Coverage reference¶
131 SCuBA policy rows are mapped; 4 are explicitly untracked. All 135 baseline rows at the pinned commit are accounted for. 16 of the mapped rows are coverage gaps: tracked but not automated by LicenseLens.
| Policy ID | Product | Disposition | Local checks | Source |
|---|---|---|---|---|
MS.AAD.1.1v1 |
aad |
implemented_direct |
id-ca-legacy-auth-block | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.2.1v1 |
aad |
implemented_direct |
id-ca-high-risk-users | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.2.2v1 |
aad |
manual |
— | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.2.3v1 |
aad |
implemented_direct |
id-ca-high-risk-signins | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.1v1 |
aad |
implemented_direct |
id-ca-phishing-resistant-all | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.2v2 |
aad |
implemented_direct |
id-ca-mfa-all-users | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.3v2 |
aad |
implemented_direct |
id-auth-authenticator-context | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.4v1 |
aad |
implemented_direct |
id-auth-methods-migration | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.5v2 |
aad |
implemented_direct |
id-auth-weak-methods-disabled | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.6v1 |
aad |
implemented_direct |
id-ca-phishing-resistant-privileged | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.7v1 |
aad |
implemented_direct |
id-ca-managed-devices | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.8v1 |
aad |
implemented_direct |
id-ca-mfa-registration-managed | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.3.9v1 |
aad |
implemented_direct |
id-ca-device-code-block | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.4.1v1 |
aad |
manual |
— | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.1v1 |
aad |
implemented_direct |
id-app-registration-admin-only | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.2v1 |
aad |
implemented_direct |
id-app-user-consent-restricted | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.3v1 |
aad |
implemented_direct |
id-app-admin-consent-workflow | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.5v1 |
aad |
implemented_direct |
id-app-password-addition-blocked | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.6v1 |
aad |
implemented_direct |
id-app-password-lifetime | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.5.7v1 |
aad |
implemented_direct |
id-app-certificate-lifetime | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.6.1v1 |
aad |
implemented_direct |
id-password-never-expire | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.1v1 |
aad |
implemented_direct |
id-ga-count-bounds | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.2v1 |
aad |
implemented_direct |
id-ga-finer-roles | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.3v1 |
aad |
implemented_direct |
id-priv-cloud-only | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.4v1 |
aad |
implemented_direct |
id-pim-no-permanent-privileged | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.5v1 |
aad |
implemented_direct |
id-pim-no-outside-pam | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.6v1 |
aad |
implemented_direct |
id-pim-ga-activation-approval | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.7v1 |
aad |
implemented_direct |
id-pim-privileged-assignment-alert | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.8v1 |
aad |
implemented_direct |
id-pim-ga-activation-alert | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.7.9v1 |
aad |
implemented_direct |
id-pim-other-activation-alert | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.8.1v1 |
aad |
implemented_direct |
id-guest-directory-access-limited | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.8.2v1 |
aad |
implemented_direct |
id-guest-inviter-restricted | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.8.3v1 |
aad |
manual |
— | PowerShell/ScubaGear/baselines/aad.md |
MS.AAD.9.1v1 |
aad |
implemented_direct |
id-ai-agents-risky-block | PowerShell/ScubaGear/baselines/aad.md |
MS.DEFENDER.1.1v1 |
defender |
implemented_proxy |
mdo-p2-policies-default | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.1.2v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.1.3v1 |
defender |
implemented_proxy |
mdo-p2-policies-default | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.1.4v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.1.5v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.2.1v1 |
defender |
implemented_direct |
mdo-impersonation-users-protected | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.2.2v1 |
defender |
implemented_direct |
mdo-impersonation-domains-owned | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.2.3v1 |
defender |
implemented_direct |
mdo-impersonation-partner-domains | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.3.1v1 |
defender |
implemented_direct |
mdo-safe-attachments-spo-teams | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.1v2 |
defender |
implemented_direct |
pur-dlp-policy-present | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.2v1 |
defender |
implemented_direct |
pur-dlp-locations-complete | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.3v1 |
defender |
implemented_direct |
pur-dlp-enforcement-block | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.4v1 |
defender |
implemented_direct |
pur-dlp-notifications | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.5v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.4.6v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.5.1v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.5.2v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.6.1v1 |
defender |
implemented_direct |
mdo-unified-audit-enabled | PowerShell/ScubaGear/baselines/defender.md |
MS.DEFENDER.6.3v1 |
defender |
manual |
— | PowerShell/ScubaGear/baselines/defender.md |
MS.EXO.1.1v2 |
exo |
implemented_direct |
exo-forwarding-external-disabled, mdo-outbound-spam-forwarding-block, mdo-transport-rule-external-forward | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.13.1v1 |
exo |
implemented_direct |
exo-mailbox-audit-enabled | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.2.2v3 |
exo |
implemented_direct |
exo-spf-published | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.3.1v1 |
exo |
implemented_direct |
exo-dkim-enabled | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.4.1v1 |
exo |
implemented_direct |
exo-dmarc-published | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.4.2v1 |
exo |
implemented_direct |
exo-dmarc-reject | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.4.3v1 |
exo |
implemented_direct |
exo-dmarc-federal-contact | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.4.4v1 |
exo |
implemented_direct |
exo-dmarc-agency-contact | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.5.1v1 |
exo |
implemented_direct |
exo-smtp-auth-disabled | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.6.1v1 |
exo |
implemented_direct |
exo-sharing-contact-not-all-domains | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.6.2v1 |
exo |
implemented_direct |
exo-sharing-calendar-not-all-domains | PowerShell/ScubaGear/baselines/exo.md |
MS.EXO.7.1v1 |
exo |
implemented_direct |
exo-external-sender-warnings | PowerShell/ScubaGear/baselines/exo.md |
MS.POWERBI.1.1v1 |
powerbi |
implemented_direct |
pbi-publish-to-web-disabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.2.1v1 |
powerbi |
implemented_direct |
pbi-guest-access-disabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.3.1v1 |
powerbi |
implemented_direct |
pbi-external-invite-disabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.4.1v1 |
powerbi |
implemented_direct |
pbi-sp-api-restricted | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.4.2v1 |
powerbi |
implemented_direct |
pbi-sp-profiles-disabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.5.1v1 |
powerbi |
implemented_direct |
pbi-resource-key-auth-blocked | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.6.1v1 |
powerbi |
implemented_direct |
pbi-python-r-visuals-disabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERBI.7.1v1 |
powerbi |
implemented_direct |
pbi-sensitivity-labels-enabled | PowerShell/ScubaGear/baselines/powerbi.md |
MS.POWERPLATFORM.1.1v1 |
powerplatform |
implemented_direct |
pp-env-creation-admin-only | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.1.2v1 |
powerplatform |
implemented_direct |
pp-trial-creation-admin-only | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.2.1v1 |
powerplatform |
implemented_direct |
pp-dlp-all-environments | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.2.2v1 |
powerplatform |
implemented_direct |
pp-dlp-nondefault-envs | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.3.1v1 |
powerplatform |
implemented_direct |
pp-tenant-isolation-enabled | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.3.2v1 |
powerplatform |
implemented_direct |
pp-tenant-isolation-allowlist | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.4.1v1 |
powerplatform |
manual |
— | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.5.1v1 |
powerplatform |
implemented_direct |
pp-pages-creation-admin-only | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.POWERPLATFORM.6.1v1 |
powerplatform |
implemented_direct |
pp-share-with-everyone-disabled | PowerShell/ScubaGear/baselines/powerplatform.md |
MS.SECURITYSUITE.1.1v1 |
securitysuite |
implemented_direct |
mdo-malware-file-filter | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.1.2v1 |
securitysuite |
implemented_direct |
mdo-malware-zap | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.1.3v1 |
securitysuite |
implemented_direct |
mdo-safe-attachments-block | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.1.4v1 |
securitysuite |
implemented_direct |
mdo-safe-attachments-spo-teams | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.15.2v1 |
securitysuite |
implemented_direct |
mdo-safe-links-real-time-scan | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.2.1v1 |
securitysuite |
implemented_direct |
mdo-impersonation-users-protected, mdo-mailbox-intelligence | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.2.2v1 |
securitysuite |
implemented_direct |
mdo-impersonation-domains-owned | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.2.3v1 |
securitysuite |
implemented_direct |
mdo-impersonation-partner-domains | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.2.4v1 |
securitysuite |
implemented_direct |
mdo-safety-tips-enabled | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.3.1v1 |
securitysuite |
implemented_direct |
pur-dlp-policy-present | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.3.2v1 |
securitysuite |
implemented_direct |
pur-dlp-locations-complete | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.3.3v1 |
securitysuite |
implemented_direct |
pur-dlp-enforcement-block | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.3.4v1 |
securitysuite |
implemented_direct |
pur-dlp-notifications | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.3.5v1 |
securitysuite |
manual |
— | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.4.1v1 |
securitysuite |
manual |
— | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.4.2v1 |
securitysuite |
manual |
— | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.5.1v1 |
securitysuite |
implemented_direct |
mdo-unified-audit-enabled | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.5.2v1 |
securitysuite |
manual |
— | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.6.1v1 |
securitysuite |
implemented_direct |
mdo-spam-phish-not-inbox | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.6.2v1 |
securitysuite |
implemented_direct |
mdo-anti-spam-no-allowed-domains | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.7.1v1 |
securitysuite |
implemented_direct |
mdo-safe-links-block-list | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.7.2v1 |
securitysuite |
implemented_direct |
mdo-safe-links-real-time-scan | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.7.3v1 |
securitysuite |
implemented_direct |
mdo-safe-links-click-tracking | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.8.1v1 |
securitysuite |
implemented_direct |
mdo-connection-filter-no-ip-allow | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SECURITYSUITE.8.2v1 |
securitysuite |
implemented_direct |
mdo-connection-filter-no-safe-list | PowerShell/ScubaGear/baselines/securitysuite.md |
MS.SHAREPOINT.1.1v1 |
sharepoint |
implemented_direct |
spo-sharing-capability-limited | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.1.2v1 |
sharepoint |
implemented_direct |
spo-onedrive-sharing-limited | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.1.3v1 |
sharepoint |
implemented_direct |
spo-domain-restrictions | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.2.1v1 |
sharepoint |
implemented_direct |
spo-default-link-specific | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.2.2v1 |
sharepoint |
implemented_direct |
spo-default-link-view | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.3.1v1 |
sharepoint |
implemented_direct |
spo-anyone-link-expiration | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.3.2v1 |
sharepoint |
implemented_direct |
spo-anyone-link-view | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.3.3v2 |
sharepoint |
implemented_direct |
spo-verification-reauth | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.SHAREPOINT.4.1v1 |
sharepoint |
implemented_direct |
spo-unmanaged-device-access | PowerShell/ScubaGear/baselines/sharepoint.md |
MS.TEAMS.1.1v1 |
teams |
implemented_direct |
teams-external-control-disabled | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.2v2 |
teams |
implemented_direct |
teams-anonymous-start-disabled | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.3v1 |
teams |
implemented_direct |
teams-anonymous-lobby | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.4v1 |
teams |
implemented_direct |
teams-internal-auto-admit | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.5v1 |
teams |
implemented_direct |
teams-dialin-lobby | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.6v1 |
teams |
implemented_direct |
teams-recording-disabled | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.1.7v2 |
teams |
implemented_direct |
teams-broadcast-not-always-record | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.2.1v2 |
teams |
implemented_direct |
teams-external-access-per-domain | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.2.2v2 |
teams |
implemented_direct |
teams-unmanaged-inbound-blocked | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.2.3v2 |
teams |
implemented_direct |
teams-unmanaged-outbound-blocked | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.3.1v1 |
teams |
implemented_direct |
teams-guest-access-restricted | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.4.1v1 |
teams |
implemented_direct |
teams-email-integration-disabled | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.5.1v2 |
teams |
implemented_direct |
teams-microsoft-apps-governed | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.5.2v2 |
teams |
implemented_direct |
teams-third-party-apps-governed | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.5.3v2 |
teams |
implemented_direct |
teams-custom-apps-governed | PowerShell/ScubaGear/baselines/teams.md |
Coverage gaps¶
The following 16 policies are tracked but not automated. They disclose the SCuBA source path so the gap is auditable.
MS.AAD.2.2v1(aad, manual)MS.AAD.4.1v1(aad, manual)MS.AAD.8.3v1(aad, manual)MS.DEFENDER.1.2v1(defender, manual)MS.DEFENDER.1.4v1(defender, manual)MS.DEFENDER.1.5v1(defender, manual)MS.DEFENDER.4.5v1(defender, manual)MS.DEFENDER.4.6v1(defender, manual)MS.DEFENDER.5.1v1(defender, manual)MS.DEFENDER.5.2v1(defender, manual)MS.DEFENDER.6.3v1(defender, manual)MS.POWERPLATFORM.4.1v1(powerplatform, manual)MS.SECURITYSUITE.3.5v1(securitysuite, manual)MS.SECURITYSUITE.4.1v1(securitysuite, manual)MS.SECURITYSUITE.4.2v1(securitysuite, manual)MS.SECURITYSUITE.5.2v1(securitysuite, manual)
implemented_direct rows map to direct Graph/ARM/bridge evaluation and
implemented_proxy rows to Secure Score proxy checks; both carry their local
check ids and pinned SCuBA source path.
Explicitly untracked baseline rows¶
The following 4 baseline rows are explicitly untracked: superseded or removed upstream, with the disposition recorded.
| Policy ID | Product | Rationale | Source |
|---|---|---|---|
MS.EXO.16.1v1 |
exo |
Removed upstream; reworked into mapped MS.SECURITYSUITE.4.1v1. | PowerShell/ScubaGear/baselines/defender.md |
MS.TEAMS.5.1v1 |
teams |
Legacy v1 superseded by mapped MS.TEAMS.5.1v2. | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.5.2v1 |
teams |
Legacy v1 superseded by mapped MS.TEAMS.5.2v2. | PowerShell/ScubaGear/baselines/teams.md |
MS.TEAMS.5.3v1 |
teams |
Legacy v1 superseded by mapped MS.TEAMS.5.3v2. | PowerShell/ScubaGear/baselines/teams.md |
Intentionally excluded¶
The following product-scope items are deliberately out of LicenseLens's thesis (the maturity plan's explicit reject list). Each carries its reason, so nothing is missing merely because nobody remembered it.
| Item | Reason |
|---|---|
| Automatic remediation / write-back | Read-only tool by design (docs/limitations.md); the remediation loop uses the portal deep link plus rescan. |
| Azure Defender for Cloud / CSPM expansion | Outside M365-entitlement realization; the az-cspm-out-of-scope check flags that boundary explicitly. |
| Azure resource posture (NSGs, key vaults, storage) | Not LicenseLens's job — the product assesses M365 entitlements, not Azure infrastructure hardening. |
| Entra Verified ID / decentralized identity | Niche identity scenario, not an entitlement-realization control. |
| Microsoft Sentinel depth | Azure-billed surface, not an M365 entitlement; the five existing sentinel checks are the coverage ceiling. |
| SaaS backend, dashboards, telemetry, database | Out of thesis (product brief): local, offline, self-contained tooling only. |