Entra ID / M365
Entra ID, Azure, Intune, and Microsoft 365: conditional access, EIDSCA, Exchange Online, SharePoint, Teams, applications, and governance.
- Command
Invoke-EntraAudit- checks
- 257
- Check families
- 17
| Family | Checks |
|---|---|
| Advanced Threat Protection | 50 |
| AI Agent Governance | 4 |
| Azure IAM & Resource Security | 10 |
| Consent | 20 |
| Defender for Office 365 | 3 |
| EIDSCA Baseline | 44 |
| Entitlement Management | 5 |
| Entra ID Authentication Methods & MFA | 18 |
| Entra ID Conditional Access | 18 |
| Entra ID Federation & Hybrid Identity | 13 |
| Entra ID Privileged Identity Management | 14 |
| Entra ID Tenant Configuration | 16 |
| Intune / Endpoint Management | 23 |
| Microsoft Teams Security | 8 |
| Power Platform Security | 3 |
| SharePoint & OneDrive Security | 5 |
| Unified Audit & Logging | 3 |
Advanced Threat Protection (50)
- M365EXO-001: Anti-spam policy audit High
- M365EXO-002: Anti-phishing policy audit High
- M365EXO-003: Anti-malware policy audit High
- M365EXO-004: Safe Attachments policy High
- M365EXO-005: Safe Links policy High
- M365EXO-006: DKIM/DMARC/SPF validation Critical
- M365EXO-007: Auto-forwarding policy Critical
- M365EXO-008: Transport rules inventory and analysis Medium
- M365EXO-009: Mailbox auditing enabled High
- M365EXO-010: External sender warnings Medium
- M365EXO-011: OAuth/SMTP AUTH per-mailbox audit High
- M365EXO-012: Remote domains auto-forward setting High
- M365EXO-013: Automatic forwarding to external domains disabled (MS.EXO.1.1) High
- M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1) Medium
- M365EXO-015: SPF policy published for each domain (MS.EXO.2.2) Critical
- M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1) High
- M365EXO-017: DMARC policy published for each domain (MS.EXO.4.1) Critical
- M365EXO-018: DMARC enforcement set to p=reject (MS.EXO.4.2) High
- M365EXO-019: DMARC aggregate report contact configured (MS.EXO.4.3) Medium
- M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1) High
- M365EXO-021: Contact folder sharing not open to all domains (MS.EXO.6.1) Medium
- M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2) Medium
- M365EXO-023: External sender warning implemented (MS.EXO.7.1) Medium
- M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1) High
- M365EXO-025: DLP protects PII and sensitive data types (MS.EXO.8.2) High
- M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1) High
- M365EXO-027: Attachment filter assesses true file type (MS.EXO.9.2) Medium
- M365EXO-028: Disallowed attachment file types set (MS.EXO.9.3) High
- M365EXO-029: Emails scanned for malware (MS.EXO.10.1) High
- M365EXO-030: Malware emails quarantined or dropped (MS.EXO.10.2) High
- M365EXO-031: Post-delivery malware scanning enabled (MS.EXO.10.3) High
- M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1) High
- M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2) Medium
- M365EXO-034: AI-based phishing detection in use (MS.EXO.11.3) Medium
- M365EXO-035: No IP allow list in connection filter (MS.EXO.12.1) High
- M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2) Medium
- M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1) High
- M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1) High
- M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2) Medium
- M365EXO-040: No allowed domains in anti-spam policy (MS.EXO.14.3) Medium
- M365EXO-041: URL block-list comparison enabled (MS.EXO.15.1) High
- M365EXO-042: Direct download links scanned for malware (MS.EXO.15.2) High
- M365EXO-043: User click tracking enabled (MS.EXO.15.3) Medium
- M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1) High
- M365EXO-045: Alerts routed to monitored destination (MS.EXO.16.2) Medium
- M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1) High
- M365EXO-047: Purview Audit (Premium) logging enabled (MS.EXO.17.2) Medium
- M365EXO-048: Audit log retention meets minimum (MS.EXO.17.3) Medium
- M365EXO-049: Executable attachment types blocked (MS.EXO.9.5) Medium
- M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4) High
AI Agent Governance (4)
Azure IAM & Resource Security (10)
- AZIAM-001: Subscription-level role assignments audit High
- AZIAM-002: Users with Azure IAM roles directly on resources Medium
- AZIAM-003: Resource group permission analysis Medium
- AZIAM-004: Azure Key Vault access policy audit High
- AZIAM-005: Storage account security settings High
- AZIAM-006: Network Security Group rules audit High
- AZIAM-007: Azure Policy compliance status Medium
- AZIAM-008: Management group structure review Info
- AZIAM-009: Custom RBAC role definitions Medium
- AZIAM-010: Resource locks configuration Medium
Consent (20)
- EIDAPP-001: Application Registration Inventory Info
- EIDAPP-002: App Registrations with High-Risk API Permissions Critical
- EIDAPP-003: App Registrations with Added Credentials High
- EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials Critical
- EIDAPP-005: Service Principals with High Privileges and Added Credentials Critical
- EIDAPP-006: Excessive Microsoft Graph Permissions High
- EIDAPP-007: App Registrations with Azure IAM Role Assignments High
- EIDAPP-008: Credential Expiration Monitoring Medium
- EIDAPP-009: Stale Application Registrations Medium
- EIDAPP-010: Multi-Tenant Application Analysis Medium
- EIDAPP-011: Consent Grants Analysis High
- EIDAPP-012: User Consent Settings Policy High
- EIDAPP-013: Admin Consent Workflow Configuration Medium
- EIDAPP-014: Application Impersonation Role Holders Critical
- EIDAPP-015: OAuth2 Permission Grants Review High
- EIDAPP-016: Managed Identity Inventory and Permissions Info
- EIDAPP-017: Service Principal Sign-In Activity Info
- EIDAPP-018: Change Tracking on App Registrations and Service Principals Medium
- EIDAPP-019: Dangling Reply URLs High
- EIDAPP-020: Group Owner Consent to Applications Blocked Medium
Defender for Office 365 (3)
EIDSCA Baseline (44)
- EIDSCA-AF01: EIDSCA AF01: Authentication Method - FIDO2 security key - State Medium
- EIDSCA-AF02: EIDSCA AF02: Authentication Method - FIDO2 security key - Allow self-service set up Low
- EIDSCA-AF03: EIDSCA AF03: Authentication Method - FIDO2 security key - Enforce attestation Medium
- EIDSCA-AF04: EIDSCA AF04: Authentication Method - FIDO2 security key - Enforce key restrictions Medium
- EIDSCA-AF05: EIDSCA AF05: Authentication Method - FIDO2 security key - Restricted Low
- EIDSCA-AF06: EIDSCA AF06: Authentication Method - FIDO2 security key - Restrict specific keys Low
- EIDSCA-AG01: EIDSCA AG01: Authentication Method - General Settings - Manage migration Medium
- EIDSCA-AG02: EIDSCA AG02: Authentication Method - General Settings - Report suspicious activity - State Medium
- EIDSCA-AG03: EIDSCA AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups Medium
- EIDSCA-AM01: EIDSCA AM01: Authentication Method - Microsoft Authenticator - State Medium
- EIDSCA-AM02: EIDSCA AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP Medium
- EIDSCA-AM03: EIDSCA AM03: Authentication Method - Microsoft Authenticator - Require number matching for push notifications High
- EIDSCA-AM04: EIDSCA AM04: Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications High
- EIDSCA-AM06: EIDSCA AM06: Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications Medium
- EIDSCA-AM07: EIDSCA AM07: Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications Medium
- EIDSCA-AM09: EIDSCA AM09: Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications Low
- EIDSCA-AM10: EIDSCA AM10: Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications Low
- EIDSCA-AP01: EIDSCA AP01: Default Authorization Settings - Enabled Self service password reset for administrators High
- EIDSCA-AP04: EIDSCA AP04: Default Authorization Settings - Guest invite restrictions High
- EIDSCA-AP05: EIDSCA AP05: Default Authorization Settings - Sign-up for email based subscription Medium
- EIDSCA-AP06: EIDSCA AP06: Default Authorization Settings - User can join the tenant by email validation Medium
- EIDSCA-AP07: EIDSCA AP07: Default Authorization Settings - Guest user access High
- EIDSCA-AP08: EIDSCA AP08: Default Authorization Settings - User consent policy assigned for applications High
- EIDSCA-AP09: EIDSCA AP09: Default Authorization Settings - Allow user consent on risk-based apps High
- EIDSCA-AP10: EIDSCA AP10: Default Authorization Settings - Default User Role Permissions - Allowed to create Apps Medium
- EIDSCA-AP14: EIDSCA AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users Low
- EIDSCA-AS04: EIDSCA AS04: Authentication Method - SMS - Use for sign-in High
- EIDSCA-AT01: EIDSCA AT01: Authentication Method - Temporary Access Pass - State Low
- EIDSCA-AT02: EIDSCA AT02: Authentication Method - Temporary Access Pass - One-time Medium
- EIDSCA-AV01: EIDSCA AV01: Authentication Method - Voice call - State Medium
- EIDSCA-CP01: EIDSCA CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data High
- EIDSCA-CP03: EIDSCA CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps High
- EIDSCA-CP04: EIDSCA CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to Medium
- EIDSCA-CR01: EIDSCA CR01: Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature Medium
- EIDSCA-CR02: EIDSCA CR02: Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests Low
- EIDSCA-CR03: EIDSCA CR03: Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire Low
- EIDSCA-CR04: EIDSCA CR04: Consent Framework - Admin Consent Request - Consent request duration (days) Low
- EIDSCA-PR01: EIDSCA PR01: Default Settings - Password Rule Settings - Password Protection - Mode Medium
- EIDSCA-PR02: EIDSCA PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory Medium
- EIDSCA-PR03: EIDSCA PR03: Default Settings - Password Rule Settings - Enforce custom list High
- EIDSCA-PR05: EIDSCA PR05: Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds Medium
- EIDSCA-PR06: EIDSCA PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold High
- EIDSCA-ST08: EIDSCA ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner Medium
- EIDSCA-ST09: EIDSCA ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content High
Entitlement Management (5)
- EIDGOV-001: Access-package assignment policies require approval Medium
- EIDGOV-002: Access-package assignment policies enforce access reviews Medium
- EIDGOV-003: Access-package assignments are time-bound Low
- EIDGOV-004: External access-package eligibility is controlled High
- EIDGOV-005: Access-package catalog external visibility reviewed Low
Entra ID Authentication Methods & MFA (18)
- EIDAUTH-001: Authentication Methods Policy Audit Info
- EIDAUTH-002: MFA Registration Status for All Users Critical
- EIDAUTH-003: MFA Method Distribution Analysis Info
- EIDAUTH-004: Users with Only SMS/Voice MFA Methods High
- EIDAUTH-005: Users with No MFA Methods Registered Critical
- EIDAUTH-006: FIDO2 Security Key Inventory and Audit Info
- EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check Critical
- EIDAUTH-008: Passwordless Authentication Readiness Medium
- EIDAUTH-009: Windows Hello for Business Configuration Medium
- EIDAUTH-010: Temporary Access Pass (TAP) Policy Audit Medium
- EIDAUTH-011: Self-Service Password Reset (SSPR) Configuration High
- EIDAUTH-012: SSPR Methods and Requirements Medium
- EIDAUTH-013: Password Protection (Banned Passwords) Configuration High
- EIDAUTH-014: Custom Banned Password List Status Medium
- EIDAUTH-015: Legacy Authentication Protocol Usage High
- EIDAUTH-016: ROPC (Resource Owner Password Credentials) Flow Enabled High
- EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection Medium
- EIDAUTH-018: Microsoft Authenticator Login Context (Application Name and Location) Medium
Entra ID Conditional Access (18)
- EIDCA-001: Full CA Policy Inventory Info
- EIDCA-002: CA Policy Coverage Gap Analysis High
- EIDCA-003: CA Policies in Report-Only Mode Medium
- EIDCA-004: CA Exclusion Group Analysis High
- EIDCA-005: Unprotected Groups in CA Exclusions High
- EIDCA-006: Break-Glass Account CA Exclusion Validation Critical
- EIDCA-007: MFA Enforcement via Conditional Access Critical
- EIDCA-008: Legacy Authentication Blocking via CA Critical
- EIDCA-009: Device Compliance Requirement in CA High
- EIDCA-010: Location-Based CA Policies Audit Medium
- EIDCA-011: Named Locations Configuration Review Medium
- EIDCA-012: Sign-In Risk-Based CA Policies High
- EIDCA-013: User Risk-Based CA Policies High
- EIDCA-014: Session Controls Audit Medium
- EIDCA-015: CA What-If Simulation for Attack Scenarios Info
- EIDCA-016: CA Policy Documentation Export Info
- EIDCA-017: High-Risk User Notification to Administrators Medium
- EIDCA-018: Managed Device Required for MFA Registration Medium
Entra ID Federation & Hybrid Identity (13)
- EIDFED-001: Federated Domain Enumeration Info
- EIDFED-002: Federation Signing Certificate Validity Period High
- EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch Critical
- EIDFED-004: Federation Trust Metadata Analysis High
- EIDFED-005: Azure AD Connect Configuration Review High
- EIDFED-006: Azure AD Connect Sync Scope Audit Medium
- EIDFED-007: Password Hash Sync Enabled Status Medium
- EIDFED-008: Pass-Through Authentication Agent Status Medium
- EIDFED-009: AD FS Server Configuration Assessment High
- EIDFED-010: AD FS Extranet Lockout Settings Medium
- EIDFED-011: Hybrid Join Configuration Medium
- EIDFED-012: Cloud-Only vs Synced Account Analysis Info
- EIDFED-013: Entra Connect Sync-Client Version Currency High
Entra ID Privileged Identity Management (14)
- EIDPIM-001: Global Administrator Enumeration Info
- EIDPIM-002: All Privileged Role Assignments Info
- EIDPIM-003: Permanent Privileged Role Assignments High
- EIDPIM-004: Privileged Role Assignments to Guest Users Critical
- EIDPIM-005: Privileged Role Assignments to Synced Accounts High
- EIDPIM-006: Privileged Users Without MFA Critical
- EIDPIM-007: Privileged Users with Weak Authentication Methods High
- EIDPIM-008: Disabled Accounts in Privileged Roles High
- EIDPIM-009: Accounts Never Signed In with Active Privileged Role Medium
- EIDPIM-010: PIM Configuration Audit High
- EIDPIM-011: PIM Eligible Role Activation History Info
- EIDPIM-012: Emergency Access Account Validation Critical
- EIDPIM-013: Separate Admin Account Enforcement High
- EIDPIM-014: Privileged Role Assignment Notification Settings Medium
Entra ID Tenant Configuration (16)
- EIDTNT-001: Tenant-Wide Settings Export Info
- EIDTNT-002: User Settings Review High
- EIDTNT-003: Guest User Access Restrictions High
- EIDTNT-004: Guest Invitation Restrictions Medium
- EIDTNT-005: External Collaboration Settings High
- EIDTNT-006: Azure B2B Cross-Tenant Access Policies High
- EIDTNT-007: Security Defaults Enabled/Disabled Status Critical
- EIDTNT-008: License Inventory and Utilization Info
- EIDTNT-009: Administrative Unit Configuration Info
- EIDTNT-010: Custom Domain Configuration Info
- EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs High
- EIDTNT-012: Audit Log Retention Settings High
- EIDTNT-013: Notification Settings Audit Medium
- EIDTNT-014: User Password Expiration Disabled (Passwords Never Expire) Low
- EIDTNT-015: Privileged Partner Delegated Admin Access (GDAP) High
- EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP) Medium
Intune / Endpoint Management (23)
- INTUNE-001: Device compliance policy inventory Info
- INTUNE-002: Device compliance status overview High
- INTUNE-003: Non-compliant device enumeration High
- INTUNE-004: Configuration profile inventory Info
- INTUNE-005: Configuration profile assignment analysis Medium
- INTUNE-006: Windows Update for Business ring configuration High
- INTUNE-007: BitLocker encryption policy audit High
- INTUNE-008: Windows Defender/Antivirus policy audit Critical
- INTUNE-009: Attack Surface Reduction rules configuration High
- INTUNE-010: Endpoint Detection and Response configuration Critical
- INTUNE-011: Application protection policies (MAM) High
- INTUNE-012: Conditional launch settings Medium
- INTUNE-013: Device enrollment restrictions Medium
- INTUNE-014: Autopilot configuration Info
- INTUNE-015: Disk encryption status High
- INTUNE-016: Firewall policy configuration High
- INTUNE-017: Security baselines compliance High
- INTUNE-018: PowerShell script deployment audit Critical
- INTUNE-019: Win32 app deployment security review Medium
- INTUNE-020: Device categories and grouping Info
- INTUNE-021: Remote actions audit (wipe, retire, lock) High
- INTUNE-022: OneDrive sync restrictions Medium
- INTUNE-023: Multi-admin approval for destructive device actions Critical
Microsoft Teams Security (8)
- M365TEAMS-001: External access settings High
- M365TEAMS-002: Guest access settings High
- M365TEAMS-003: External meeting participant settings Medium
- M365TEAMS-004: Anonymous meeting join settings High
- M365TEAMS-005: Recording and transcription policies Medium
- M365TEAMS-006: Messaging policies (external communication) Medium
- M365TEAMS-007: App permission policies Medium
- M365TEAMS-008: File sharing settings in Teams Medium