Skip to content

Checks

Security License Lens ships 170 checks across ten workload directories. Each check is a single YAML file under checks/<workload>/ and evaluates only when its required capabilities are licensed.

The authoritative per-check catalog (collector, support state, evaluator, capabilities, evidence keys) is generated — do not maintain a full check table here:

Workloads

Counts are the number of checks/<dir>/*.yaml files in the tree (must sum to 170):

Workload Checks Examples
identity 45 Conditional Access gaps, PIM, dormant privileged accounts
collaboration 22 Teams federation, guest access, external sharing
defender 21 Safe Links / Safe Attachments, anti-spam, alert policies
exchange 12 SPF/DKIM/DMARC, forwarding, SMTP auth, mailbox audit
purview 11 DLP policy presence/enforcement, sensitivity labels, retention
power-bi 9 Tenant settings, sharing
endpoint 8 MDE onboard gaps, Intune policy
power-platform 6 DLP policies, environment isolation
sentinel 8 Analytics rule coverage, UEBA, telemetry ingestion
azure 2 Azure resource hygiene

Email is a priority pack, not a workload directory under checks/.

Tiers

109 checks are activation (paid security products). 61 checks are hygiene (base-workload configuration). See Two tiers and the classification table in audit/check-tier-classification.md.

Check anatomy

Each check declares machine fields and customer-facing copy:

id: id-ca-priv-gaps
title: Privileged sign-ins not strongly gated by Conditional Access
customer_title: Powerful accounts may sign in without strong extra checks
customer_summary: >
  You can require multi-factor authentication and block outdated sign-in methods.
  Gaps here mean admin or other high-value accounts might get in with weaker proof
  than your license already allows.
customer_next_step: >
  Require multi-factor authentication for admins and block legacy email sign-in
  methods that skip modern security prompts.
workload: identity
required_capabilities:
  - conditional_access
severity: high
impact: high
effort: hours
blast_radius: all_users
pack: identity
collector: graph_ca
remediation: >
  Create CA policies that require phishing-resistant MFA for privileged roles
  and block legacy authentication tenant-wide where possible.
references:
  - https://learn.microsoft.com/entra/identity/conditional-access/overview
  - https://learn.microsoft.com/entra/identity/conditional-access/block-legacy-authentication
enabled: true

Field meanings

  • severity — critical / high / medium / low / info.
  • impact — high / medium / low.
  • effort — minutes / hours / days; feeds the ranked fix list.
  • blast_radius — who is affected: all_users, admin, data, devices.
  • exposure_class — how a gap is surfaced (for example none for normal findings).
  • collector — which backend supplies evidence.
  • required_capabilities — the catalog entries that gate the check.

Licensing gates

A check whose required_capabilities are not present reports not_licensed instead of a gap. Unlicensed capabilities never produce false findings.

Adding a check

See Adding a check for the step-by-step guide and the minimum bar for a new-check PR.