Check reference¶
170 checks. Every check discloses its collector (backend), support state (direct, proxy, manual, unsupported, or direct_with_proxy_fallback), evaluator registration, required capabilities, flagship status, evidence keys, compliance mappings, and source file.
| Check ID | Collector (backend) | State | Evaluator | Required capabilities | Evidence keys | Mappings | Source | Flagship |
|---|---|---|---|---|---|---|---|---|
az-cspm-out-of-scope |
noop |
manual | registered | defender_for_cloud_cspm | break_glass_principal_ids | — | checks/azure/az-cspm-out-of-scope.yaml |
— |
az-defender-plan-enabled |
defender_pricings_collector |
direct | registered | defender_for_cloud_cspm, defender_for_cloud_servers | defender_for_cloud_pricings | — | checks/azure/az-defender-plan-enabled.yaml |
— |
endpoint-compliance-noncompliance-action |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-2 | checks/endpoint/endpoint-compliance-noncompliance-action.yaml |
— |
endpoint-compliance-policy-assigned |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-2 | checks/endpoint/endpoint-compliance-policy-assigned.yaml |
yes |
endpoint-enrollment-coverage |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-2 | checks/endpoint/endpoint-enrollment-coverage.yaml |
yes |
endpoint-mde-connector |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: SI-3, SI-4 | checks/endpoint/endpoint-mde-connector.yaml |
— |
endpoint-security-baseline |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-2 | checks/endpoint/endpoint-security-baseline.yaml |
— |
endpoint-security-policy-coverage |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-3 | checks/endpoint/endpoint-security-policy-coverage.yaml |
yes |
ep-asr-rules |
intune_collector |
direct | registered | defender_endpoint_p1, defender_endpoint_p2 | intune_bundle | MITRE: T1059, T1204; NIST: SI-3, CM-6 | checks/endpoint/asr-rules.yaml |
yes |
ep-bitlocker-policy |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1486, T1040; NIST: SC-28, CM-6 | checks/endpoint/bitlocker-policy.yaml |
yes |
ep-compliance-enforcement |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1059; NIST: CM-6, SI-2 | checks/endpoint/compliance-enforcement.yaml |
— |
ep-mam-app-protection |
intune_collector |
direct | registered | intune | intune_bundle | MITRE: T1040, T1486; NIST: SC-28, AC-3 | checks/endpoint/mam-app-protection.yaml |
— |
ep-tamper-protection |
intune_collector |
direct | registered | defender_endpoint_p1, defender_endpoint_p2 | intune_bundle | MITRE: T1562; NIST: SI-3, SI-7 | checks/endpoint/tamper-protection.yaml |
yes |
exo-dkim-enabled |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-dkim-enabled.yaml |
yes |
exo-dmarc-agency-contact |
exchange_collector |
direct | registered | exchange_online | dns_records | — | checks/exchange/exo-dmarc-agency-contact.yaml |
— |
exo-dmarc-federal-contact |
exchange_collector |
direct | registered | exchange_online | dns_records | — | checks/exchange/exo-dmarc-federal-contact.yaml |
— |
exo-dmarc-published |
exchange_collector |
direct | registered | exchange_online | dns_records | — | checks/exchange/exo-dmarc-published.yaml |
— |
exo-dmarc-reject |
exchange_collector |
direct | registered | exchange_online | dns_records | — | checks/exchange/exo-dmarc-reject.yaml |
yes |
exo-external-sender-warnings |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-external-sender-warnings.yaml |
— |
exo-forwarding-external-disabled |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-forwarding-external-disabled.yaml |
— |
exo-mailbox-audit-enabled |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-mailbox-audit-enabled.yaml |
yes |
exo-sharing-calendar-not-all-domains |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-sharing-calendar-not-all-domains.yaml |
— |
exo-sharing-contact-not-all-domains |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-sharing-contact-not-all-domains.yaml |
— |
exo-smtp-auth-disabled |
exchange_collector |
direct | registered | exchange_online | exchange_bundle | — | checks/exchange/exo-smtp-auth-disabled.yaml |
yes |
exo-spf-published |
exchange_collector |
direct | registered | exchange_online | dns_records | — | checks/exchange/exo-spf-published.yaml |
— |
id-access-reviews-scope |
graph_access_reviews |
direct | registered | entra_id_p2 | access_review_definitions, access_review_instances | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-access-reviews-scope.yaml |
— |
id-access-reviews-unused |
graph_access_reviews |
direct | registered | entra_id_p2 | access_review_definitions | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-access-reviews-unused.yaml |
— |
id-ai-agents-risky-block |
graph_ca |
direct | registered | identity_protection | ca_policies | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ai-agents-risky-block.yaml |
— |
id-app-admin-consent-workflow |
graph_authorization |
direct | registered | conditional_access | admin_consent_request_policy | MITRE: T1098; NIST: AC-2, IA-5 | checks/identity/id-app-admin-consent-workflow.yaml |
— |
id-app-certificate-lifetime |
graph_applications |
direct | registered | conditional_access | applications_bundle | MITRE: T1098; NIST: IA-5 | checks/identity/id-app-certificate-lifetime.yaml |
— |
id-app-expiring-credentials |
graph_applications |
direct | registered | conditional_access | applications_bundle | MITRE: T1098; NIST: IA-5 | checks/identity/id-app-expiring-credentials.yaml |
— |
id-app-ownerless-or-stale |
graph_applications |
direct | registered | conditional_access | applications_bundle | MITRE: T1098; NIST: AC-2, IA-5 | checks/identity/id-app-ownerless-or-stale.yaml |
— |
id-app-password-addition-blocked |
graph_ca |
direct | registered | conditional_access | ca_policies | MITRE: T1098; NIST: IA-5 | checks/identity/id-app-password-addition-blocked.yaml |
— |
id-app-password-lifetime |
graph_applications |
direct | registered | conditional_access | applications_bundle | MITRE: T1098; NIST: IA-5 | checks/identity/id-app-password-lifetime.yaml |
— |
id-app-registration-admin-only |
graph_authorization |
direct | registered | conditional_access | authorization_policy | MITRE: T1098; NIST: AC-2, AC-6 | checks/identity/id-app-registration-admin-only.yaml |
— |
id-app-risky-delegated-consent |
graph_applications |
direct | registered | conditional_access | applications_bundle | MITRE: T1098; NIST: AC-2, IA-5 | checks/identity/id-app-risky-delegated-consent.yaml |
— |
id-app-user-consent-restricted |
graph_authorization |
direct | registered | conditional_access | authorization_policy | MITRE: T1098; NIST: AC-2, IA-5 | checks/identity/id-app-user-consent-restricted.yaml |
— |
id-auth-authenticator-context |
graph_auth_methods |
direct | registered | conditional_access | auth_methods_bundle | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-auth-authenticator-context.yaml |
— |
id-auth-methods-migration |
graph_auth_methods |
direct | registered | conditional_access | auth_methods_bundle | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-auth-methods-migration.yaml |
yes |
id-auth-weak-methods-disabled |
graph_auth_methods |
direct | registered | conditional_access | auth_methods_bundle | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-auth-weak-methods-disabled.yaml |
— |
id-break-glass-exclusion |
graph_ca |
direct | registered | conditional_access, entra_id_p2 | break_glass_principal_ids, ca_policies, role_assignments, role_eligibilities | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-break-glass-exclusion.yaml |
yes |
id-ca-device-code-block |
graph_ca |
direct | registered | conditional_access | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-ca-device-code-block.yaml |
— |
id-ca-high-risk-signins |
graph_identity_protection |
direct | registered | identity_protection | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ca-high-risk-signins.yaml |
yes |
id-ca-high-risk-users |
graph_identity_protection |
direct | registered | identity_protection | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ca-high-risk-users.yaml |
— |
id-ca-legacy-auth-block |
graph_ca |
direct | registered | conditional_access | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-ca-legacy-auth-block.yaml |
yes |
id-ca-managed-devices |
graph_ca |
direct | registered | conditional_access, intune | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ca-managed-devices.yaml |
yes |
id-ca-mfa-all-users |
graph_ca |
direct | registered | conditional_access | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ca-mfa-all-users.yaml |
yes |
id-ca-mfa-registration-managed |
graph_ca |
direct | registered | conditional_access, intune | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-ca-mfa-registration-managed.yaml |
— |
id-ca-phishing-resistant-all |
graph_ca |
direct | registered | conditional_access | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-ca-phishing-resistant-all.yaml |
yes |
id-ca-phishing-resistant-privileged |
graph_ca |
direct | registered | conditional_access | break_glass_principal_ids, ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-ca-phishing-resistant-privileged.yaml |
yes |
id-ca-priv-gaps |
graph_ca |
direct | registered | conditional_access | ca_policies, role_assignments, security_defaults_policy | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-ca-priv-gaps.yaml |
yes |
id-ca-workload-identity |
graph_ca |
direct | registered | workload_identities_premium | ca_policies | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-ca-workload-identity.yaml |
yes |
id-cross-tenant-defaults |
graph_guests |
direct | registered | conditional_access | guests_bundle | MITRE: T1078; NIST: AC-2, AC-3 | checks/identity/id-cross-tenant-defaults.yaml |
— |
id-cross-tenant-mfa-trust |
graph_guests |
direct | registered | conditional_access | guests_bundle | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-cross-tenant-mfa-trust.yaml |
— |
id-dormant-privileged |
graph_signins_roles |
direct | registered | entra_id_p2 | principal_directory, recent_signin_user_ids, role_assignments | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-dormant-privileged.yaml |
yes |
id-entitlement-access-packages |
graph_entitlement_management |
direct | registered | entitlement_management | access_packages | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-entitlement-access-packages.yaml |
— |
id-ga-count-bounds |
graph_pim |
direct | registered | entra_id_p2 | role_assignments | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-ga-count-bounds.yaml |
— |
id-ga-finer-roles |
graph_pim |
direct | registered | entra_id_p2 | role_assignments | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-ga-finer-roles.yaml |
— |
id-guest-directory-access-limited |
graph_authorization |
direct | registered | conditional_access | authorization_policy | MITRE: T1078; NIST: AC-2, AC-3 | checks/identity/id-guest-directory-access-limited.yaml |
— |
id-guest-invite-domains |
graph_guests |
manual | registered | conditional_access | approved_guest_domains, guests_bundle | MITRE: T1078; NIST: AC-2, AC-3 | checks/identity/id-guest-invite-domains.yaml |
— |
id-guest-inviter-restricted |
graph_authorization |
direct | registered | conditional_access | authorization_policy | MITRE: T1078; NIST: AC-2, AC-3 | checks/identity/id-guest-inviter-restricted.yaml |
— |
id-identity-protection-workload |
graph_identity_protection_workload |
direct | registered | workload_identities_premium | risky_service_principals | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-identity-protection-workload.yaml |
— |
id-idprotect-notify-high-risk |
noop |
manual | registered | identity_protection | break_glass_principal_ids | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-idprotect-notify-high-risk.yaml |
— |
id-idprotect-off |
graph_identity_protection |
direct | registered | identity_protection | ca_policies | MITRE: T1078; NIST: AC-2, IA-2 | checks/identity/id-idprotect-off.yaml |
yes |
id-logs-to-soc |
noop |
manual | registered | conditional_access | break_glass_principal_ids | MITRE: T1078; NIST: AU-6, AU-12 | checks/identity/id-logs-to-soc.yaml |
— |
id-number-matching |
graph_auth_methods |
direct | registered | conditional_access | auth_methods_bundle | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-number-matching.yaml |
yes |
id-password-never-expire |
graph_domains |
direct | registered | conditional_access | domains | MITRE: T1078; NIST: IA-5 | checks/identity/id-password-never-expire.yaml |
— |
id-pim-activation-controls |
graph_pim_policies |
direct | registered | entra_id_p2 | pim_policies_bundle | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-activation-controls.yaml |
yes |
id-pim-ga-activation-alert |
graph_pim_policies |
direct | registered | entra_id_p2 | pim_policies_bundle | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-ga-activation-alert.yaml |
— |
id-pim-ga-activation-approval |
graph_pim_policies |
direct | registered | entra_id_p2 | pim_policies_bundle | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-ga-activation-approval.yaml |
— |
id-pim-no-outside-pam |
graph_pim |
direct | registered | entra_id_p2 | role_assignments, role_eligibilities | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-no-outside-pam.yaml |
— |
id-pim-no-permanent-privileged |
graph_pim |
direct | registered | entra_id_p2 | role_assignments, role_eligibilities | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-no-permanent-privileged.yaml |
yes |
id-pim-other-activation-alert |
graph_pim_policies |
direct | registered | entra_id_p2 | pim_policies_bundle | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-other-activation-alert.yaml |
— |
id-pim-privileged-assignment-alert |
graph_pim_policies |
direct | registered | entra_id_p2 | pim_policies_bundle | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-privileged-assignment-alert.yaml |
— |
id-pim-unused |
graph_pim |
direct | registered | entra_id_p2 | break_glass_principal_ids, role_assignments, role_eligibilities | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-pim-unused.yaml |
yes |
id-priv-cloud-only |
graph_signins_roles |
direct | registered | entra_id_p2 | principal_directory, role_assignments | MITRE: T1078; NIST: AC-2, AC-6 | checks/identity/id-priv-cloud-only.yaml |
yes |
id-protective-plan-assignment |
license_assignment_collector |
direct | registered | defender_endpoint_p2, defender_office_p2, entra_id_p2, identity_protection, purview_dlp | license_assignment | MITRE: T1078; NIST: CM-8 | checks/identity/id-protective-plan-assignment.yaml |
— |
id-security-defaults-on |
graph_security_defaults |
direct | registered | conditional_access | ca_policies, security_defaults_policy | MITRE: T1078; NIST: IA-2, IA-5 | checks/identity/id-security-defaults-on.yaml |
— |
mde-onboard-gap |
mde_onboarding |
direct | registered | defender_endpoint_p1, defender_endpoint_p2 | mde_summary | — | checks/defender/mde-onboard-gap.yaml |
yes |
mde-sensor-health |
mde_health_collector |
direct | registered | defender_endpoint_p1, defender_endpoint_p2 | mde_health | MITRE: T1059; NIST: SI-3, SI-4 | checks/endpoint/mde-sensor-health.yaml |
— |
mdi-sensors-missing |
mdi_sensors |
direct_with_proxy_fallback | registered | defender_identity | mdi_health, secure_score_controls | — | checks/defender/mdi-sensors-missing.yaml |
— |
mdo-alert-policies-enabled |
noop |
manual | registered | defender_office_p1 | break_glass_principal_ids | — | checks/defender/mdo-alert-policies-enabled.yaml |
— |
mdo-anti-spam-no-allowed-domains |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-anti-spam-no-allowed-domains.yaml |
— |
mdo-audit-retention |
noop |
manual | registered | purview_audit | break_glass_principal_ids | — | checks/defender/mdo-audit-retention.yaml |
— |
mdo-connection-filter-no-ip-allow |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-connection-filter-no-ip-allow.yaml |
— |
mdo-connection-filter-no-safe-list |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-connection-filter-no-safe-list.yaml |
— |
mdo-impersonation-domains-owned |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-impersonation-domains-owned.yaml |
— |
mdo-impersonation-partner-domains |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-impersonation-partner-domains.yaml |
— |
mdo-impersonation-users-protected |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-impersonation-users-protected.yaml |
— |
mdo-mailbox-intelligence |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-mailbox-intelligence.yaml |
— |
mdo-malware-file-filter |
exchange_collector |
direct | registered | defender_office_p1 | exchange_bundle | — | checks/defender/mdo-malware-file-filter.yaml |
— |
mdo-malware-zap |
exchange_collector |
direct | registered | defender_office_p1 | exchange_bundle | — | checks/defender/mdo-malware-zap.yaml |
— |
mdo-outbound-spam-forwarding-block |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-outbound-spam-forwarding-block.yaml |
— |
mdo-p2-policies-default |
graph_mdo |
direct_with_proxy_fallback | registered | defender_office_p2 | secure_score_controls | — | checks/defender/mdo-p2-policies-default.yaml |
yes |
mdo-quarantine-policy |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-quarantine-policy.yaml |
— |
mdo-safe-attachments-block |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-attachments-block.yaml |
— |
mdo-safe-attachments-spo-teams |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-attachments-spo-teams.yaml |
— |
mdo-safe-documents |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-documents.yaml |
— |
mdo-safe-links-block-list |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-links-block-list.yaml |
— |
mdo-safe-links-click-through |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-links-click-through.yaml |
— |
mdo-safe-links-click-tracking |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-links-click-tracking.yaml |
— |
mdo-safe-links-real-time-scan |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safe-links-real-time-scan.yaml |
— |
mdo-safety-tips-enabled |
exchange_collector |
direct | registered | defender_office_p2 | exchange_bundle | — | checks/defender/mdo-safety-tips-enabled.yaml |
— |
mdo-spam-phish-not-inbox |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-spam-phish-not-inbox.yaml |
— |
mdo-transport-rule-external-forward |
exchange_collector |
direct | registered | exchange_online_protection | exchange_bundle | — | checks/defender/mdo-transport-rule-external-forward.yaml |
— |
mdo-unified-audit-enabled |
exchange_collector |
direct | registered | purview_audit | exchange_bundle | — | checks/defender/mdo-unified-audit-enabled.yaml |
— |
pbi-export-controls |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-export-controls.yaml |
— |
pbi-external-invite-disabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-external-invite-disabled.yaml |
— |
pbi-guest-access-disabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-guest-access-disabled.yaml |
— |
pbi-premium-capacity-governance |
pbi_capacity_collector |
direct | registered | power_bi_premium | pbi_capacity_bundle | — | checks/power-bi/pbi-premium-capacity-governance.yaml |
— |
pbi-publish-to-web-disabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-publish-to-web-disabled.yaml |
— |
pbi-python-r-visuals-disabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-python-r-visuals-disabled.yaml |
— |
pbi-resource-key-auth-blocked |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-resource-key-auth-blocked.yaml |
— |
pbi-sensitivity-labels-enabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-sensitivity-labels-enabled.yaml |
— |
pbi-sp-api-restricted |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-sp-api-restricted.yaml |
— |
pbi-sp-profiles-disabled |
power_data_collector |
direct | registered | power_bi_pro | power_data_bundle | — | checks/power-bi/pbi-sp-profiles-disabled.yaml |
— |
pp-dlp-all-environments |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-dlp-all-environments.yaml |
— |
pp-dlp-nondefault-envs |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-dlp-nondefault-envs.yaml |
— |
pp-env-creation-admin-only |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-env-creation-admin-only.yaml |
— |
pp-pages-creation-admin-only |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-pages-creation-admin-only.yaml |
— |
pp-share-with-everyone-disabled |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-share-with-everyone-disabled.yaml |
— |
pp-tenant-isolation-allowlist |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-tenant-isolation-allowlist.yaml |
— |
pp-tenant-isolation-enabled |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-tenant-isolation-enabled.yaml |
— |
pp-trial-creation-admin-only |
power_data_collector |
direct | registered | power_platform | power_data_bundle | — | checks/power-platform/pp-trial-creation-admin-only.yaml |
— |
pur-communication-compliance-readiness |
noop |
manual | registered | purview_communication_compliance | break_glass_principal_ids | — | checks/purview/pur-communication-compliance-readiness.yaml |
— |
pur-default-and-mandatory-labels |
power_data_collector |
direct | registered | purview_sensitivity_labels | power_data_bundle | — | checks/purview/pur-default-and-mandatory-labels.yaml |
yes |
pur-dlp-enforcement-block |
exchange_collector |
direct | registered | purview_dlp | exchange_bundle | — | checks/purview/pur-dlp-enforcement-block.yaml |
— |
pur-dlp-locations-complete |
exchange_collector |
direct | registered | purview_dlp | exchange_bundle | — | checks/purview/pur-dlp-locations-complete.yaml |
— |
pur-dlp-not-enforced |
purview_dlp |
direct_with_proxy_fallback | registered | purview_dlp | purview_dlp | — | checks/purview/pur-dlp-not-enforced.yaml |
yes |
pur-dlp-notifications |
exchange_collector |
direct | registered | purview_dlp | exchange_bundle | — | checks/purview/pur-dlp-notifications.yaml |
— |
pur-dlp-policy-present |
exchange_collector |
direct | registered | purview_dlp | exchange_bundle | — | checks/purview/pur-dlp-policy-present.yaml |
— |
pur-ediscovery-readiness |
graph_purview_ediscovery |
direct | registered | purview_ediscovery | purview_ediscovery | — | checks/purview/pur-ediscovery-readiness.yaml |
— |
pur-endpoint-dlp |
exchange_collector |
direct | registered | purview_dlp | exchange_bundle | — | checks/purview/pur-endpoint-dlp.yaml |
— |
pur-insider-risk-readiness |
graph_purview_insider_risk |
direct | registered | purview_insider_risk | purview_insider_risk | — | checks/purview/pur-insider-risk-readiness.yaml |
— |
pur-retention-policy-coverage |
power_data_collector |
direct | registered | purview_retention | power_data_bundle | — | checks/purview/pur-retention-policy-coverage.yaml |
— |
pur-sensitivity-auto-labeling |
power_data_collector |
direct | registered | purview_sensitivity_labels | power_data_bundle | — | checks/purview/pur-sensitivity-auto-labeling.yaml |
— |
pur-sensitivity-labels-published |
power_data_collector |
direct | registered | purview_sensitivity_labels | power_data_bundle | — | checks/purview/pur-sensitivity-labels-published.yaml |
yes |
sen-analytics-rule-coverage |
sentinel_analytics |
direct | registered | microsoft_sentinel | sentinel_rules | — | checks/sentinel/sen-analytics-rule-coverage.yaml |
yes |
sen-automation-rules |
sentinel_automation_rules_collector |
direct | registered | microsoft_sentinel | sentinel_automation_rules | — | checks/sentinel/sen-automation-rules.yaml |
— |
sen-data-connectors |
sentinel_data_connectors_collector |
direct | registered | microsoft_sentinel | sentinel_data_connectors | — | checks/sentinel/sen-data-connectors.yaml |
yes |
sen-entra-diagnostics-routed |
la_usage_collector |
proxy | registered | microsoft_sentinel | la_usage_by_table | — | checks/sentinel/sen-entra-diagnostics-routed.yaml |
— |
sen-log-analytics-retention |
sentinel_workspace_collector |
direct | registered | log_analytics, microsoft_sentinel | sentinel_workspace | — | checks/sentinel/sen-log-analytics-retention.yaml |
— |
sen-rule-telemetry-parity |
sentinel_analytics |
direct | registered | microsoft_sentinel | la_usage_by_table, sentinel_rules, telemetry_expectations | — | checks/sentinel/sen-rule-telemetry-parity.yaml |
yes |
sen-telemetry-ingestion-coverage |
la_usage_collector |
direct | registered | microsoft_sentinel | la_usage_by_table, telemetry_expectations | — | checks/sentinel/sen-telemetry-ingestion-coverage.yaml |
yes |
sen-ueba-not-enabled |
sentinel_ueba |
direct | registered | microsoft_sentinel | sentinel_ueba | — | checks/sentinel/sen-ueba-not-enabled.yaml |
— |
spo-anyone-link-expiration |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-anyone-link-expiration.yaml |
— |
spo-anyone-link-view |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-anyone-link-view.yaml |
— |
spo-default-link-specific |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-default-link-specific.yaml |
— |
spo-default-link-view |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-default-link-view.yaml |
— |
spo-domain-restrictions |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-domain-restrictions.yaml |
— |
spo-onedrive-sharing-limited |
collaboration_collector |
direct | registered | onedrive_for_business | collaboration_bundle | — | checks/collaboration/spo-onedrive-sharing-limited.yaml |
— |
spo-sharing-capability-limited |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-sharing-capability-limited.yaml |
— |
spo-unmanaged-device-access |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-unmanaged-device-access.yaml |
— |
spo-verification-reauth |
collaboration_collector |
direct | registered | sharepoint_online | collaboration_bundle | — | checks/collaboration/spo-verification-reauth.yaml |
— |
teams-anonymous-lobby |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-anonymous-lobby.yaml |
— |
teams-anonymous-start-disabled |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-anonymous-start-disabled.yaml |
— |
teams-broadcast-not-always-record |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-broadcast-not-always-record.yaml |
— |
teams-custom-apps-governed |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-custom-apps-governed.yaml |
— |
teams-dialin-lobby |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-dialin-lobby.yaml |
— |
teams-email-integration-disabled |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-email-integration-disabled.yaml |
— |
teams-external-access-per-domain |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-external-access-per-domain.yaml |
— |
teams-external-control-disabled |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-external-control-disabled.yaml |
— |
teams-guest-access-restricted |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-guest-access-restricted.yaml |
— |
teams-internal-auto-admit |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-internal-auto-admit.yaml |
— |
teams-microsoft-apps-governed |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-microsoft-apps-governed.yaml |
— |
teams-recording-disabled |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-recording-disabled.yaml |
— |
teams-third-party-apps-governed |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-third-party-apps-governed.yaml |
— |
teams-unmanaged-inbound-blocked |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-unmanaged-inbound-blocked.yaml |
— |
teams-unmanaged-outbound-blocked |
collaboration_collector |
direct | registered | teams | collaboration_bundle | — | checks/collaboration/teams-unmanaged-outbound-blocked.yaml |
— |
xdr-incident-readiness |
security_alerts_collector |
direct | registered | defender_xdr | security_alerts_bundle | MITRE: T1059; NIST: IR-4, AU-6 | checks/endpoint/xdr-incident-readiness.yaml |
— |
State comes from the runtime registry evaluation mode:
direct (Graph/ARM/bridge), proxy (Secure Score proxy), manual
(operator-confirmed), unsupported (no automated path), or
direct_with_proxy_fallback (direct evidence first, Secure Score only when
direct is unavailable). Per-finding report rows still serialize the observed
mode (direct or proxy) when a dynamic check runs. missing under
Evaluator would be rejected by the reference model, so it cannot appear here.
Pass criteria¶
Customer-facing wording for every check that declares pass_criteria.
These strings also appear on the finding JSON and in the report
("How this is decided").
az-defender-plan-enabled¶
- OK: The paid Defender for Cloud plan is enabled on the subscription with continuous export of findings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: status
endpoint-compliance-noncompliance-action¶
- OK: Every compliance policy has a scheduled action for noncompliant devices.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: compliance_policy_count, policies_with_action
endpoint-compliance-policy-assigned¶
- OK: At least one compliance policy is assigned.
- Partial: Compliance policies exist but leave some platforms out.
- Gap: No compliance policy is assigned.
- Evidence fields: assigned_count, compliance_policy_count, uncovered_platforms
endpoint-enrollment-coverage¶
- OK: Managed-device count meets the expected enrollment denominator.
- Partial: Some licensed or registered devices are not enrolled.
- Gap: Almost none of the expected devices are enrolled.
- Evidence fields: managed_device_count, licensed_units, truncated
endpoint-mde-connector¶
- OK: The Intune to Defender for Endpoint connector is active for the expected devices.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: onboarded_device_count, unhealthy_device_count, unknown_device_count
endpoint-security-baseline¶
- OK: Security baseline profiles are assigned to every managed platform.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: baseline_policy_count, configuration_policy_count
endpoint-security-policy-coverage¶
- OK: Antivirus, firewall, disk encryption, and ASR families are all assigned.
- Partial: Some endpoint-security families are missing.
- Gap: Managed devices lack the expected endpoint-security families.
- Evidence fields: coverage_ratio, covered_families, expected_families
ep-asr-rules¶
- OK: Attack surface reduction rules are configured and assigned.
- Partial: ASR policies exist but cover few rules or few devices.
- Gap: No ASR policy is assigned.
- Evidence fields: assigned_count, asr_policy_count, rules_total
ep-bitlocker-policy¶
- OK: A BitLocker disk-encryption policy is configured and assigned.
- Partial: A BitLocker policy exists but is not assigned widely.
- Gap: No BitLocker policy is assigned.
- Evidence fields: assigned_count, bitlocker_config_count
ep-compliance-enforcement¶
- OK: Managed devices match the expected state, with zero noncompliant devices reported.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: compliance_policy_count, compliant_devices, conflict_devices, error_devices, in_grace_period_devices, managed_devices_total, noncompliant_devices, unknown_devices
ep-mam-app-protection¶
- OK: App protection policies exist and are assigned to protect managed app data.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: app_protection_policy_count, assigned_count, org_wide_count
ep-tamper-protection¶
- OK: Tamper protection is configured, assigned, and reported enabled on sampled devices.
- Partial: A policy exists but some devices still report tamper protection off or unknown.
- Gap: No tamper-protection policy is assigned.
- Evidence fields: assigned_count, tamper_enabled_devices, tamper_disabled_devices, sampled_devices
exo-dkim-enabled¶
- OK: DKIM signing is enabled for every accepted domain.
- Partial: DKIM is enabled for some domains only.
- Gap: DKIM signing is not enabled.
- Evidence fields: disabled_domains, dkim_configs
exo-dmarc-agency-contact¶
- OK: DMARC records include the agency's internal report contact.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: configured, field
exo-dmarc-federal-contact¶
- OK: DMARC records include the required federal report contact.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: configured, field
exo-dmarc-published¶
- OK: Every domain publishes a DMARC record at _dmarc.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: dmarc_missing, domains_checked
exo-dmarc-reject¶
- OK: Every checked domain publishes a DMARC policy of reject.
- Partial: Some domains publish a weaker DMARC policy.
- Gap: Domains are missing a DMARC reject policy.
- Evidence fields: dmarc_not_reject, domains_checked
exo-external-sender-warnings¶
- OK: External mail carries a clear sender warning for users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: external_sender_rule, mail_tips_external_tips
exo-forwarding-external-disabled¶
- OK: Automatic forwarding to external domains is blocked except approved partners.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allowed_forwarding_domains, forwarding_domains, unapproved_forwarding
exo-mailbox-audit-enabled¶
- OK: Mailbox auditing is enabled organization-wide.
- Partial: Mailbox auditing is on for some mailboxes only.
- Gap: Mailbox auditing is disabled organization-wide.
- Evidence fields: audit_disabled
exo-sharing-calendar-not-all-domains¶
- OK: Calendar sharing policies exclude the all-domains scope.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: kind, shares_with_all_domains
exo-sharing-contact-not-all-domains¶
- OK: Contact sharing policies exclude the all-domains scope.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: kind, shares_with_all_domains
exo-smtp-auth-disabled¶
- OK: SMTP AUTH is disabled organization-wide.
- Partial: SMTP AUTH is still allowed for some mailboxes.
- Gap: SMTP AUTH is enabled organization-wide.
- Evidence fields: smtp_client_authentication_disabled
exo-spf-published¶
- OK: Every domain publishes an SPF record that fails unapproved senders.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: domains_checked, spf_missing
id-access-reviews-scope¶
- OK: Access reviews for privileged roles recur on a schedule and have completed at least one round.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: definition_count, definitions_with_completed_rounds, instance_count_by_definition, privileged_recurring_count, privileged_scoped_count
id-access-reviews-unused¶
- OK: Periodic access reviews run for privileged roles and guest access.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: definition_count, definition_ids, privileged_recurring_count, privileged_scoped_count, recurring_count
id-ai-agents-risky-block¶
- OK: Risky AI agents are blocked by Conditional Access or identity protection.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: candidate_policies, manual_fallback
id-app-admin-consent-workflow¶
- OK: Admin consent requests route to reviewers who monitor the queue.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: is_enabled, notify_reviewers
id-app-certificate-lifetime¶
- OK: Application certificates expire within 365 days of issuance.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: long_lived_certificate_count, sample
id-app-expiring-credentials¶
- OK: Application secrets and certificates rotate before expiry.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: already_expired, expired_count, expiring_count, expiring_within_30_days
id-app-ownerless-or-stale¶
- OK: Every application has an owner and current credentials.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: app_count, ownerless_count, ownerless_sample, stale_count, stale_sample
id-app-password-addition-blocked¶
- OK: App passwords that bypass MFA are blocked for all users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enforced_policies
id-app-password-lifetime¶
- OK: Application password credentials expire within 180 days.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: long_lived_password_count, sample
id-app-registration-admin-only¶
- OK: Only administrators can register applications in the tenant.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allowed_to_create_apps
id-app-risky-delegated-consent¶
- OK: Tenant-wide delegated consent grants hold no unused high-impact scopes.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: risky_grant_count, sample
id-app-user-consent-restricted¶
- OK: User consent to applications is restricted so admins review risky permissions.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: permission_grant_policies, unrestricted
id-auth-authenticator-context¶
- OK: Authenticator prompts show the application name and sign-in location.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: authenticator_state, number_matching_enabled, show_app_name, show_location
id-auth-methods-migration¶
- OK: Authentication methods policy migration is finished.
- Partial: Migration is in progress or not finished.
- Gap: Authentication methods still live in the legacy policy surface.
- Evidence fields: policy_migration_state
id-auth-weak-methods-disabled¶
- OK: SMS, voice call, and email one-time codes are disabled.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: configuration_count, enabled_weak_methods
id-break-glass-exclusion¶
- OK: Emergency accounts are declared and every Conditional Access exclusion is justified.
- Partial: Emergency accounts exist, but some exclusions are still unexplained.
- Gap: Emergency accounts are missing, or Conditional Access exclusions are unexplained.
- Evidence fields: declared_break_glass_principal_count, unjustified_exclusion_count, identified_break_glass_accounts
id-ca-device-code-block¶
- OK: Device-code sign-ins are blocked by an enforced Conditional Access policy.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: break_glass_principal_count, enforced_policies, label, report_only_policies, scope_gaps_best, scoped_policies, security_defaults_enabled, universal_policies
id-ca-high-risk-signins¶
- OK: Sign-ins marked high risk are blocked for all users on all cloud apps.
- Partial: A high-risk sign-in block exists but is limited in who or what it covers.
- Gap: High-risk sign-ins are not blocked.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues, protected_population
id-ca-high-risk-users¶
- OK: Accounts marked high user risk by Identity Protection are blocked.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: break_glass_principal_count, enforced_policies, label, protected_population, report_only_policies, scope_gaps_best, scoped_policies, security_defaults_enabled
id-ca-legacy-auth-block¶
- OK: Legacy authentication clients are blocked for all users on all cloud apps.
- Partial: The block exists but is limited to some users, some apps, or extra conditions.
- Gap: Legacy authentication is still allowed.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-ca-managed-devices¶
- OK: Access to cloud apps requires an Intune-marked or hybrid-joined device for all users.
- Partial: A device requirement exists but is limited to some users or some apps.
- Gap: Cloud apps can be reached from unmanaged devices.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-ca-mfa-all-users¶
- OK: An enforced Conditional Access policy requires a second factor for all users across all cloud apps, without risk, location, platform, or client-type limits.
- Partial: MFA is required only for some users, some apps, or with extra limits that leave people out.
- Gap: No enforced all-user MFA policy was found.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-ca-mfa-registration-managed¶
- OK: Security-information registration happens only from managed devices.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: break_glass_principal_count, enforced_policies, label, report_only_policies, scope_gaps_best, scoped_policies, security_defaults_enabled, universal_policies
id-ca-phishing-resistant-all¶
- OK: Every user must use phishing-resistant MFA on all cloud apps.
- Partial: Phishing-resistant MFA applies only to some users or some apps.
- Gap: No tenant-wide phishing-resistant MFA policy is enforced.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-ca-phishing-resistant-privileged¶
- OK: Privileged directory roles must use phishing-resistant MFA on all cloud apps.
- Partial: Privileged MFA exists but is limited to some apps or some roles.
- Gap: Privileged roles are not required to use phishing-resistant MFA.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-ca-priv-gaps¶
- OK: Privileged sign-ins require phishing-resistant MFA and legacy authentication is blocked.
- Partial: Privileged MFA or the legacy-auth block is missing, report-only, or limited in scope.
- Gap: Privileged accounts can sign in without modern MFA, or legacy authentication is still allowed.
- Evidence fields: mfa_covers_privileged, legacy_block_enforced, privileged_principal_count, unjustified_exclusion_issues
id-ca-workload-identity¶
- OK: Workload identities have a risk-based Conditional Access policy.
- Partial: A workload-identity policy exists but is report-only or limited in scope.
- Gap: No risk-based policy protects workload identities.
- Evidence fields: enforced_policies, universal_policies, scoped_policies, scope_gaps_best, security_defaults_enabled, unjustified_exclusion_issues
id-cross-tenant-defaults¶
- OK: Cross-tenant defaults block unknown external tenants until reviewed.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: inbound_access_type
id-cross-tenant-mfa-trust¶
- OK: Multi-factor authentication claims from external tenants are not trusted by default.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: inbound_mfa_trust_default, outbound_mfa_trust_default, partner_count, partner_inbound_mfa_trust_count, partner_outbound_mfa_trust_count
id-dormant-privileged¶
- OK: Privileged accounts have signed in inside the lookback window.
- Partial: Some privileged accounts could not be verified.
- Gap: Privileged accounts have not signed in inside the lookback window.
- Evidence fields: dormant_privileged_users, active_privileged_users, lookback_days, signin_sample_truncated
id-entitlement-access-packages¶
- OK: Entitlement Management access packages are configured for governed access.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: status
id-ga-count-bounds¶
- OK: Between two and eight Global Administrator principals exist in the tenant.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: global_admin_assignment_count, global_admin_principal_count, max_recommended, min_recommended
id-ga-finer-roles¶
- OK: Privileged users hold fine-grained roles instead of standing Global Admin.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: global_admin_principals, other_highly_privileged_assignments
id-guest-directory-access-limited¶
- OK: Guests hold limited directory access as Guest or Restricted Guest users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: guest_user_role_id
id-guest-inviter-restricted¶
- OK: Only Guest Inviter role members and admins can invite guests.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_invites_from
id-identity-protection-workload¶
- OK: No service principals are currently flagged as risky or compromised.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: status
id-idprotect-off¶
- OK: User-risk and sign-in-risk policies are enforced.
- Partial: Only one of the two risk policies is enforced, or both are report-only.
- Gap: Identity Protection risk policies are not enforced.
- Evidence fields: user_risk_enforced, sign_in_risk_enforced, risk_policy_count, protected_population
id-number-matching¶
- OK: Microsoft Authenticator number matching is required.
- Partial: Authenticator is enabled but number matching is not explicitly required.
- Gap: Number matching is not in use.
- Evidence fields: number_matching_state, authenticator_state, number_matching_explicit
id-password-never-expire¶
- OK: User passwords never expire on verified managed domains.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: expiring_domains, never_expire_domains
id-pim-activation-controls¶
- OK: Privileged-role activation requires justification, an authentication context, and a short time limit.
- Partial: Some activation controls are present but not all three.
- Gap: Privileged-role activation is missing justification, an authentication context, or a time cap.
- Evidence fields: justification_required, auth_context_required, activation_duration_capped, policy_count
id-pim-ga-activation-alert¶
- OK: Security is alerted the moment Global Administrator is activated.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: ga_notification_rules
id-pim-ga-activation-approval¶
- OK: A second approver signs off on every Global Administrator activation.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: approval_required_rules, ga_rule_count
id-pim-no-outside-pam¶
- OK: Privileged roles are granted only through PIM eligibility.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: eligible_schedules, standing_highly_privileged_assignments
id-pim-no-permanent-privileged¶
- OK: Highly privileged roles have no standing active assignments.
- Partial: Some standing assignments remain.
- Gap: Highly privileged roles still have permanent active assignments.
- Evidence fields: standing_highly_privileged_assignments, eligible_schedules
id-pim-other-activation-alert¶
- OK: Alerts fire when other highly privileged roles activate.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: notification_rule_count
id-pim-privileged-assignment-alert¶
- OK: Highly privileged role assignments trigger alerts.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: notification_rule_count
id-pim-unused¶
- OK: Privileged access is used through just-in-time activation, not standing roles.
- Partial: PIM is in use but standing privileged assignments remain.
- Gap: Privileged roles are standing assignments rather than just-in-time activation.
- Evidence fields: privileged_permanent_assignments, privileged_eligible_schedules, standing_non_break_glass_assignments
id-priv-cloud-only¶
- OK: Highly privileged accounts are cloud-only.
- Partial: Some privileged accounts could not be classified.
- Gap: Privileged accounts are synced from on-premises directories.
- Evidence fields: cloud_only, hybrid_or_synced, privileged_principals_checked
id-protective-plan-assignment¶
- OK: Protective plans are assigned to at least 85% of enabled member users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: capabilities, enabled_member_users
id-security-defaults-on¶
- OK: Conditional Access policies replace Security Defaults for MFA and legacy-authentication blocking.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: baseline_protections_active, conditional_access_customization_unused, policy_id, security_defaults_enabled
mde-onboard-gap¶
- OK: Onboarded machines meet the active-device denominator (or the licensed-seat signal when no inventory join is available).
- Partial: Onboarding is below the threshold, or only a licensed-seat leverage signal is available.
- Gap: Almost none of the expected devices are onboarded when an authoritative denominator exists.
- Evidence fields: onboarded_machines, licensed_units, coverage_ratio, truncated
mde-sensor-health¶
- OK: Every onboarded device reports an active, in the expected state Defender sensor.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: active_healthy, count_method, health_status_counts, healthy_ratio, impaired_communication, machines_sampled, no_sensor_data, truncated
mdo-anti-spam-no-allowed-domains¶
- OK: Anti-spam policies keep allowed sender and domain lists empty.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allowed_entries
mdo-connection-filter-no-ip-allow¶
- OK: Connection filter policies keep the IP allow list empty.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: ip_allow_list
mdo-connection-filter-no-safe-list¶
- OK: Connection filter policies disable the safe list.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enable_safe_list
mdo-impersonation-domains-owned¶
- OK: Impersonation protection covers every owned organization domain.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-impersonation-partner-domains¶
- OK: Impersonation protection covers profile-listed partner domains.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: partner_domains
mdo-impersonation-users-protected¶
- OK: User impersonation protection covers profile-listed sensitive accounts.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: sensitive_users
mdo-mailbox-intelligence¶
- OK: Mailbox intelligence is enabled on all anti-phish policies.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: mailbox_intelligence_enabled, mailbox_intelligence_missing, policies, surface
mdo-malware-file-filter¶
- OK: The common attachments filter blocks executable attachment types.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-malware-zap¶
- OK: Zero-hour auto purge removes delivered malware from inboxes.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-outbound-spam-forwarding-block¶
- OK: Outbound automatic forwarding is blocked tenant-wide by the outbound spam filter policy.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: forwarding_enabled, policies, surface
mdo-p2-policies-default¶
- OK: Safe Attachments and Safe Links run in block mode for recipients (direct Exchange read, or labeled fallback).
- Partial: Email protections exist but are not in block mode for everyone.
- Gap: Safe Attachments or Safe Links are not protecting recipients.
- Evidence fields: safe_attachments_enabled, safe_links_enabled, preset_enabled, proxy, exchange_direct
mdo-quarantine-policy¶
- OK: End users have limited quarantine access and mail is kept long enough.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: full_access_policies, policies, retention_days, surface
mdo-safe-attachments-block¶
- OK: Safe Attachments blocks detected malware before delivery.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-safe-attachments-spo-teams¶
- OK: Safe Attachments scans files in SharePoint, OneDrive, and Teams.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enable_atp_for_spo_teams_odb
mdo-safe-documents¶
- OK: Safe Documents protects users who open Office files from the internet.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_safe_docs_open, enable_safe_docs
mdo-safe-links-block-list¶
- OK: Safe Links screens URLs in email, Teams, and Office applications.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: email, office, surface, teams
mdo-safe-links-click-through¶
- OK: Safe Links keeps users from clicking through to the original URL.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_click_through, policies, surface
mdo-safe-links-click-tracking¶
- OK: Safe Links records who clicks rewritten URLs.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-safe-links-real-time-scan¶
- OK: Safe Links scans link destinations in real time before delivery.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
mdo-safety-tips-enabled¶
- OK: Anti-phish safety tips warn users about unusual senders.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled_safety_tips, surface
mdo-spam-phish-not-inbox¶
- OK: Spam and phishing messages land in quarantine, not the inbox.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies, weak_actions
mdo-transport-rule-external-forward¶
- OK: No transport rule Bcc's or redirects mail to external domains.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: accepted_domains, external_forward_rules, rules, surface, unresolved_rules
mdo-unified-audit-enabled¶
- OK: Unified audit logging records user and admin activity.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: adapter, unified_audit_ingestion
pbi-export-controls¶
- OK: Power BI data export is turned off for the organization.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-external-invite-disabled¶
- OK: External user invitations are disabled in Power BI tenant settings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-guest-access-disabled¶
- OK: Guest access is disabled in Power BI tenant settings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-premium-capacity-governance¶
- OK: Premium capacities are in use and capacity admins stay limited.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: status
pbi-publish-to-web-disabled¶
- OK: Publish to web is disabled in Power BI tenant settings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-python-r-visuals-disabled¶
- OK: Python and R visuals are disabled in Power BI tenant settings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-resource-key-auth-blocked¶
- OK: Resource key authentication is blocked in Power BI tenant settings.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-sensitivity-labels-enabled¶
- OK: Sensitivity labels are enabled so Power BI content inherits classification.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pbi-sp-api-restricted¶
- OK: Service principal API access is disabled or limited to specific security groups.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, security_groups, surface
pbi-sp-profiles-disabled¶
- OK: Service principals cannot create Power BI profiles.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled, surface
pp-dlp-all-environments¶
- OK: Every environment, including the default, is in the expected state by a DLP policy.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: covered_environments, dlp_policy_count, environment_count, uncovered_environments
pp-dlp-nondefault-envs¶
- OK: A DLP policy protects each non-default Power Platform environment.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: dlp_policy_count, non_default_environment_count, uncovered_nondefault_environments
pp-env-creation-admin-only¶
- OK: Only admins can create Power Platform environments.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
pp-pages-creation-admin-only¶
- OK: Only admins can create Power Pages sites.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
pp-share-with-everyone-disabled¶
- OK: Power Apps sharing with everyone is disabled.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
pp-tenant-isolation-allowlist¶
- OK: Tenant isolation uses an explicit cross-tenant allowlist.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allowed_tenants, isolation_enabled, surface
pp-tenant-isolation-enabled¶
- OK: Tenant isolation blocks cross-tenant connections with an explicit allowlist.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: isolation_enabled, surface
pp-trial-creation-admin-only¶
- OK: Only admins can create Power Platform trial environments.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: property, surface, value
pur-default-and-mandatory-labels¶
- OK: A default sensitivity label is assigned and labeling is required.
- Partial: A default label or mandatory labeling is missing.
- Gap: No default label and no mandatory labeling are configured.
- Evidence fields: default_label, mandatory_labeling, label_policies
pur-dlp-enforcement-block¶
- OK: DLP rule actions block sharing of sensitive information.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: blocking_rules, dlp_rules
pur-dlp-locations-complete¶
- OK: DLP policies cover Exchange, SharePoint, OneDrive, Teams, and devices.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: covered_workloads, workloads
pur-dlp-not-enforced¶
- OK: At least one DLP policy runs in production mode (direct Graph read, or labeled fallback).
- Partial: DLP policies exist but are still in test mode, or only a labeled fallback signal is available.
- Gap: No DLP policy is in production mode.
- Evidence fields: dlp_graph, proxy, source
pur-dlp-notifications¶
- OK: DLP user notifications explain blocked actions to users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: dlp_rules, notifying_rules
pur-dlp-policy-present¶
- OK: An enforced DLP policy protects agency-defined sensitive information.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: dlp_policy_count, enforced_dlp_policies
pur-ediscovery-readiness¶
- OK: Premium eDiscovery cases exist and legal hold workflows are in use.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: case_count, case_names, direct, proxy, source
pur-endpoint-dlp¶
- OK: An enforced DLP policy covers endpoint devices.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: dlp_policy_count, endpoint_dlp_policies
pur-insider-risk-readiness¶
- OK: At least one insider risk policy is live; analytics is enabled.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: direct, policy_count, policy_names, proxy, source
pur-retention-policy-coverage¶
- OK: Retention policies govern content across mail and file workloads.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: absent, adapter, retention_policies, retention_rules
pur-sensitivity-auto-labeling¶
- OK: Sensitive content is classified automatically through auto-labeling policies.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: absent, adapter, auto_labeling, label_policies
pur-sensitivity-labels-published¶
- OK: Sensitivity labels are published through an enabled label policy.
- Partial: Labels exist but are not published.
- Gap: No sensitivity labels are published.
- Evidence fields: published, published_label_policies, sensitivity_labels
sen-analytics-rule-coverage¶
- OK: Enough scheduled analytics rules are enabled across several tactics.
- Partial: Some scheduled rules are enabled, but coverage is thin or dead rules block a pass.
- Gap: Too few scheduled analytics rules are enabled.
- Evidence fields: enabled_scheduled_or_nrt, tactic_count, total_rules, workspace_resource_id
sen-automation-rules¶
- OK: Automation rules trigger playbooks for high-value alerts.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: enabled_automation_rules, playbook_automation_rules, total_automation_rules, workspace_resource_id
sen-data-connectors¶
- OK: Key connectors are connected and at least one table is ingesting.
- Partial: Connectors are connected but Usage shows no ingesting tables, or key connectors are missing.
- Gap: Too few data connectors are connected.
- Evidence fields: connected_connectors, key_connectors_connected, total_connectors, workspace_resource_id
sen-log-analytics-retention¶
- OK: Sentinel workspace retention covers at least 90 days for investigations.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: customer_id, retention_in_days, sku, workspace_resource_id
sen-rule-telemetry-parity¶
- OK: Enabled analytics rules query tables that ingested in the last seven days.
- Partial: Too few rules could be evaluated, or some rules watch empty tables.
- Gap: A large share of evaluable rules watch tables that are not arriving.
- Evidence fields: dead_rule_ratio, dead_rules, evaluable_rules, indeterminate_rules, unwatched_tables
sen-telemetry-ingestion-coverage¶
- OK: Core tables for owned capabilities ingested in the last seven days.
- Partial: Some owned capabilities are missing core tables.
- Gap: Owned capabilities are missing their core tables.
- Evidence fields: capabilities, mode
sen-ueba-not-enabled¶
- OK: UEBA entity behavior analytics is enabled on the Sentinel workspace.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: entity_analytics_enabled, raw_entity_present, raw_ueba_present, setting_names, ueba_enabled, ueba_setting_enabled, workspace_resource_id
spo-anyone-link-expiration¶
- OK: Anyone links expire within 30 days of creation.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: sharing_capability
spo-anyone-link-view¶
- OK: Anyone links grant view-only access to files and folders.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: sharing_capability
spo-default-link-specific¶
- OK: Default sharing links are scoped to specific people only.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: default_link_type
spo-default-link-view¶
- OK: Every newly created sharing link defaults to view-only access.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: default_link_permission
spo-domain-restrictions¶
- OK: External sharing is limited to organization-approved partner domains.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allowed_domains, domain_restriction_mode, sharing_capability
spo-onedrive-sharing-limited¶
- OK: OneDrive sharing is limited to existing guests or internal users only.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: sharing_capability
spo-sharing-capability-limited¶
- OK: SharePoint sharing is limited to existing guests or internal users only.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: sharing_capability
spo-unmanaged-device-access¶
- OK: Unmanaged devices cannot open SharePoint or OneDrive content.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: unmanaged_device_policy
spo-verification-reauth¶
- OK: Verification-code users reauthenticate within 30 days or fewer.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: email_attestation_reauth_days, email_attestation_required, sharing_capability
teams-anonymous-lobby¶
- OK: Anonymous and dial-in callers are held in the meeting lobby.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies
teams-anonymous-start-disabled¶
- OK: Meeting policies block anonymous users from starting any meeting.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies
teams-broadcast-not-always-record¶
- OK: Live events are recorded only when the organizer chooses.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies, weak_policies
teams-custom-apps-governed¶
- OK: Custom app installation is limited to agency-approved apps.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: catalog_types, required_surface, required_surface_incomplete, v2_readable
teams-dialin-lobby¶
- OK: Dial-in callers wait in the meeting lobby.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies
teams-email-integration-disabled¶
- OK: Teams channel email integration is turned off.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_email_into_channel
teams-external-access-per-domain¶
- OK: Teams external access is limited to approved domains only.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_federated_users, allowed_domains
teams-external-control-disabled¶
- OK: Meeting policies deny external participants control over shared screens.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies
teams-guest-access-restricted¶
- OK: Teams guest access is disabled or limited to approved domains.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: allow_guest_calling, allow_guest_chat, allow_guest_user
teams-internal-auto-admit¶
- OK: Internal users are admitted to meetings without waiting in the lobby.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies
teams-microsoft-apps-governed¶
- OK: Microsoft app installation is limited to agency-approved apps.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: catalog_types, required_surface, required_surface_incomplete, v2_readable, weak_policies
teams-recording-disabled¶
- OK: Meeting recording is off by default in meeting policies.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: policies, weak_policies
teams-third-party-apps-governed¶
- OK: Third-party app installation is limited to agency-approved apps.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: catalog_types, required_surface, required_surface_incomplete, v2_readable
teams-unmanaged-inbound-blocked¶
- OK: Unmanaged Teams accounts cannot initiate contact with internal users.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: EnableTeamsConsumerInbound
teams-unmanaged-outbound-blocked¶
- OK: Internal users cannot contact unmanaged Teams accounts.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: EnableTeamsConsumerAccess
xdr-incident-readiness¶
- OK: Defender XDR correlates signals from identity, email, and endpoint into incidents.
- Partial: The expected state is only partly met.
- Gap: The expected state is not met.
- Evidence fields: alert_count, capability_operating, incident_count, service_sources