From d6a370ffcf9b5e3b86b17776460246e1acdd5751 Mon Sep 17 00:00:00 2001 From: Ashir Wahid Date: Wed, 12 Aug 2026 11:57:27 +0200 Subject: [PATCH] updated baseline to 7.0 --- .../AadIam/GroupSettings/Configuration.json | 4 + .../PasswordResetPolicies/Configuration.json | 2 +- .../CIS L2 Attachment Policy.json | 2 + .../MalwareFilterPolicy/Default.json | 2 + .../OwaMailboxPolicy-Default.json | 2 +- ...re authentication transfer is blocked.json | 43 ++ ...hentication is required for all users.json | 40 ++ .../Configuration.json | 2 +- .../Tags/CIS M365 Foundations 7.0.0.json | 669 ++++++++++++++++++ 9 files changed, 763 insertions(+), 3 deletions(-) create mode 100644 Definitions/Content/AadIam/GroupSettings/Configuration.json create mode 100644 Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Ensure authentication transfer is blocked.json create mode 100644 Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Periodic reauthentication is required for all users.json create mode 100644 Definitions/Tags/CIS M365 Foundations 7.0.0.json diff --git a/Definitions/Content/AadIam/GroupSettings/Configuration.json b/Definitions/Content/AadIam/GroupSettings/Configuration.json new file mode 100644 index 0000000..86af704 --- /dev/null +++ b/Definitions/Content/AadIam/GroupSettings/Configuration.json @@ -0,0 +1,4 @@ +{ + "groupsInAccessPanelEnabled": false, + "selfServiceGroupManagementEnabled": false +} diff --git a/Definitions/Content/AadIam/PasswordResetPolicies/Configuration.json b/Definitions/Content/AadIam/PasswordResetPolicies/Configuration.json index e0573fd..9bbeaaf 100644 --- a/Definitions/Content/AadIam/PasswordResetPolicies/Configuration.json +++ b/Definitions/Content/AadIam/PasswordResetPolicies/Configuration.json @@ -8,7 +8,7 @@ "mobilePhoneOptionEnabled": true, "notifyOnAdminPasswordReset": false, "notifyUsersOnPasswordReset": true, - "numberOfAuthenticationMethodsRequired": 1, + "numberOfAuthenticationMethodsRequired": 2, "numberOfQuestionsToRegister": 5, "numberOfQuestionsToReset": 3, "officePhoneOptionEnabled": false, diff --git a/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/CIS L2 Attachment Policy.json b/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/CIS L2 Attachment Policy.json index 9bdbe7f..41e3501 100644 --- a/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/CIS L2 Attachment Policy.json +++ b/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/CIS L2 Attachment Policy.json @@ -11,6 +11,7 @@ "ade", "adp", "ani", + "apk", "app", "appinstaller", "applescript", @@ -75,6 +76,7 @@ "ksh", "lha", "lib", + "library", "library-ms", "lnk", "lzh", diff --git a/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/Default.json b/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/Default.json index 6d07d9e..04826f1 100644 --- a/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/Default.json +++ b/Definitions/Content/ExchangeOnline/MalwareFilterPolicy/Default.json @@ -11,6 +11,7 @@ "ade", "adp", "ani", + "apk", "app", "appinstaller", "applescript", @@ -75,6 +76,7 @@ "ksh", "lha", "lib", + "library", "library-ms", "lnk", "lzh", diff --git a/Definitions/Content/ExchangeOnline/OwaMailboxPolicy/OwaMailboxPolicy-Default.json b/Definitions/Content/ExchangeOnline/OwaMailboxPolicy/OwaMailboxPolicy-Default.json index 1bef341..673e54d 100644 --- a/Definitions/Content/ExchangeOnline/OwaMailboxPolicy/OwaMailboxPolicy-Default.json +++ b/Definitions/Content/ExchangeOnline/OwaMailboxPolicy/OwaMailboxPolicy-Default.json @@ -258,7 +258,7 @@ "OutlookNewslettersAccessLevel": "Undefined", "OutlookNewslettersReactions": "Undefined", "OutlookNewslettersShowMore": "Undefined", - "PersonalAccountCalendarsEnabled": true, + "PersonalAccountCalendarsEnabled": false, "PhoneticSupportEnabled": false, "PlacesEnabled": true, "PremiumClientEnabled": true, diff --git a/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Ensure authentication transfer is blocked.json b/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Ensure authentication transfer is blocked.json new file mode 100644 index 0000000..c49d3b2 --- /dev/null +++ b/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Ensure authentication transfer is blocked.json @@ -0,0 +1,43 @@ +{ + "displayName": "Ensure authentication transfer is blocked", + "conditions": { + "applications": { + "excludeApplications": [], + "includeApplications": [ + "All" + ], + "includeAuthenticationContextClassReferences": [], + "includeUserActions": [] + }, + "authenticationFlows": { + "transferMethods": "authenticationTransfer" + }, + "clientAppTypes": [ + "all" + ], + "signInRiskLevels": [], + "userRiskLevels": [], + "users": { + "excludeGroups": [], + "excludeRoles": [], + "excludeUsers": [ + "${urn:resource:MSGraph:Users/admin@${ResourceContext:TenantDomainName}?id}", + "${urn:resource:MSGraph:Users/break-glass@${ResourceContext:TenantDomainName}?id}" + ], + "includeGroups": [], + "includeRoles": [], + "includeUsers": [ + "All" + ] + } + }, + "grantControls": { + "builtInControls": [ + "block" + ], + "customAuthenticationFactors": [], + "operator": "OR", + "termsOfUse": [] + }, + "state": "enabledForReportingButNotEnforced" +} diff --git a/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Periodic reauthentication is required for all users.json b/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Periodic reauthentication is required for all users.json new file mode 100644 index 0000000..a42f7e1 --- /dev/null +++ b/Definitions/Content/MSGraph/Identity/ConditionalAccess/Policies/Periodic reauthentication is required for all users.json @@ -0,0 +1,40 @@ +{ + "displayName": "Periodic reauthentication is required for all users", + "conditions": { + "applications": { + "excludeApplications": [], + "includeApplications": [ + "All" + ], + "includeAuthenticationContextClassReferences": [], + "includeUserActions": [] + }, + "clientAppTypes": [ + "all" + ], + "signInRiskLevels": [], + "userRiskLevels": [], + "users": { + "excludeGroups": [], + "excludeRoles": [], + "excludeUsers": [ + "${urn:resource:MSGraph:Users/break-glass@${ResourceContext:TenantDomainName}?id}" + ], + "includeGroups": [], + "includeRoles": [], + "includeUsers": [ + "All" + ] + } + }, + "sessionControls": { + "signInFrequency": { + "authenticationType": "primaryAndSecondaryAuthentication", + "frequencyInterval": "timeBased", + "isEnabled": true, + "type": "days", + "value": 7 + } + }, + "state": "enabledForReportingButNotEnforced" +} diff --git a/Definitions/Content/MSGraph/Policies/DeviceRegistrationPolicy/Configuration.json b/Definitions/Content/MSGraph/Policies/DeviceRegistrationPolicy/Configuration.json index bbfee62..8b999d2 100644 --- a/Definitions/Content/MSGraph/Policies/DeviceRegistrationPolicy/Configuration.json +++ b/Definitions/Content/MSGraph/Policies/DeviceRegistrationPolicy/Configuration.json @@ -25,5 +25,5 @@ "isEnabled": true }, "multiFactorAuthConfiguration": "notRequired", - "userDeviceQuota": 20 + "userDeviceQuota": 10 } diff --git a/Definitions/Tags/CIS M365 Foundations 7.0.0.json b/Definitions/Tags/CIS M365 Foundations 7.0.0.json new file mode 100644 index 0000000..dcb5239 --- /dev/null +++ b/Definitions/Tags/CIS M365 Foundations 7.0.0.json @@ -0,0 +1,669 @@ +{ + "name": "CIS M365 Foundations 7.0.0", + "description": "This baseline aligns with the Center for Internet Security (CIS) Microsoft 365 Foundations Benchmark v7.0.0.", + "label": "CIS M365 Foundations 7.0.0", + "tags": [ + { + "path": "Content/AadIam/ExternalUserGuestSettings/Configuration.json", + "description": [ + "5.1.6.1 (L2) Ensure that collaboration invitations are sent to allowed domains only (Manual)" + ] + }, + { + "path": "Content/AadIam/PasswordResetPolicies/Configuration.json", + "description": [ + "5.2.4.1 (L1) Ensure 'Self service password reset enabled' is set to 'All' (Manual)", + "5.2.4.2 Ensure that 2 methods are required for password reset" + ] + }, + { + "path": "Content/AadIam/UserSettings/Configuration.json", + "description": [ + "5.1.2.4 (L1) Ensure 'Restrict access to the Azure AD administration portal' is set to 'Yes' (Manual)", + "5.1.2.6 (L2) Ensure 'LinkedIn account connections' is disabled (Manual)" + ] + }, + { + "path": "Content/AadIam/GroupSettings/Configuration.json", + "description": [ + "5.1.3.2 Ensure that 'Restrict user ability to access groups features in My Groups' is set to 'Yes'" + ] + }, + { + "path": "Content/ExchangeOnline/AdminAuditLogConfig/Configuration.json", + "description": [ + "3.1.1 (L1) Ensure Microsoft 365 audit log search is Enabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/AntiPhishPolicy/Office365 AntiPhish Default.json", + "description": [ + "2.1.7 (L1) Ensure that an anti-phishing policy has been created (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/AtpPolicyForO365/Configuration.json", + "description": [ + "2.1.5 (L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/ExternalInOutlook/Configuration.json", + "description": [ + "6.2.3 (L1) Ensure email from external senders is identified (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/HostedOutboundSpamFilterPolicy/Default.json", + "description": [ + "2.1.6 (L1) Ensure Exchange Online Spam Policies are set to notify administrators (Automated)", + "2.1.15 (L1) Ensure outbound anti-spam message limits are in place (Automated)", + "6.2.1 (L1) Ensure all forms of mail forwarding are blocked and/or disabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/MalwareFilterPolicy/Default.json", + "description": [ + "2.1.2 (L1) Ensure the Common Attachment Types Filter is enabled (Automated)", + "2.1.3 (L1) Ensure notifications for internal users sending malware is Enabled (Automated)", + "2.1.14 (L2) Ensure comprehensive attachment filtering is applied (Automated)", + "2.1.11 (L2) Ensure comprehensive attachment filtering is applied - Simplify audit script, provide new output methods, clarify audit steps" + ] + }, + { + "path": "Content/ExchangeOnline/OrganizationConfig/Configuration.json", + "description": [ + "1.3.9 (L1) Ensure shared bookings paged are restricted to select users (Automated)", + "6.1.1 (L1) Ensure 'AuditDisabled' organizationally is set to 'False' (Automated)", + "6.5.1 (L1) Ensure modern authentication for Exchange Online is enabled (Automated)", + "6.5.2 (L1) Ensure MailTips are enabled for end users (Automated)", + "6.5.5 (L2) Ensure Direct Send submissions are rejected (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/OwaMailboxPolicy/OwaMailboxPolicy-Default.json", + "description": [ + "6.5.3 (L2) Ensure additional storage providers are restricted in Outlook on the web (Automated)", + "Outlook on the web (OWA) mailbox policies include two settings that control personal account integration in Outlook. `PersonalAccountsEnabled` controls whether users can add personal email accounts (e.g., Outlook.com, Gmail, Yahoo) in the new Outlook for Windows. `PersonalAccountCalendarsEnabled` controls whether users can connect personal Outlook.com or Google calendars in Outlook on the web. Neither setting applies to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps." + ] + }, + { + "path": "Content/ExchangeOnline/SafeAttachmentPolicy/Baseline - Safe Attachments Policy.json", + "description": [ + "2.1.4 (L2) Ensure Safe Attachments policy is enabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/SafeLinksPolicy/Built-In Protection Policy.json", + "description": [ + "2.1.1 (L2) Ensure Safe Links for Office Applications is Enabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/SharingPolicy/Default Sharing Policy.json", + "description": [ + "1.3.3 (L2) Ensure 'External sharing' of calendars is not available (Automated)" + ] + }, + { + "path": "Content/MSGraph/Admin/Sharepoint/Settings/Configuration.json", + "description": [ + "7.2.1 (L1) Ensure modern authentication for SharePoint applications is required (Automated)", + "7.2.3 (L1) Ensure external content sharing is restricted (Automated)", + "7.2.5 (L2) Ensure that SharePoint guest users cannot share items they don't own (Automated)", + "7.2.6 (L2) Ensure SharePoint external sharing is restricted (Automated)", + "7.3.2 (L2) Ensure OneDrive sync is restricted for unmanaged devices (Automated)" + ] + }, + { + "path": "Content/MSGraph/Domains/${ResourceContext%3ATenantDomainName}.json", + "description": [ + "1.3.1 (L1) Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)' (Automated)" + ] + }, + { + "path": "Content/MSGraph/Groups/Baseline - Guest Users.json", + "description": [ + "5.1.3.1 (L1) Ensure a dynamic group for guest users is created (Automated)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Block Access to Admin Portals.json", + "description": [ + "5.2.2.8 (L2) Ensure 'sign-in risk' is blocked for medium and high risk (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Block Legacy Authentication.json", + "description": [ + "5.2.2.3 (L1) Enable Conditional Access policies to block legacy authentication (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - No Persistent Admin Sessions.json", + "description": [ + "5.2.2.4 (L1) Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require MFA for Admins.json", + "description": [ + "5.2.2.1 (L1) Ensure multifactor authentication is enabled for all users in administrative roles (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require MFA for All Users.json", + "description": [ + "5.2.2.2 (L1) Ensure multifactor authentication is enabled for all users (Manual)", + "5.2.3.4 (L1) Ensure all member users are 'MFA capable' (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require MFA for Risky Sign-ins.json", + "description": [ + "5.2.2.7 (L1) Enable Identity Protection sign-in risk policies (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require Password Change for High-risk Users.json", + "description": [ + "5.2.2.6 (L1) Enable Identity Protection user risk policies (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require Phishing-resistant MFA for Admins.json", + "description": [ + "5.2.2.5 (L2) Ensure 'Phishing-resistant MFA strength' is required for Administrators (Manual)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Periodic reauthentication is required for all users.json", + "description": [ + "5.2.2.13 Ensure that periodic reauthentication is required for all users" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Ensure authentication transfer is blocked.json", + "description": [ + "5.2.2.17 Ensure authentication transfer is blocked" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Access review for Exchange Administrators.json", + "description": [ + "5.3.3 (L1) Ensure 'Access reviews' for high privileged Azure AD roles are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Access review for Global Administrators.json", + "description": [ + "5.3.3 (L1) Ensure 'Access reviews' for high privileged Azure AD roles are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Access review for Security Administrators.json", + "description": [ + "5.3.3 (L1) Ensure 'Access reviews' for high privileged Azure AD roles are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Access review for SharePoint Administrators.json", + "description": [ + "5.3.3 (L1) Ensure 'Access reviews' for high privileged Azure AD roles are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Access review for Teams Administrators.json", + "description": [ + "5.3.3 (L1) Ensure 'Access reviews' for high privileged Azure AD roles are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/IdentityGovernance/AccessReviews/Definitions/Baseline - Review guest access across Microsoft 365 groups.json", + "description": [ + "5.3.2 (L1) Ensure 'Access reviews' for Guest Users are configured (Manual)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthenticationMethodsPolicy/AuthenticationMethodConfigurations/microsoftAuthenticator.json", + "description": [ + "5.2.3.1 (L1) Ensure Microsoft Authenticator is configured to protect against MFA fatigue (Manual)", + "5.2.3.6 (L1) Ensure system-preferred multifactor authentication is enabled (Manual)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthorizationPolicy/Authorization Policy.json", + "description": [ + "5.1.2.2 (L2) Ensure third party integrated applications are not allowed (Automated)", + "5.1.2.3 (L1) Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes' (Automated)", + "5.1.3.2 (L1) Ensure users cannot create security groups (Automated)", + "5.1.34 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'" + ] + }, + { + "path": "Content/MSGraph/Settings/Consent Policy Settings.json", + "description": [ + "5.1.5.1 (L2) Ensure user consent to apps accessing company data on their behalf is not allowed (Automated)", + "5.1.5.2 (L1) Ensure the admin consent workflow is enabled (Manual)" + ] + }, + { + "path": "Content/MSGraph/Settings/Password Rule Settings.json", + "description": [ + "5.2.3.2 (L1) Ensure custom banned passwords lists are used (Manual)", + "5.2.3.3 (L1) Ensure password protection is enabled for on-prem Active Directory (Manual)" + ] + }, + { + "path": "Content/MSGraph/Users/break-glass@${ResourceContext%3ATenantDomainName}.json", + "description": [ + "1.1.2 (L1) Ensure two emergency access accounts have been defined (Manual)", + "1.1.2 Ensure two emergency access accounts have been defined - Audit now checks for disabled accounts" + ] + }, + { + "path": "Content/MSGraph/Users/emergency-access@${ResourceContext%3ATenantDomainName}.json", + "description": [ + "1.1.2 (L1) Ensure two emergency access accounts have been defined (Manual)", + "1.1.2 Ensure two emergency access accounts have been defined - Audit now checks for disabled accounts" + ] + }, + { + "path": "Content/O365Portal/Settings/Apps/OfficeForms/Configuration.json", + "description": [ + "1.3.5 (L1) Ensure internal phishing protection for Forms is enabled (Manual)" + ] + }, + { + "path": "Content/O365Portal/Settings/Security/ActivityBasedTimeout/Configuration.json", + "description": [ + "1.3.2 (L2) Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices (Manual)" + ] + }, + { + "path": "Content/O365Portal/Settings/UserOwnedAppAndServices/AccessOfficeStore/Configuration.json", + "description": [ + "1.3.4 (L1) Ensure 'User owned apps and services' is restricted" + ] + }, + { + "path": "Content/O365Portal/Settings/UserOwnedAppAndServices/StartTrialOnBehalfOrg/Configuration.json", + "description": [ + "1.3.4 (L1) Ensure 'User owned apps and services' is restricted" + ] + }, + { + "path": "Content/SecurityAndCompliance/DlpCompliancePolicy/Baseline - Default DLP Policy for Office 365.json", + "description": [ + "3.2.1 (L1) Ensure DLP policies are enabled (Manual)" + ] + }, + { + "path": "Content/SecurityAndCompliance/DlpCompliancePolicy/Baseline - Default DLP Policy for Teams.json", + "description": [ + "3.2.2 (L1) Ensure DLP policies are enabled for Microsoft Teams (Manual)" + ] + }, + { + "path": "Content/SharePoint/TenantProperties/Configuration.json", + "description": [ + "7.2.2 (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled (Automated)", + "7.2.4 (L2) Ensure OneDrive content sharing is restricted (Automated)", + "2.1.5 (L2) Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled (Automated)", + "7.2.7 (L1) Ensure link sharing is restricted in SharePoint and OneDrive (Automated)", + "7.2.9 (L1) Ensure guest access to a site or OneDrive will expire automatically (Automated)", + "7.2.10 (L1) Ensure reauthentication with verification code is restricted (Automated)", + "7.3.1 (L2) Ensure Office 365 SharePoint infected files are disallowed for download (Automated)" + ] + }, + { + "path": "Content/Teams/CsTeamsClientConfiguration/Global.json", + "description": [ + "8.1.1 (L2) Ensure external file sharing in Teams is enabled for only approved cloud storage services (Automated)", + "8.1.2 (L1) Ensure users can't send emails to a channel email address (Automated)" + ] + }, + { + "path": "Content/Teams/CsTeamsMeetingPolicy/Global.json", + "description": [ + "8.5.1 (L2) Ensure anonymous users can't join a meeting (Automated)", + "8.5.2 (L1) Ensure anonymous users and dial-in callers can't start a meeting (Automated)", + "8.5.3 (L1) Ensure only people in my org can bypass the lobby (Automated)", + "8.5.4 (L1) Ensure users dialing in can't bypass the lobby (Automated)", + "8.5.5 (L2) Ensure meeting chat does not allow anonymous users (Automated)", + "8.5.6 (L2) Ensure only organizers and co-organizers can present (Automated)", + "8.5.7 (L1) Ensure external participants can't give or request control (Automated)", + "8.5.8 (L2) Ensure external meeting chat is off (Automated)" + ] + }, + { + "path": "Content/Teams/CsTeamsMessagingPolicy/Global.json", + "description": [ + "8.6.1 (L1) Ensure users can report security concerns in Teams (Automated)" + ] + }, + { + "path": "Content/Teams/CsTenantFederationConfiguration/Global.json", + "description": [ + "8.2.1 (L1) Ensure 'external access' is restricted in the Teams admin center (Automated)", + "8.2.4 (L1) Ensure the organization cannot communicate with accounts in trial Teams tenants (Automated)" + ] + }, + { + "path": "Content/AzureManagement/Providers/Microsoft/CustomerLockbox/Configuration.json", + "description": [ + "1.3.6 (L2) Ensure the customer lockbox feature is enabled (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/MalwareFilterPolicy/CIS L2 Attachment Policy.json", + "description": [ + "2.1.11 (L2) Ensure comprehensive attachment filtering is applied (Automated)", + "2.1.11 (L2) Ensure comprehensive attachment filtering is applied - Simplify audit script, provide new output methods, clarify audit steps" + ] + }, + { + "path": "Content/ExchangeOnline/MalwareFilterRule/CIS L2 Attachment Policy.json", + "description": [ + "2.1.11 (L2) Ensure comprehensive attachment filtering is applied (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/HostedConnectionFilterPolicy/Default.json", + "description": [ + "2.1.12 (L1) Ensure the connection filter IP allow list is not used (Automated)", + "2.1.13 (L1) Ensure the connection filter IP allow list is not used (Automated)" + ] + }, + { + "path": "Content/ExchangeOnline/EmailTenantSettings/Configuration.json", + "description": [ + "2.4.1 (L1) Ensure Priority account protection is enabled and configured (Automated)" + ] + }, + { + "path": "Content/SecurityAndCompliance/Label/Confidential Data--.json", + "description": [ + "3.3.1 (L1) Ensure Information Protection sensitivity label policies are published (Manual)" + ] + }, + { + "path": "Content/SecurityAndCompliance/Label/Highly Confidential Data--.json", + "description": [ + "3.3.1 (L1) Ensure Information Protection sensitivity label policies are published (Manual)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthorizationPolicy/Authorization Policy.json", + "description": [ + "5.1.6.2 (L1) Ensure that guest user access is restricted (Automated)", + "5.1.6.3 (L2) Ensure guest user invitations are limited to the Guest Inviter role (Automated)", + "5.1.34 Ensure that 'Users can create security groups in Azure portals, API or PowerShell' is set to 'No'" + ] + }, + { + "path": "Content/MSGraph/DeviceManagement/Configuration.json", + "description": [ + "4.1 (L2) Ensure devices without a compliance policy are marked 'not compliant' (Automated) - Note the only required property for CIS is secureByDefault set as true." + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require Managed Device to Register Security Information.json", + "description": [ + "5.2.2.10 (L1) Ensure a managed device is required to register security information (Automated)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Requrie Compliant Device.json", + "description": [ + "5.2.2.9 (L1) Ensure a managed device is required for authentication (Automated)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Block Device Code Auth.json", + "description": [ + "5.2.2.12 (L1) Ensure the device code sign-in flow is blocked (Automated)" + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/Policies/Baseline - Require MFA to Enroll Device.json", + "description": [ + "5.2.2.11 (L1) Ensure sign-in frequency for Intune Enrollment is set to 'Every time' (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthenticationMethodsPolicy/AuthenticationMethodConfigurations/email.json", + "description": [ + "5.2.3.7 (L2) Ensure the email OTP authentication method is disabled (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthenticationMethodsPolicy/AuthenticationMethodConfigurations/sms.json", + "description": [ + "5.2.3.5 (L1) Ensure weak authentication methods are disabled (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/AuthenticationMethodsPolicy/AuthenticationMethodConfigurations/voice.json", + "description": [ + "5.2.3.5 (L1) Ensure weak authentication methods are disabled (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/RoleManagementPolicies/Rules/#microsoft.graph.unifiedRoleManagementPolicyApprovalRule--${urn%3Aresource%3AMSGraph%3APolicies%3ARoleManagementPolicies%2FGlobal Administrator%3Fid}--Approval_EndUser_Assignment.json", + "description": [ + "5.3.4 (L1) Ensure approval is required for Global Administrator role activation (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/RoleManagementPolicies/Rules/#microsoft.graph.unifiedRoleManagementPolicyApprovalRule--${urn%3Aresource%3AMSGraph%3APolicies%3ARoleManagementPolicies%2FPrivileged Role Administrator%3Fid}--Approval_EndUser_Assignment.json", + "description": [ + "5.3.5 (L1) Ensure approval is required for Privileged Role Administrator activation (Automated)" + ] + }, + { + "path": "Content/SharePoint/TenantProperties/Configuration.json", + "description": [ + "7.2.11 (L1) Ensure the SharePoint default sharing link permission is set (Automated)" + ] + }, + { + "path": "Content/Teams/CsTeamsMeetingPolicy/Global.json", + "description": [ + "8.5.9 (L2) Ensure meeting recording is off by default (Automated)" + ] + }, + { + "path": "Content/Teams/CsTenantFederationConfiguration/Global.json", + "description": [ + "8.2.2 (L1) Ensure communication with unmanaged Teams users is disabled (Automated)", + "8.2.3 (L1) Ensure external Teams users cannot initiate conversations (Automated)" + ] + }, + { + "path": "Content/MSGraph/Policies/DeviceRegistrationPolicy/Configuration.json", + "description": [ + "5.1.4.2 (L2) Ensure the maximum number of devices per user is limited", + "This setting defines the maximum number of Microsoft Entra joined or registered devices that a user can have in Microsoft Entra ID. Once this limit is reached, no additional devices can be added until existing ones are removed. Values above 100 are automatically capped at 100." + ] + }, + { + "path": "", + "description": [ + "5.1.4.1 (L2) Ensure the ability to join devices to Entra is restricted", + "5.1.4.3 (L1) Ensure the GA role is not added as a local administrator during Entra join", + "5.1.4.4 (L1) Ensure local administrator assignment is limited during Entra join", + "5.1.4.5 (L1) Ensure Local Administrator Password Solution is enabled", + "5.1.4.6 (L2) Ensure users are restricted from recovering BitLocker keys" + ] + }, + { + "path": "Content/MSGraph/Groups/Baseline - Device Enrollers.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/ExchangeOnline/QuarantinePolicy/DefaultFullAccessPolicy.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/Groups/Baseline - PIM Approvers.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/ExchangeOnline/QuarantinePolicy/AdminOnlyAccessPolicy.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Application Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Authentication Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Billing Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Cloud Application Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Conditional Access Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Exchange Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Global Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Global Reader.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Helpdesk Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Password Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Privileged Authentication Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Privileged Role Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Security Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/SharePoint Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Teams Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/User Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/Users/break-glass@${ResourceContext%3ATenantDomainName}.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/Users/emergency-access@${ResourceContext%3ATenantDomainName}.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/Identity/ConditionalAccess/AuthenticationStrength/Policies/Phishing-resistant MFA.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/Users/admin@${ResourceContext%3ATenantDomainName}.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/RoleManagement/Directory/RoleDefinitions/Restricted Guest User.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/DirectoryRoles/Global Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/DirectoryRoles/SharePoint Administrator.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + }, + { + "path": "Content/MSGraph/ServicePrincipals/d4ebce55-015a-49b5-a083-c84d1797ae8c.json", + "description": [ + "This configuration is a dependency for other industry baseline configurations." + ] + } + ] +} \ No newline at end of file