Analysis High
- ADKERB-007: Resource-Based Constrained Delegation High
- ADKERB-008: Protocol Transition Abuse Paths High
- ADKERB-009: Kerberos Encryption Types High
- ADKERB-010: Kerberos Ticket Lifetime Medium
- ADKERB-011: Computer SPN Audit Info
AD Logging & EDR Posture (7)
- ADLOG-001: Advanced Audit Policy Configured High
- ADLOG-002: PowerShell Script Block Logging Enabled High
- ADLOG-003: PowerShell Module Logging Enabled Medium
- ADLOG-004: Process Creation Auditing with Command Line High
- ADLOG-005: Microsoft Defender Tamper Protection Policy High
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager High
- ADLOG-007: Sysmon Deployment Indicator Medium
AD Network & Relay Preconditions (10)
- ADNET-001: LDAP Signing Required on Domain Controllers Critical
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers High
- ADNET-003: SMB Server Signing Required (Domain Policy) Critical
- ADNET-004: SMB Client Signing Required (Domain Policy) High
- ADNET-005: LLMNR Disabled by Domain Policy High
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed Medium
- ADNET-007: IPv6 mitm6 Mitigation Posture High
- ADNET-008: WPAD Auto-Discovery Disabled Medium
- ADNET-009: Print Spooler Service on Domain Controllers Critical
- ADNET-010: WebClient Service Default State on Workstations High
Attack Paths (2)
AD Privileged Account Security (30)
- ADPRIV-001: Domain Admins Enumeration Critical
- ADPRIV-002: Enterprise Admins Enumeration Critical
- ADPRIV-003: Schema Admins Enumeration High
- ADPRIV-004: Account Operators Enumeration High
- ADPRIV-005: Server Operators Enumeration High
- ADPRIV-006: Backup Operators Enumeration High
- ADPRIV-007: Print Operators Enumeration Medium
- ADPRIV-008: DnsAdmins Group Membership High
- ADPRIV-009: Nested Group Membership Analysis High
- ADPRIV-010: Privileged Users Password Never Expires Critical
- ADPRIV-011: Privileged Users Password Not Required Critical
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth Critical
- ADPRIV-013: Privileged Users Reversible Encryption Critical
- ADPRIV-014: Privileged Users DES-Only Kerberos High
- ADPRIV-015: Privileged Accounts No MFA Indicator High
- ADPRIV-016: Privileged Accounts Weak Passwords Critical
- ADPRIV-017: Privileged Accounts Old Passwords High
- ADPRIV-018: Privileged Accounts Never Logged In Medium
- ADPRIV-019: Disabled Accounts in Privileged Groups High
- ADPRIV-020: AdminSDHolder Protected Object Audit Critical
- ADPRIV-021: AdminCount Orphans Medium
- ADPRIV-022: krbtgt Password Age Critical
- ADPRIV-023: krbtgt Account Exposure Assessment Critical
- ADPRIV-024: Service Accounts in Privileged Groups High
- ADPRIV-025: Computer Accounts in Privileged Groups High
- ADPRIV-026: Privileged Users Local Logon on DCs High
- ADPRIV-027: Privileged Users RDP on DCs High
- ADPRIV-028: Users with DCSync Rights Critical
- ADPRIV-029: Protected Users Group Audit High
- ADPRIV-030: Privileged Users Not in Protected Users High
AD Password & Lockout Policies (22)
- ADPWD-001: Default Domain Password Policy High
- ADPWD-002: Fine-Grained Password Policy Enumeration Medium
- ADPWD-003: FGPP Application Analysis Medium
- ADPWD-004: Minimum Password Length High
- ADPWD-005: Password Complexity Requirement High
- ADPWD-006: Account Lockout Policy High
- ADPWD-007: Password History Enforcement Medium
- ADPWD-008: Maximum Password Age Medium
- ADPWD-009: Users with Password Never Expires High
- ADPWD-010: Users with Blank Passwords Critical
- ADPWD-011: Duplicate Password Hashes High
- ADPWD-012: Passwords in HaveIBeenPwned Database High
- ADPWD-013: Custom Dictionary Password Check Medium
- ADPWD-014: Default/Common Passwords High
- ADPWD-015: Password Last Set Age Distribution Medium
- ADPWD-016: LAPS Deployment Status High
- ADPWD-017: LAPS Password Expiration Medium
- ADPWD-018: Windows LAPS vs Legacy LAPS Low
- ADPWD-019: Azure AD Password Protection Medium
- ADPWD-020: BitLocker Recovery Keys in AD Info
- ADPWD-021: Account Lockout Threshold High
- ADPWD-022: Lockout Observation Window Medium
AD Logon Scripts & Network Shares (11)
- ADSCRIPT-001: NETLOGON Share Permissions High
- ADSCRIPT-002: SYSVOL Share Permissions High
- ADSCRIPT-003: Logon Script Inventory Info
- ADSCRIPT-004: Hardcoded Credentials in Scripts Critical
- ADSCRIPT-005: LOLBins Usage in Scripts High
- ADSCRIPT-006: Plaintext Passwords in Scripts Critical
- ADSCRIPT-007: World-Writable Script Permissions Critical
- ADSCRIPT-008: External Resource References High
- ADSCRIPT-009: Malformed Scripts Medium
- ADSCRIPT-010: UNC Paths to Non-DC Locations High
- ADSCRIPT-011: Script Content Analysis Medium
AD Stale & Obsolete Objects (11)
- ADSTALE-001: Inactive User Accounts Medium
- ADSTALE-002: Inactive Computer Accounts Medium
- ADSTALE-003: Disabled Accounts with Group Memberships Medium
- ADSTALE-004: Expired Passwords Not Disabled Medium
- ADSTALE-005: Obsolete OS Computers High
- ADSTALE-006: Unsupported OS Versions High
- ADSTALE-007: Orphaned Foreign Security Principals Medium
- ADSTALE-008: Orphaned SID History Medium
- ADSTALE-009: Abandoned OUs Low
- ADSTALE-010: Printer Objects Low
- ADSTALE-011: DNS Record Staleness Medium
Tier-0 Hygiene & Hybrid Identity Surface (7)
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit Critical
- ADTIER-002: Backup Software Service Accounts in Privileged Groups Critical
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups High
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups Critical
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups High
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU High
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group High
AD Adversary Tradecraft Indicators (10)
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL Critical
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers) High
- ADTRADE-003: Stale BitLocker Recovery Keys Medium
- ADTRADE-004: RODC Password Replication Policy Hygiene High
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation High
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals Critical
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface Critical
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership High
- ADTRADE-009: Cert Publishers Group Membership High
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure High
AD Trust Relationships (11)
- ADTRUST-001: Trust Relationships Enumeration Info
- ADTRUST-002: Trust Direction Analysis Medium
- ADTRUST-003: Trust Transitivity Analysis Medium
- ADTRUST-004: SID Filtering Status Critical
- ADTRUST-005: SID History Abuse Detection Critical
- ADTRUST-006: Selective Authentication Status High
- ADTRUST-007: Azure AD Hybrid Trust Security Medium
- ADTRUST-008: Foreign Domain Trust Enumeration Medium
- ADTRUST-009: Orphaned Trust Detection Medium
- ADTRUST-010: Trust Key Age and Rotation High
- ADTRUST-011: Trust Hierarchy Visualization Info
Google Workspace (168 checks)
Admin & User Management (22)
- ADMIN-001: Super Admin Account Inventory Critical
- ADMIN-002: Admin Role Assignments Audit High
- ADMIN-003: Delegated Admin Permissions Review Medium
- ADMIN-004: Inactive/Suspended Admin Accounts High
- ADMIN-005: User Account Inventory Medium
- ADMIN-006: Stale User Accounts Medium
- ADMIN-007: OU Structure Review Low
- ADMIN-008: Directory Sharing Settings Medium
- ADMIN-009: User Profile Visibility Low
- ADMIN-010: Groups Settings and External Membership High
- ADMIN-011: Group Creation Restrictions Medium
- ADMIN-012: Groups for Business Settings Medium
- ADMIN-013: Super Admin Count High
- ADMIN-014: Assured Controls - Access Approvals Enabled Medium
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff Medium
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled Medium
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3) Medium
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1) Low
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2) Low
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4) High
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1) Medium
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2) Medium
Authentication & Access Controls (18)
- AUTH-001: 2SV Enforcement Critical
- AUTH-002: 2SV Enrollment Rate High
- AUTH-003: 2SV Method Strength Medium
- AUTH-004: Password Minimum Length High
- AUTH-005: Password Reuse Restriction Medium
- AUTH-006: Session Duration Medium
- AUTH-007: SSO Configuration Medium
- AUTH-008: Less Secure Apps Access High
- AUTH-009: App Passwords Policy Medium
- AUTH-010: Recovery Options Configuration High
- AUTH-011: Login Challenge Settings Medium
- AUTH-012: Super Admin 2SV Enrollment Critical
- AUTH-013: Stale Super Admin Accounts High
- AUTH-014: 2SV Enrollment Allowed Medium
- AUTH-015: 2SV Enrollment Grace Period Low
- AUTH-016: Advanced Protection Self-Enrollment Low
- AUTH-017: Super Admin Account Self-Recovery High
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2) Medium
Collaboration (25)
- COLLAB-001: Meet Recording Settings Medium
- COLLAB-002: Meet External Participant Settings Medium
- COLLAB-003: Meet Anonymous Join Settings Medium
- COLLAB-004: Chat External Communication High
- COLLAB-005: Chat History Settings Medium
- COLLAB-006: Chat Spaces External Access Medium
- COLLAB-007: Chat App Installation Settings Low
- COLLAB-008: Calendar External Sharing High
- COLLAB-009: Calendar External Invitations Medium
- COLLAB-010: Calendar Appointment Slots External Visibility Low
- COLLAB-011: Meet External Participant Labeling Low
- COLLAB-012: Meet Host Management Medium
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1) High
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1) Low
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1) High
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2) Low
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1) Low
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1) Low
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1) Low
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1) High
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2) Medium
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3) Medium
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1) Low
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1) Low
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1) Low
Device & Endpoint Management (11)
- DEVICE-001: MDM Policy Audit High
- DEVICE-002: Device Approval Requirements High
- DEVICE-003: Screen Lock Enforcement High
- DEVICE-004: Device Encryption Requirements High
- DEVICE-005: Compromised Device Blocking High
- DEVICE-006: Jailbroken/Rooted Device Policy High
- DEVICE-007: Chrome Browser Management Medium
- DEVICE-008: Chrome Extension Whitelist/Blocklist High
- DEVICE-009: Chrome OS Device Policies Medium
- DEVICE-010: Endpoint Verification Settings Medium
- DEVICE-011: Company-Owned Device Inventory Low
Drive Security & Data Protection (17)
- DRIVE-001: External Sharing Defaults High
- DRIVE-002: Link Sharing Default Settings High
- DRIVE-003: Anyone With the Link Sharing Audit High
- DRIVE-004: Shared Drive Creation Restrictions Medium
- DRIVE-005: Shared Drive Member Management Medium
- DRIVE-006: Shared Drive External Sharing High
- DRIVE-007: File Ownership Transfer Settings Medium
- DRIVE-008: Drive for Desktop Allowed/Blocked Medium
- DRIVE-009: Third-Party App Drive Access High
- DRIVE-010: Drive DLP Rules Audit Medium
- DRIVE-011: Target Audience Settings Medium
- DRIVE-012: Drive Add-ons Settings Low
- DRIVE-013: Offline Access Settings Medium
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1) High
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9) Low
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1) Medium
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8) Medium
Advanced Threat Protection (31)
- EMAIL-001: SPF Record Validation Critical
- EMAIL-002: DKIM Signing Enabled Critical
- EMAIL-003: DMARC Policy Audit Critical
- EMAIL-004: MTA-STS Policy Medium
- EMAIL-005: TLS Enforcement High
- EMAIL-006: Email Allowlist/Blocklist Review Medium
- EMAIL-007: Inbound Gateway Configuration Medium
- EMAIL-008: Email Routing Rules Audit Medium
- EMAIL-009: Auto-Forwarding Policy High
- EMAIL-010: Delegate Access Settings Medium
- EMAIL-011: POP/IMAP Access Settings High
- EMAIL-012: Spam and Phishing Filter Settings High
- EMAIL-013: Enhanced Pre-Delivery Message Scanning High
- EMAIL-014: External Recipient Warning Medium
- EMAIL-015: Attachment Safety Settings High
- EMAIL-016: Links and External Images Protection High
- EMAIL-017: Spoofing and Authentication Protection Critical
- EMAIL-018: Compliance Rules Audit Medium
- EMAIL-019: DLP Rules Configuration Medium
- EMAIL-020: Gmail Confidential Mode Low
- EMAIL-021: S/MIME Settings Low
- EMAIL-022: Mail Forwarding Rule Enumeration High
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1) Medium
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1) Medium
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1) Medium
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1) High
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1) Low
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1) Low
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1) Low
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1) Medium
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1) Medium
Adversary Tradecraft (6)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure Critical
- GTRADE-002: Internet-Readable Google Groups High
- GTRADE-003: Open-Join / External-Member Groups Medium
- GTRADE-004: Super-Admin Sprawl Medium
- GTRADE-005: Super-Admin-Equivalent Custom Roles Medium
- GTRADE-006: Persistent / Over-Scoped OAuth Grants High
Gemini for Workspace (12)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes Medium
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join Medium
- GWS-CLASS-003: Classroom API Data Access Restricted Medium
- GWS-CLASS-004: Classroom Roster Import Disabled Low
- GWS-CLASS-005: Classroom Student Unenrollment Restricted Low
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers Medium
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users Medium
- GWS-GEMINI-002: Gemini Alpha Features Disabled Low
- GWS-GEMINI-003: Gemini Conversation History Enabled Low
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months Low
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled Medium
- GWS-SITES-001: Sites Service Disabled Low
K12 Baseline (10)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff Medium
- GWS-K12-002: Student External Drive Sharing Restricted High
- GWS-K12-003: Students Cannot Authorize Third-Party Apps High
- GWS-K12-004: Vendor Delegated Access Review High
- GWS-K12-005: Delegated Admin Least Privilege High
- GWS-K12-006: Student Communication Boundaries High
- GWS-K12-007: Guardian Access Integrity Medium
- GWS-K12-008: Managed Student Chromebook Posture Medium
- GWS-K12-009: Departed Student Account Disposition Medium
- GWS-K12-010: Student Account Security Floor High
Logging, Alerting & Monitoring (6)
OAuth & API Security (10)
- OAUTH-001: OAuth App Whitelist/Blocklist High
- OAUTH-002: Installed OAuth Apps Inventory High
- OAUTH-003: OAuth Scope Analysis Critical
- OAUTH-004: OAuth App Risk Scoring High
- OAUTH-005: Unverified App Access Policy High
- OAUTH-006: API Access Control Medium
- OAUTH-007: Marketplace App Installation Restrictions Medium
- OAUTH-008: Domain-Wide Delegation Grants Audit Critical
- OAUTH-009: Service Account Key Enumeration High
- OAUTH-010: Connected Apps With Sensitive Scopes High
Entra ID / M365 (257 checks)
AI Agent Governance (4)
Azure IAM & Resource Security (10)
- AZIAM-001: Subscription-level role assignments audit High
- AZIAM-002: Users with Azure IAM roles directly on resources Medium
- AZIAM-003: Resource group permission analysis Medium
- AZIAM-004: Azure Key Vault access policy audit High
- AZIAM-005: Storage account security settings High
- AZIAM-006: Network Security Group rules audit High
- AZIAM-007: Azure Policy compliance status Medium
- AZIAM-008: Management group structure review Info
- AZIAM-009: Custom RBAC role definitions Medium
- AZIAM-010: Resource locks configuration Medium
Consent (20)
- EIDAPP-001: Application Registration Inventory Info
- EIDAPP-002: App Registrations with High-Risk API Permissions Critical
- EIDAPP-003: App Registrations with Added Credentials High
- EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials Critical
- EIDAPP-005: Service Principals with High Privileges and Added Credentials Critical
- EIDAPP-006: Excessive Microsoft Graph Permissions High
- EIDAPP-007: App Registrations with Azure IAM Role Assignments High
- EIDAPP-008: Credential Expiration Monitoring Medium
- EIDAPP-009: Stale Application Registrations Medium
- EIDAPP-010: Multi-Tenant Application Analysis Medium
- EIDAPP-011: Consent Grants Analysis High
- EIDAPP-012: User Consent Settings Policy High
- EIDAPP-013: Admin Consent Workflow Configuration Medium
- EIDAPP-014: Application Impersonation Role Holders Critical
- EIDAPP-015: OAuth2 Permission Grants Review High
- EIDAPP-016: Managed Identity Inventory and Permissions Info
- EIDAPP-017: Service Principal Sign-In Activity Info
- EIDAPP-018: Change Tracking on App Registrations and Service Principals Medium
- EIDAPP-019: Dangling Reply URLs High
- EIDAPP-020: Group Owner Consent to Applications Blocked Medium
Entra ID Authentication Methods & MFA (18)
- EIDAUTH-001: Authentication Methods Policy Audit Info
- EIDAUTH-002: MFA Registration Status for All Users Critical
- EIDAUTH-003: MFA Method Distribution Analysis Info
- EIDAUTH-004: Users with Only SMS/Voice MFA Methods High
- EIDAUTH-005: Users with No MFA Methods Registered Critical
- EIDAUTH-006: FIDO2 Security Key Inventory and Audit Info
- EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check Critical
- EIDAUTH-008: Passwordless Authentication Readiness Medium
- EIDAUTH-009: Windows Hello for Business Configuration Medium
- EIDAUTH-010: Temporary Access Pass (TAP) Policy Audit Medium
- EIDAUTH-011: Self-Service Password Reset (SSPR) Configuration High
- EIDAUTH-012: SSPR Methods and Requirements Medium
- EIDAUTH-013: Password Protection (Banned Passwords) Configuration High
- EIDAUTH-014: Custom Banned Password List Status Medium
- EIDAUTH-015: Legacy Authentication Protocol Usage High
- EIDAUTH-016: ROPC (Resource Owner Password Credentials) Flow Enabled High
- EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection Medium
- EIDAUTH-018: Microsoft Authenticator Login Context (Application Name and Location) Medium
Entra ID Conditional Access (18)
- EIDCA-001: Full CA Policy Inventory Info
- EIDCA-002: CA Policy Coverage Gap Analysis High
- EIDCA-003: CA Policies in Report-Only Mode Medium
- EIDCA-004: CA Exclusion Group Analysis High
- EIDCA-005: Unprotected Groups in CA Exclusions High
- EIDCA-006: Break-Glass Account CA Exclusion Validation Critical
- EIDCA-007: MFA Enforcement via Conditional Access Critical
- EIDCA-008: Legacy Authentication Blocking via CA Critical
- EIDCA-009: Device Compliance Requirement in CA High
- EIDCA-010: Location-Based CA Policies Audit Medium
- EIDCA-011: Named Locations Configuration Review Medium
- EIDCA-012: Sign-In Risk-Based CA Policies High
- EIDCA-013: User Risk-Based CA Policies High
- EIDCA-014: Session Controls Audit Medium
- EIDCA-015: CA What-If Simulation for Attack Scenarios Info
- EIDCA-016: CA Policy Documentation Export Info
- EIDCA-017: High-Risk User Notification to Administrators Medium
- EIDCA-018: Managed Device Required for MFA Registration Medium
Entra ID Federation & Hybrid Identity (13)
- EIDFED-001: Federated Domain Enumeration Info
- EIDFED-002: Federation Signing Certificate Validity Period High
- EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch Critical
- EIDFED-004: Federation Trust Metadata Analysis High
- EIDFED-005: Azure AD Connect Configuration Review High
- EIDFED-006: Azure AD Connect Sync Scope Audit Medium
- EIDFED-007: Password Hash Sync Enabled Status Medium
- EIDFED-008: Pass-Through Authentication Agent Status Medium
- EIDFED-009: AD FS Server Configuration Assessment High
- EIDFED-010: AD FS Extranet Lockout Settings Medium
- EIDFED-011: Hybrid Join Configuration Medium
- EIDFED-012: Cloud-Only vs Synced Account Analysis Info
- EIDFED-013: Entra Connect Sync-Client Version Currency High
Entitlement Management (5)
- EIDGOV-001: Access-package assignment policies require approval Medium
- EIDGOV-002: Access-package assignment policies enforce access reviews Medium
- EIDGOV-003: Access-package assignments are time-bound Low
- EIDGOV-004: External access-package eligibility is controlled High
- EIDGOV-005: Access-package catalog external visibility reviewed Low
Entra ID Privileged Identity Management (14)
- EIDPIM-001: Global Administrator Enumeration Info
- EIDPIM-002: All Privileged Role Assignments Info
- EIDPIM-003: Permanent Privileged Role Assignments High
- EIDPIM-004: Privileged Role Assignments to Guest Users Critical
- EIDPIM-005: Privileged Role Assignments to Synced Accounts High
- EIDPIM-006: Privileged Users Without MFA Critical
- EIDPIM-007: Privileged Users with Weak Authentication Methods High
- EIDPIM-008: Disabled Accounts in Privileged Roles High
- EIDPIM-009: Accounts Never Signed In with Active Privileged Role Medium
- EIDPIM-010: PIM Configuration Audit High
- EIDPIM-011: PIM Eligible Role Activation History Info
- EIDPIM-012: Emergency Access Account Validation Critical
- EIDPIM-013: Separate Admin Account Enforcement High
- EIDPIM-014: Privileged Role Assignment Notification Settings Medium
EIDSCA Baseline (44)
- EIDSCA-AF01: EIDSCA AF01: Authentication Method - FIDO2 security key - State Medium
- EIDSCA-AF02: EIDSCA AF02: Authentication Method - FIDO2 security key - Allow self-service set up Low
- EIDSCA-AF03: EIDSCA AF03: Authentication Method - FIDO2 security key - Enforce attestation Medium
- EIDSCA-AF04: EIDSCA AF04: Authentication Method - FIDO2 security key - Enforce key restrictions Medium
- EIDSCA-AF05: EIDSCA AF05: Authentication Method - FIDO2 security key - Restricted Low
- EIDSCA-AF06: EIDSCA AF06: Authentication Method - FIDO2 security key - Restrict specific keys Low
- EIDSCA-AG01: EIDSCA AG01: Authentication Method - General Settings - Manage migration Medium
- EIDSCA-AG02: EIDSCA AG02: Authentication Method - General Settings - Report suspicious activity - State Medium
- EIDSCA-AG03: EIDSCA AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups Medium
- EIDSCA-AM01: EIDSCA AM01: Authentication Method - Microsoft Authenticator - State Medium
- EIDSCA-AM02: EIDSCA AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP Medium
- EIDSCA-AM03: EIDSCA AM03: Authentication Method - Microsoft Authenticator - Require number matching for push notifications High
- EIDSCA-AM04: EIDSCA AM04: Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications High
- EIDSCA-AM06: EIDSCA AM06: Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications Medium
- EIDSCA-AM07: EIDSCA AM07: Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications Medium
- EIDSCA-AM09: EIDSCA AM09: Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications Low
- EIDSCA-AM10: EIDSCA AM10: Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications Low
- EIDSCA-AP01: EIDSCA AP01: Default Authorization Settings - Enabled Self service password reset for administrators High
- EIDSCA-AP04: EIDSCA AP04: Default Authorization Settings - Guest invite restrictions High
- EIDSCA-AP05: EIDSCA AP05: Default Authorization Settings - Sign-up for email based subscription Medium
- EIDSCA-AP06: EIDSCA AP06: Default Authorization Settings - User can join the tenant by email validation Medium
- EIDSCA-AP07: EIDSCA AP07: Default Authorization Settings - Guest user access High
- EIDSCA-AP08: EIDSCA AP08: Default Authorization Settings - User consent policy assigned for applications High
- EIDSCA-AP09: EIDSCA AP09: Default Authorization Settings - Allow user consent on risk-based apps High
- EIDSCA-AP10: EIDSCA AP10: Default Authorization Settings - Default User Role Permissions - Allowed to create Apps Medium
- EIDSCA-AP14: EIDSCA AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users Low
- EIDSCA-AS04: EIDSCA AS04: Authentication Method - SMS - Use for sign-in High
- EIDSCA-AT01: EIDSCA AT01: Authentication Method - Temporary Access Pass - State Low
- EIDSCA-AT02: EIDSCA AT02: Authentication Method - Temporary Access Pass - One-time Medium
- EIDSCA-AV01: EIDSCA AV01: Authentication Method - Voice call - State Medium
- EIDSCA-CP01: EIDSCA CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data High
- EIDSCA-CP03: EIDSCA CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps High
- EIDSCA-CP04: EIDSCA CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to Medium
- EIDSCA-CR01: EIDSCA CR01: Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature Medium
- EIDSCA-CR02: EIDSCA CR02: Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests Low
- EIDSCA-CR03: EIDSCA CR03: Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire Low
- EIDSCA-CR04: EIDSCA CR04: Consent Framework - Admin Consent Request - Consent request duration (days) Low
- EIDSCA-PR01: EIDSCA PR01: Default Settings - Password Rule Settings - Password Protection - Mode Medium
- EIDSCA-PR02: EIDSCA PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory Medium
- EIDSCA-PR03: EIDSCA PR03: Default Settings - Password Rule Settings - Enforce custom list High
- EIDSCA-PR05: EIDSCA PR05: Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds Medium
- EIDSCA-PR06: EIDSCA PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold High
- EIDSCA-ST08: EIDSCA ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner Medium
- EIDSCA-ST09: EIDSCA ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content High
Entra ID Tenant Configuration (16)
- EIDTNT-001: Tenant-Wide Settings Export Info
- EIDTNT-002: User Settings Review High
- EIDTNT-003: Guest User Access Restrictions High
- EIDTNT-004: Guest Invitation Restrictions Medium
- EIDTNT-005: External Collaboration Settings High
- EIDTNT-006: Azure B2B Cross-Tenant Access Policies High
- EIDTNT-007: Security Defaults Enabled/Disabled Status Critical
- EIDTNT-008: License Inventory and Utilization Info
- EIDTNT-009: Administrative Unit Configuration Info
- EIDTNT-010: Custom Domain Configuration Info
- EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs High
- EIDTNT-012: Audit Log Retention Settings High
- EIDTNT-013: Notification Settings Audit Medium
- EIDTNT-014: User Password Expiration Disabled (Passwords Never Expire) Low
- EIDTNT-015: Privileged Partner Delegated Admin Access (GDAP) High
- EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP) Medium
Intune / Endpoint Management (23)
- INTUNE-001: Device compliance policy inventory Info
- INTUNE-002: Device compliance status overview High
- INTUNE-003: Non-compliant device enumeration High
- INTUNE-004: Configuration profile inventory Info
- INTUNE-005: Configuration profile assignment analysis Medium
- INTUNE-006: Windows Update for Business ring configuration High
- INTUNE-007: BitLocker encryption policy audit High
- INTUNE-008: Windows Defender/Antivirus policy audit Critical
- INTUNE-009: Attack Surface Reduction rules configuration High
- INTUNE-010: Endpoint Detection and Response configuration Critical
- INTUNE-011: Application protection policies (MAM) High
- INTUNE-012: Conditional launch settings Medium
- INTUNE-013: Device enrollment restrictions Medium
- INTUNE-014: Autopilot configuration Info
- INTUNE-015: Disk encryption status High
- INTUNE-016: Firewall policy configuration High
- INTUNE-017: Security baselines compliance High
- INTUNE-018: PowerShell script deployment audit Critical
- INTUNE-019: Win32 app deployment security review Medium
- INTUNE-020: Device categories and grouping Info
- INTUNE-021: Remote actions audit (wipe, retire, lock) High
- INTUNE-022: OneDrive sync restrictions Medium
- INTUNE-023: Multi-admin approval for destructive device actions Critical
Unified Audit & Logging (3)
Defender for Office 365 (3)
Advanced Threat Protection (50)
- M365EXO-001: Anti-spam policy audit High
- M365EXO-002: Anti-phishing policy audit High
- M365EXO-003: Anti-malware policy audit High
- M365EXO-004: Safe Attachments policy High
- M365EXO-005: Safe Links policy High
- M365EXO-006: DKIM/DMARC/SPF validation Critical
- M365EXO-007: Auto-forwarding policy Critical
- M365EXO-008: Transport rules inventory and analysis Medium
- M365EXO-009: Mailbox auditing enabled High
- M365EXO-010: External sender warnings Medium
- M365EXO-011: OAuth/SMTP AUTH per-mailbox audit High
- M365EXO-012: Remote domains auto-forward setting High
- M365EXO-013: Automatic forwarding to external domains disabled (MS.EXO.1.1) High
- M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1) Medium
- M365EXO-015: SPF policy published for each domain (MS.EXO.2.2) Critical
- M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1) High
- M365EXO-017: DMARC policy published for each domain (MS.EXO.4.1) Critical
- M365EXO-018: DMARC enforcement set to p=reject (MS.EXO.4.2) High
- M365EXO-019: DMARC aggregate report contact configured (MS.EXO.4.3) Medium
- M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1) High
- M365EXO-021: Contact folder sharing not open to all domains (MS.EXO.6.1) Medium
- M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2) Medium
- M365EXO-023: External sender warning implemented (MS.EXO.7.1) Medium
- M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1) High
- M365EXO-025: DLP protects PII and sensitive data types (MS.EXO.8.2) High
- M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1) High
- M365EXO-027: Attachment filter assesses true file type (MS.EXO.9.2) Medium
- M365EXO-028: Disallowed attachment file types set (MS.EXO.9.3) High
- M365EXO-029: Emails scanned for malware (MS.EXO.10.1) High
- M365EXO-030: Malware emails quarantined or dropped (MS.EXO.10.2) High
- M365EXO-031: Post-delivery malware scanning enabled (MS.EXO.10.3) High
- M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1) High
- M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2) Medium
- M365EXO-034: AI-based phishing detection in use (MS.EXO.11.3) Medium
- M365EXO-035: No IP allow list in connection filter (MS.EXO.12.1) High
- M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2) Medium
- M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1) High
- M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1) High
- M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2) Medium
- M365EXO-040: No allowed domains in anti-spam policy (MS.EXO.14.3) Medium
- M365EXO-041: URL block-list comparison enabled (MS.EXO.15.1) High
- M365EXO-042: Direct download links scanned for malware (MS.EXO.15.2) High
- M365EXO-043: User click tracking enabled (MS.EXO.15.3) Medium
- M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1) High
- M365EXO-045: Alerts routed to monitored destination (MS.EXO.16.2) Medium
- M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1) High
- M365EXO-047: Purview Audit (Premium) logging enabled (MS.EXO.17.2) Medium
- M365EXO-048: Audit log retention meets minimum (MS.EXO.17.3) Medium
- M365EXO-049: Executable attachment types blocked (MS.EXO.9.5) Medium
- M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4) High
Power Platform Security (3)
SharePoint & OneDrive Security (5)
Microsoft Teams Security (8)
- M365TEAMS-001: External access settings High
- M365TEAMS-002: Guest access settings High
- M365TEAMS-003: External meeting participant settings Medium
- M365TEAMS-004: Anonymous meeting join settings High
- M365TEAMS-005: Recording and transcription policies Medium
- M365TEAMS-006: Messaging policies (external communication) Medium
- M365TEAMS-007: App permission policies Medium
- M365TEAMS-008: File sharing settings in Teams Medium
By Zero Trust pillar
Applications & Workloads (149)
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3)
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4)
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1)
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2)
- ADSCRIPT-001: NETLOGON Share Permissions
- ADSCRIPT-002: SYSVOL Share Permissions
- ADSCRIPT-003: Logon Script Inventory
- ADSCRIPT-004: Hardcoded Credentials in Scripts
- ADSCRIPT-005: LOLBins Usage in Scripts
- ADSCRIPT-006: Plaintext Passwords in Scripts
- ADSCRIPT-007: World-Writable Script Permissions
- ADSCRIPT-008: External Resource References
- ADSCRIPT-009: Malformed Scripts
- ADSCRIPT-010: UNC Paths to Non-DC Locations
- ADSCRIPT-011: Script Content Analysis
- COLLAB-001: Meet Recording Settings
- COLLAB-002: Meet External Participant Settings
- COLLAB-003: Meet Anonymous Join Settings
- COLLAB-004: Chat External Communication
- COLLAB-005: Chat History Settings
- COLLAB-006: Chat Spaces External Access
- COLLAB-007: Chat App Installation Settings
- COLLAB-008: Calendar External Sharing
- COLLAB-009: Calendar External Invitations
- COLLAB-010: Calendar Appointment Slots External Visibility
- COLLAB-011: Meet External Participant Labeling
- COLLAB-012: Meet Host Management
- EIDAPP-001: Application Registration Inventory
- EIDAPP-002: App Registrations with High-Risk API Permissions
- EIDAPP-003: App Registrations with Added Credentials
- EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials
- EIDAPP-005: Service Principals with High Privileges and Added Credentials
- EIDAPP-006: Excessive Microsoft Graph Permissions
- EIDAPP-007: App Registrations with Azure IAM Role Assignments
- EIDAPP-008: Credential Expiration Monitoring
- EIDAPP-009: Stale Application Registrations
- EIDAPP-010: Multi-Tenant Application Analysis
- EIDAPP-011: Consent Grants Analysis
- EIDAPP-012: User Consent Settings Policy
- EIDAPP-013: Admin Consent Workflow Configuration
- EIDAPP-014: Application Impersonation Role Holders
- EIDAPP-015: OAuth2 Permission Grants Review
- EIDAPP-016: Managed Identity Inventory and Permissions
- EIDAPP-017: Service Principal Sign-In Activity
- EIDAPP-018: Change Tracking on App Registrations and Service Principals
- EIDAPP-019: Dangling Reply URLs
- EMAIL-001: SPF Record Validation
- EMAIL-002: DKIM Signing Enabled
- EMAIL-003: DMARC Policy Audit
- EMAIL-004: MTA-STS Policy
- EMAIL-005: TLS Enforcement
- EMAIL-006: Email Allowlist/Blocklist Review
- EMAIL-007: Inbound Gateway Configuration
- EMAIL-008: Email Routing Rules Audit
- EMAIL-009: Auto-Forwarding Policy
- EMAIL-010: Delegate Access Settings
- EMAIL-011: POP/IMAP Access Settings
- EMAIL-012: Spam and Phishing Filter Settings
- EMAIL-013: Enhanced Pre-Delivery Message Scanning
- EMAIL-014: External Recipient Warning
- EMAIL-015: Attachment Safety Settings
- EMAIL-016: Links and External Images Protection
- EMAIL-017: Spoofing and Authentication Protection
- EMAIL-018: Compliance Rules Audit
- EMAIL-019: DLP Rules Configuration
- EMAIL-020: Gmail Confidential Mode
- EMAIL-021: S/MIME Settings
- EMAIL-022: Mail Forwarding Rule Enumeration
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1)
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1)
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1)
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1)
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join
- GWS-CLASS-003: Classroom API Data Access Restricted
- GWS-CLASS-004: Classroom Roster Import Disabled
- GWS-CLASS-005: Classroom Student Unenrollment Restricted
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users
- GWS-GEMINI-002: Gemini Alpha Features Disabled
- GWS-GEMINI-003: Gemini Conversation History Enabled
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled
- GWS-K12-003: Students Cannot Authorize Third-Party Apps
- GWS-K12-004: Vendor Delegated Access Review
- GWS-K12-006: Student Communication Boundaries
- GWS-SITES-001: Sites Service Disabled
- M365DEF-001: Preset security policy audit
- M365DEF-002: Alert policy inventory
- M365DEF-003: Threat intelligence configuration
- M365EXO-001: Anti-spam policy audit
- M365EXO-002: Anti-phishing policy audit
- M365EXO-003: Anti-malware policy audit
- M365EXO-004: Safe Attachments policy
- M365EXO-005: Safe Links policy
- M365EXO-006: DKIM/DMARC/SPF validation
- M365EXO-007: Auto-forwarding policy
- M365EXO-008: Transport rules inventory and analysis
- M365EXO-009: Mailbox auditing enabled
- M365EXO-010: External sender warnings
- M365EXO-011: OAuth/SMTP AUTH per-mailbox audit
- M365EXO-012: Remote domains auto-forward setting
- M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1)
- M365EXO-015: SPF policy published for each domain (MS.EXO.2.2)
- M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1)
- M365EXO-017: DMARC policy published for each domain (MS.EXO.4.1)
- M365EXO-018: DMARC enforcement set to p=reject (MS.EXO.4.2)
- M365EXO-019: DMARC aggregate report contact configured (MS.EXO.4.3)
- M365EXO-023: External sender warning implemented (MS.EXO.7.1)
- M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1)
- M365EXO-027: Attachment filter assesses true file type (MS.EXO.9.2)
- M365EXO-028: Disallowed attachment file types set (MS.EXO.9.3)
- M365EXO-029: Emails scanned for malware (MS.EXO.10.1)
- M365EXO-030: Malware emails quarantined or dropped (MS.EXO.10.2)
- M365EXO-031: Post-delivery malware scanning enabled (MS.EXO.10.3)
- M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1)
- M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2)
- M365EXO-034: AI-based phishing detection in use (MS.EXO.11.3)
- M365EXO-035: No IP allow list in connection filter (MS.EXO.12.1)
- M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2)
- M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1)
- M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2)
- M365EXO-040: No allowed domains in anti-spam policy (MS.EXO.14.3)
- M365EXO-041: URL block-list comparison enabled (MS.EXO.15.1)
- M365EXO-042: Direct download links scanned for malware (MS.EXO.15.2)
- M365EXO-043: User click tracking enabled (MS.EXO.15.3)
- M365EXO-049: Executable attachment types blocked (MS.EXO.9.5)
- M365PP-001: Environment creation restrictions
- M365PP-002: DLP policy configuration
- M365PP-003: Tenant isolation settings
- M365TEAMS-001: External access settings
- M365TEAMS-002: Guest access settings
- M365TEAMS-003: External meeting participant settings
- M365TEAMS-004: Anonymous meeting join settings
- M365TEAMS-005: Recording and transcription policies
- M365TEAMS-006: Messaging policies (external communication)
- M365TEAMS-007: App permission policies
- M365TEAMS-008: File sharing settings in Teams
- OAUTH-001: OAuth App Whitelist/Blocklist
- OAUTH-002: Installed OAuth Apps Inventory
- OAUTH-003: OAuth Scope Analysis
- OAUTH-004: OAuth App Risk Scoring
- OAUTH-005: Unverified App Access Policy
- OAUTH-006: API Access Control
- OAUTH-007: Marketplace App Installation Restrictions
- OAUTH-008: Domain-Wide Delegation Grants Audit
- OAUTH-009: Service Account Key Enumeration
- OAUTH-010: Connected Apps With Sensitive Scopes
Data (42)
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1)
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2)
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1)
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2)
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1)
- DRIVE-001: External Sharing Defaults
- DRIVE-002: Link Sharing Default Settings
- DRIVE-003: Anyone With the Link Sharing Audit
- DRIVE-004: Shared Drive Creation Restrictions
- DRIVE-005: Shared Drive Member Management
- DRIVE-006: Shared Drive External Sharing
- DRIVE-007: File Ownership Transfer Settings
- DRIVE-008: Drive for Desktop Allowed/Blocked
- DRIVE-009: Third-Party App Drive Access
- DRIVE-010: Drive DLP Rules Audit
- DRIVE-011: Target Audience Settings
- DRIVE-012: Drive Add-ons Settings
- DRIVE-013: Offline Access Settings
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1)
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9)
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1)
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8)
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1)
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1)
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1)
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1)
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1)
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2)
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff
- GWS-K12-002: Student External Drive Sharing Restricted
- M365EXO-013: Automatic forwarding to external domains disabled (MS.EXO.1.1)
- M365EXO-021: Contact folder sharing not open to all domains (MS.EXO.6.1)
- M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2)
- M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1)
- M365EXO-025: DLP protects PII and sensitive data types (MS.EXO.8.2)
- M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4)
- M365SPO-001: External sharing settings
- M365SPO-002: Guest access expiration
- M365SPO-003: Default sharing link type
- M365SPO-004: Site creation restrictions
- M365SPO-005: DLP policy configuration
Devices (35)
- DEVICE-001: MDM Policy Audit
- DEVICE-002: Device Approval Requirements
- DEVICE-003: Screen Lock Enforcement
- DEVICE-004: Device Encryption Requirements
- DEVICE-005: Compromised Device Blocking
- DEVICE-006: Jailbroken/Rooted Device Policy
- DEVICE-007: Chrome Browser Management
- DEVICE-008: Chrome Extension Whitelist/Blocklist
- DEVICE-009: Chrome OS Device Policies
- DEVICE-010: Endpoint Verification Settings
- DEVICE-011: Company-Owned Device Inventory
- GWS-K12-008: Managed Student Chromebook Posture
- INTUNE-001: Device compliance policy inventory
- INTUNE-002: Device compliance status overview
- INTUNE-003: Non-compliant device enumeration
- INTUNE-004: Configuration profile inventory
- INTUNE-005: Configuration profile assignment analysis
- INTUNE-006: Windows Update for Business ring configuration
- INTUNE-007: BitLocker encryption policy audit
- INTUNE-008: Windows Defender/Antivirus policy audit
- INTUNE-009: Attack Surface Reduction rules configuration
- INTUNE-010: Endpoint Detection and Response configuration
- INTUNE-011: Application protection policies (MAM)
- INTUNE-012: Conditional launch settings
- INTUNE-013: Device enrollment restrictions
- INTUNE-014: Autopilot configuration
- INTUNE-015: Disk encryption status
- INTUNE-016: Firewall policy configuration
- INTUNE-017: Security baselines compliance
- INTUNE-018: PowerShell script deployment audit
- INTUNE-019: Win32 app deployment security review
- INTUNE-020: Device categories and grouping
- INTUNE-021: Remote actions audit (wipe, retire, lock)
- INTUNE-022: OneDrive sync restrictions
- INTUNE-023: Multi-admin approval for destructive device actions
Governance (92)
- ADDOM-001: Forest Functional Level
- ADDOM-002: Domain Functional Level
- ADDOM-003: Schema Version Identification
- ADDOM-004: Domain Controller Inventory
- ADDOM-005: Obsolete OS on Domain Controllers
- ADDOM-006: FSMO Role Holder Identification
- ADDOM-007: AD Replication Health
- ADDOM-008: Tombstone Lifetime Configuration
- ADDOM-009: AD Recycle Bin Status
- ADDOM-010: Sites and Subnets Configuration
- ADDOM-011: Site Link Configuration
- ADDOM-012: DNS Zone Security
- ADDOM-013: LDAP Signing Requirements
- ADDOM-014: LDAP Channel Binding
- ADDOM-015: SMB Signing Requirements
- ADDOM-016: NTLMv1 Usage Detection
- ADDOM-017: NTLMv2 Enforcement
- ADDOM-018: Null Session Enumeration
- ADDOM-019: Print Spooler on Domain Controllers
- ADDOM-020: DSRM Password Configuration
- ADGPO-001: GPO Inventory with Link Status
- ADGPO-002: Empty GPOs
- ADGPO-003: Unlinked GPOs
- ADGPO-004: Disabled GPOs with Content
- ADGPO-005: Duplicated GPOs
- ADGPO-006: GPOs with Broken Links
- ADGPO-007: GPO Permission Inconsistencies
- ADGPO-008: GPOs Not Applied Due to WMI Filters
- ADGPO-009: GPOs with No Apply Permission
- ADGPO-010: SYSVOL/AD GPO Version Mismatch
- ADGPO-011: GPO Settings Security Analysis
- ADGPO-012: cPassword/GPP Password Detection
- ADGPO-013: Scripts in GPOs Analysis
- ADGPO-014: MSI Packages in GPOs
- ADGPO-015: Scheduled Tasks in GPOs
- ADGPO-016: Registry Settings Security Review
- ADGPO-017: Restricted Groups Analysis
- ADGPO-018: Audit Policy Configuration via GPO
- ADGPO-019: Windows Firewall Configuration via GPO
- ADGPO-020: PowerShell Execution Policy via GPO
- ADGPO-021: PowerShell Logging Configuration
- ADGPO-022: AppLocker/WDAC Policy Assessment
- ADGPO-023: LAPS GPO Configuration
- ADGPO-024: GPO WMI Filter Review
- ADMIN-001: Super Admin Account Inventory
- ADMIN-002: Admin Role Assignments Audit
- ADMIN-003: Delegated Admin Permissions Review
- ADMIN-004: Inactive/Suspended Admin Accounts
- ADMIN-005: User Account Inventory
- ADMIN-006: Stale User Accounts
- ADMIN-007: OU Structure Review
- ADMIN-008: Directory Sharing Settings
- ADMIN-009: User Profile Visibility
- ADMIN-010: Groups Settings and External Membership
- ADMIN-011: Group Creation Restrictions
- ADMIN-012: Groups for Business Settings
- ADMIN-013: Super Admin Count
- ADMIN-014: Assured Controls - Access Approvals Enabled
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled
- ADSTALE-001: Inactive User Accounts
- ADSTALE-002: Inactive Computer Accounts
- ADSTALE-003: Disabled Accounts with Group Memberships
- ADSTALE-004: Expired Passwords Not Disabled
- ADSTALE-005: Obsolete OS Computers
- ADSTALE-006: Unsupported OS Versions
- ADSTALE-007: Orphaned Foreign Security Principals
- ADSTALE-008: Orphaned SID History
- ADSTALE-009: Abandoned OUs
- ADSTALE-010: Printer Objects
- ADSTALE-011: DNS Record Staleness
- AIAGENT-003: Published Copilot agents are maintained (not dormant)
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1)
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1)
- EIDGOV-001: Access-package assignment policies require approval
- EIDGOV-002: Access-package assignment policies enforce access reviews
- EIDGOV-005: Access-package catalog external visibility reviewed
- EIDTNT-001: Tenant-Wide Settings Export
- EIDTNT-002: User Settings Review
- EIDTNT-003: Guest User Access Restrictions
- EIDTNT-004: Guest Invitation Restrictions
- EIDTNT-005: External Collaboration Settings
- EIDTNT-006: Azure B2B Cross-Tenant Access Policies
- EIDTNT-007: Security Defaults Enabled/Disabled Status
- EIDTNT-008: License Inventory and Utilization
- EIDTNT-009: Administrative Unit Configuration
- EIDTNT-010: Custom Domain Configuration
- EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs
- EIDTNT-012: Audit Log Retention Settings
- EIDTNT-013: Notification Settings Audit
- EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP)
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1)
Identity (274)
- ADACL-001: Critical Object ACL Audit
- ADACL-002: GenericAll Permissions on Critical Objects
- ADACL-003: GenericWrite Permissions on Critical Objects
- ADACL-004: WriteDACL Permissions on Critical Objects
- ADACL-005: WriteOwner Permissions on Critical Objects
- ADACL-006: ForceChangePassword Rights
- ADACL-007: Excessive Delegation to Broad Groups
- ADACL-008: OU Delegation Analysis
- ADACL-009: Machine Account Quota
- ADACL-010: Extended Rights Audit
- ADACL-011: Ownership of Critical Objects
- ADACL-012: Non-Default Domain Root Permissions
- ADACL-013: GPO Link Permissions
- ADACL-014: GPO Edit Permissions
- ADACL-015: Shadow Admins Detection
- ADACL-016: Attack Path Enumeration
- ADCS-001: CA Server Inventory
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name
- ADCS-003: ESC2 - Any Purpose Extended Key Usage
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag
- ADCS-010: ESC7 - Vulnerable CA ACLs
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints
- ADCS-012: ESC9 - No Security Extension
- ADCS-013: ESC11 - RPC Relay Without Encryption
- ADCS-014: ESC13 - Issuance Policy OID Group Link
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates
- ADCS-016: ESC16 - UPN SAN Misconfiguration
- ADCS-017: EKEUwu - Extended Key Usage Abuse
- ADCS-018: CA Auditing Configuration
- ADCS-019: Certificate Template Enumeration
- ADKERB-001: Kerberoastable Accounts
- ADKERB-002: Kerberoastable with Weak Encryption
- ADKERB-003: AS-REP Roastable Accounts
- ADKERB-004: Unconstrained Delegation - Computers
- ADKERB-005: Unconstrained Delegation - Users
- ADKERB-006: Constrained Delegation Analysis
- ADKERB-007: Resource-Based Constrained Delegation
- ADKERB-008: Protocol Transition Abuse Paths
- ADKERB-009: Kerberos Encryption Types
- ADKERB-010: Kerberos Ticket Lifetime
- ADKERB-011: Computer SPN Audit
- ADPATH-001: Escalation Paths to Tier-0
- ADPATH-002: Transitive Escalation Chains to Tier-0
- ADPRIV-001: Domain Admins Enumeration
- ADPRIV-002: Enterprise Admins Enumeration
- ADPRIV-003: Schema Admins Enumeration
- ADPRIV-004: Account Operators Enumeration
- ADPRIV-005: Server Operators Enumeration
- ADPRIV-006: Backup Operators Enumeration
- ADPRIV-007: Print Operators Enumeration
- ADPRIV-008: DnsAdmins Group Membership
- ADPRIV-009: Nested Group Membership Analysis
- ADPRIV-010: Privileged Users Password Never Expires
- ADPRIV-011: Privileged Users Password Not Required
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth
- ADPRIV-013: Privileged Users Reversible Encryption
- ADPRIV-014: Privileged Users DES-Only Kerberos
- ADPRIV-015: Privileged Accounts No MFA Indicator
- ADPRIV-016: Privileged Accounts Weak Passwords
- ADPRIV-017: Privileged Accounts Old Passwords
- ADPRIV-018: Privileged Accounts Never Logged In
- ADPRIV-019: Disabled Accounts in Privileged Groups
- ADPRIV-020: AdminSDHolder Protected Object Audit
- ADPRIV-021: AdminCount Orphans
- ADPRIV-022: krbtgt Password Age
- ADPRIV-023: krbtgt Account Exposure Assessment
- ADPRIV-024: Service Accounts in Privileged Groups
- ADPRIV-025: Computer Accounts in Privileged Groups
- ADPRIV-026: Privileged Users Local Logon on DCs
- ADPRIV-027: Privileged Users RDP on DCs
- ADPRIV-028: Users with DCSync Rights
- ADPRIV-029: Protected Users Group Audit
- ADPRIV-030: Privileged Users Not in Protected Users
- ADPWD-001: Default Domain Password Policy
- ADPWD-002: Fine-Grained Password Policy Enumeration
- ADPWD-003: FGPP Application Analysis
- ADPWD-004: Minimum Password Length
- ADPWD-005: Password Complexity Requirement
- ADPWD-006: Account Lockout Policy
- ADPWD-007: Password History Enforcement
- ADPWD-008: Maximum Password Age
- ADPWD-009: Users with Password Never Expires
- ADPWD-010: Users with Blank Passwords
- ADPWD-011: Duplicate Password Hashes
- ADPWD-012: Passwords in HaveIBeenPwned Database
- ADPWD-013: Custom Dictionary Password Check
- ADPWD-014: Default/Common Passwords
- ADPWD-015: Password Last Set Age Distribution
- ADPWD-016: LAPS Deployment Status
- ADPWD-017: LAPS Password Expiration
- ADPWD-018: Windows LAPS vs Legacy LAPS
- ADPWD-019: Azure AD Password Protection
- ADPWD-020: BitLocker Recovery Keys in AD
- ADPWD-021: Account Lockout Threshold
- ADPWD-022: Lockout Observation Window
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit
- ADTIER-002: Backup Software Service Accounts in Privileged Groups
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership
- ADTRADE-009: Cert Publishers Group Membership
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure
- ADTRUST-001: Trust Relationships Enumeration
- ADTRUST-002: Trust Direction Analysis
- ADTRUST-003: Trust Transitivity Analysis
- ADTRUST-004: SID Filtering Status
- ADTRUST-005: SID History Abuse Detection
- ADTRUST-006: Selective Authentication Status
- ADTRUST-007: Azure AD Hybrid Trust Security
- ADTRUST-008: Foreign Domain Trust Enumeration
- ADTRUST-009: Orphaned Trust Detection
- ADTRUST-010: Trust Key Age and Rotation
- ADTRUST-011: Trust Hierarchy Visualization
- AIAGENT-001: Copilot agents restrict who can interact (no broad access)
- AIAGENT-002: Copilot agents require authentication
- AIAGENT-004: Copilot agent access is scoped to security groups
- AUTH-001: 2SV Enforcement
- AUTH-002: 2SV Enrollment Rate
- AUTH-003: 2SV Method Strength
- AUTH-004: Password Minimum Length
- AUTH-005: Password Reuse Restriction
- AUTH-006: Session Duration
- AUTH-007: SSO Configuration
- AUTH-008: Less Secure Apps Access
- AUTH-009: App Passwords Policy
- AUTH-010: Recovery Options Configuration
- AUTH-011: Login Challenge Settings
- AUTH-012: Super Admin 2SV Enrollment
- AUTH-013: Stale Super Admin Accounts
- AUTH-014: 2SV Enrollment Allowed
- AUTH-015: 2SV Enrollment Grace Period
- AUTH-016: Advanced Protection Self-Enrollment
- AUTH-017: Super Admin Account Self-Recovery
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2)
- AZIAM-001: Subscription-level role assignments audit
- AZIAM-002: Users with Azure IAM roles directly on resources
- AZIAM-003: Resource group permission analysis
- AZIAM-004: Azure Key Vault access policy audit
- AZIAM-005: Storage account security settings
- AZIAM-006: Network Security Group rules audit
- AZIAM-007: Azure Policy compliance status
- AZIAM-008: Management group structure review
- AZIAM-009: Custom RBAC role definitions
- AZIAM-010: Resource locks configuration
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1)
- EIDAPP-020: Group Owner Consent to Applications Blocked
- EIDAUTH-001: Authentication Methods Policy Audit
- EIDAUTH-002: MFA Registration Status for All Users
- EIDAUTH-003: MFA Method Distribution Analysis
- EIDAUTH-004: Users with Only SMS/Voice MFA Methods
- EIDAUTH-005: Users with No MFA Methods Registered
- EIDAUTH-006: FIDO2 Security Key Inventory and Audit
- EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check
- EIDAUTH-008: Passwordless Authentication Readiness
- EIDAUTH-009: Windows Hello for Business Configuration
- EIDAUTH-010: Temporary Access Pass (TAP) Policy Audit
- EIDAUTH-011: Self-Service Password Reset (SSPR) Configuration
- EIDAUTH-012: SSPR Methods and Requirements
- EIDAUTH-013: Password Protection (Banned Passwords) Configuration
- EIDAUTH-014: Custom Banned Password List Status
- EIDAUTH-015: Legacy Authentication Protocol Usage
- EIDAUTH-016: ROPC (Resource Owner Password Credentials) Flow Enabled
- EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection
- EIDAUTH-018: Microsoft Authenticator Login Context (Application Name and Location)
- EIDCA-001: Full CA Policy Inventory
- EIDCA-002: CA Policy Coverage Gap Analysis
- EIDCA-003: CA Policies in Report-Only Mode
- EIDCA-004: CA Exclusion Group Analysis
- EIDCA-005: Unprotected Groups in CA Exclusions
- EIDCA-006: Break-Glass Account CA Exclusion Validation
- EIDCA-007: MFA Enforcement via Conditional Access
- EIDCA-008: Legacy Authentication Blocking via CA
- EIDCA-009: Device Compliance Requirement in CA
- EIDCA-010: Location-Based CA Policies Audit
- EIDCA-011: Named Locations Configuration Review
- EIDCA-012: Sign-In Risk-Based CA Policies
- EIDCA-013: User Risk-Based CA Policies
- EIDCA-014: Session Controls Audit
- EIDCA-015: CA What-If Simulation for Attack Scenarios
- EIDCA-016: CA Policy Documentation Export
- EIDCA-017: High-Risk User Notification to Administrators
- EIDCA-018: Managed Device Required for MFA Registration
- EIDFED-001: Federated Domain Enumeration
- EIDFED-002: Federation Signing Certificate Validity Period
- EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch
- EIDFED-004: Federation Trust Metadata Analysis
- EIDFED-005: Azure AD Connect Configuration Review
- EIDFED-006: Azure AD Connect Sync Scope Audit
- EIDFED-007: Password Hash Sync Enabled Status
- EIDFED-008: Pass-Through Authentication Agent Status
- EIDFED-009: AD FS Server Configuration Assessment
- EIDFED-010: AD FS Extranet Lockout Settings
- EIDFED-011: Hybrid Join Configuration
- EIDFED-012: Cloud-Only vs Synced Account Analysis
- EIDFED-013: Entra Connect Sync-Client Version Currency
- EIDGOV-003: Access-package assignments are time-bound
- EIDGOV-004: External access-package eligibility is controlled
- EIDPIM-001: Global Administrator Enumeration
- EIDPIM-002: All Privileged Role Assignments
- EIDPIM-003: Permanent Privileged Role Assignments
- EIDPIM-004: Privileged Role Assignments to Guest Users
- EIDPIM-005: Privileged Role Assignments to Synced Accounts
- EIDPIM-006: Privileged Users Without MFA
- EIDPIM-007: Privileged Users with Weak Authentication Methods
- EIDPIM-008: Disabled Accounts in Privileged Roles
- EIDPIM-009: Accounts Never Signed In with Active Privileged Role
- EIDPIM-010: PIM Configuration Audit
- EIDPIM-011: PIM Eligible Role Activation History
- EIDPIM-012: Emergency Access Account Validation
- EIDPIM-013: Separate Admin Account Enforcement
- EIDPIM-014: Privileged Role Assignment Notification Settings
- EIDSCA-AF01: EIDSCA AF01: Authentication Method - FIDO2 security key - State
- EIDSCA-AF02: EIDSCA AF02: Authentication Method - FIDO2 security key - Allow self-service set up
- EIDSCA-AF03: EIDSCA AF03: Authentication Method - FIDO2 security key - Enforce attestation
- EIDSCA-AF04: EIDSCA AF04: Authentication Method - FIDO2 security key - Enforce key restrictions
- EIDSCA-AF05: EIDSCA AF05: Authentication Method - FIDO2 security key - Restricted
- EIDSCA-AF06: EIDSCA AF06: Authentication Method - FIDO2 security key - Restrict specific keys
- EIDSCA-AG01: EIDSCA AG01: Authentication Method - General Settings - Manage migration
- EIDSCA-AG02: EIDSCA AG02: Authentication Method - General Settings - Report suspicious activity - State
- EIDSCA-AG03: EIDSCA AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups
- EIDSCA-AM01: EIDSCA AM01: Authentication Method - Microsoft Authenticator - State
- EIDSCA-AM02: EIDSCA AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP
- EIDSCA-AM03: EIDSCA AM03: Authentication Method - Microsoft Authenticator - Require number matching for push notifications
- EIDSCA-AM04: EIDSCA AM04: Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications
- EIDSCA-AM06: EIDSCA AM06: Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications
- EIDSCA-AM07: EIDSCA AM07: Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications
- EIDSCA-AM09: EIDSCA AM09: Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications
- EIDSCA-AM10: EIDSCA AM10: Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications
- EIDSCA-AP01: EIDSCA AP01: Default Authorization Settings - Enabled Self service password reset for administrators
- EIDSCA-AP04: EIDSCA AP04: Default Authorization Settings - Guest invite restrictions
- EIDSCA-AP05: EIDSCA AP05: Default Authorization Settings - Sign-up for email based subscription
- EIDSCA-AP06: EIDSCA AP06: Default Authorization Settings - User can join the tenant by email validation
- EIDSCA-AP07: EIDSCA AP07: Default Authorization Settings - Guest user access
- EIDSCA-AP08: EIDSCA AP08: Default Authorization Settings - User consent policy assigned for applications
- EIDSCA-AP09: EIDSCA AP09: Default Authorization Settings - Allow user consent on risk-based apps
- EIDSCA-AP10: EIDSCA AP10: Default Authorization Settings - Default User Role Permissions - Allowed to create Apps
- EIDSCA-AP14: EIDSCA AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users
- EIDSCA-AS04: EIDSCA AS04: Authentication Method - SMS - Use for sign-in
- EIDSCA-AT01: EIDSCA AT01: Authentication Method - Temporary Access Pass - State
- EIDSCA-AT02: EIDSCA AT02: Authentication Method - Temporary Access Pass - One-time
- EIDSCA-AV01: EIDSCA AV01: Authentication Method - Voice call - State
- EIDSCA-CP01: EIDSCA CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data
- EIDSCA-CP03: EIDSCA CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps
- EIDSCA-CP04: EIDSCA CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to
- EIDSCA-CR01: EIDSCA CR01: Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature
- EIDSCA-CR02: EIDSCA CR02: Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests
- EIDSCA-CR03: EIDSCA CR03: Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire
- EIDSCA-CR04: EIDSCA CR04: Consent Framework - Admin Consent Request - Consent request duration (days)
- EIDSCA-PR01: EIDSCA PR01: Default Settings - Password Rule Settings - Password Protection - Mode
- EIDSCA-PR02: EIDSCA PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory
- EIDSCA-PR03: EIDSCA PR03: Default Settings - Password Rule Settings - Enforce custom list
- EIDSCA-PR05: EIDSCA PR05: Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds
- EIDSCA-PR06: EIDSCA PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold
- EIDSCA-ST08: EIDSCA ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner
- EIDSCA-ST09: EIDSCA ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content
- EIDTNT-014: User Password Expiration Disabled (Passwords Never Expire)
- EIDTNT-015: Privileged Partner Delegated Admin Access (GDAP)
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1)
- GWS-K12-005: Delegated Admin Least Privilege
- GWS-K12-007: Guardian Access Integrity
- GWS-K12-009: Departed Student Account Disposition
- GWS-K12-010: Student Account Security Floor
- M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1)
Networks (10)
- ADNET-001: LDAP Signing Required on Domain Controllers
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers
- ADNET-003: SMB Server Signing Required (Domain Policy)
- ADNET-004: SMB Client Signing Required (Domain Policy)
- ADNET-005: LLMNR Disabled by Domain Policy
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed
- ADNET-007: IPv6 mitm6 Mitigation Posture
- ADNET-008: WPAD Auto-Discovery Disabled
- ADNET-009: Print Spooler Service on Domain Controllers
- ADNET-010: WebClient Service Default State on Workstations
Visibility & Analytics (34)
- ADLOG-001: Advanced Audit Policy Configured
- ADLOG-002: PowerShell Script Block Logging Enabled
- ADLOG-003: PowerShell Module Logging Enabled
- ADLOG-004: Process Creation Auditing with Command Line
- ADLOG-005: Microsoft Defender Tamper Protection Policy
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager
- ADLOG-007: Sysmon Deployment Indicator
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers)
- ADTRADE-003: Stale BitLocker Recovery Keys
- ADTRADE-004: RODC Password Replication Policy Hygiene
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1)
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure
- GTRADE-002: Internet-Readable Google Groups
- GTRADE-003: Open-Join / External-Member Groups
- GTRADE-004: Super-Admin Sprawl
- GTRADE-005: Super-Admin-Equivalent Custom Roles
- GTRADE-006: Persistent / Over-Scoped OAuth Grants
- LOG-001: Audit Log Retention Settings
- LOG-002: Alert Center Rules Inventory
- LOG-003: Activity Rules Coverage Analysis
- LOG-004: Data Export Settings
- LOG-005: Admin Email Alerts Configuration
- LOG-006: Reporting API Access
- M365AUDIT-001: Unified Audit Log enabled
- M365AUDIT-002: Audit log retention policy
- M365AUDIT-003: Audit log search capability
- M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1)
- M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1)
- M365EXO-045: Alerts routed to monitored destination (MS.EXO.16.2)
- M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1)
- M365EXO-047: Purview Audit (Premium) logging enabled (MS.EXO.17.2)
- M365EXO-048: Audit log retention meets minimum (MS.EXO.17.3)