{"capabilities":[{"backends":["graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/entra/identity/conditional-access/overview","entitlement_kind":"included","id":"conditional_access","required_by_checks":["id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-break-glass-exclusion","id-ca-device-code-block","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-cross-tenant-defaults","id-cross-tenant-mfa-trust","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-logs-to-soc","id-number-matching","id-password-never-expire","id-security-defaults-on"],"service_plan_aliases":[],"service_plan_names":["AAD_PREMIUM","AAD_PREMIUM_P2"],"sku_aliases":["SPE_E3_USGOV_GCCHIGH","SPE_E5_USGOV_DOD","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["AAD_PREMIUM","AAD_PREMIUM_P2","ENTERPRISEPREMIUM","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["identity"]},{"backends":["graph","mde"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-endpoint/defender-endpoint-plan-1-2","entitlement_kind":"add_on","id":"defender_endpoint_p1","required_by_checks":["ep-asr-rules","ep-tamper-protection","mde-onboard-gap","mde-sensor-health"],"service_plan_aliases":[],"service_plan_names":["DEFENDER_ENDPOINT_P1","MDE_LITE","MDE_P1"],"sku_aliases":[],"sku_part_numbers":["DEFENDER_ENDPOINT_P1","IDENTITY_THREAT_PROTECTION","MDE_P1","SPE_E3"],"source_version":"2026-08","workloads":["defender","endpoint"]},{"backends":["graph","mde"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-endpoint/onboarding","entitlement_kind":"included","id":"defender_endpoint_p2","required_by_checks":["ep-asr-rules","ep-tamper-protection","id-protective-plan-assignment","mde-onboard-gap","mde-sensor-health"],"service_plan_aliases":["WINDEFATP"],"service_plan_names":["DEFENDER_ENDPOINT_P2","MDATP_XPLAT"],"sku_aliases":["DEFENDER_ENDPOINT_P2_GOV","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["DEFENDER_ENDPOINT_P2","IDENTITY_THREAT_PROTECTION","SPE_E5"],"source_version":"2026-08","workloads":["defender","endpoint"]},{"backends":["arm"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/azure/defender-for-cloud/concept-cloud-security-posture-management","entitlement_kind":"consumption","id":"defender_for_cloud_cspm","required_by_checks":["az-cspm-out-of-scope","az-defender-plan-enabled"],"service_plan_aliases":[],"service_plan_names":[],"sku_aliases":[],"sku_part_numbers":[],"source_version":"2026-08","workloads":["azure","defender"]},{"backends":["arm"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/azure/defender-for-cloud/defender-for-servers-introduction","entitlement_kind":"consumption","id":"defender_for_cloud_servers","required_by_checks":["az-defender-plan-enabled"],"service_plan_aliases":[],"service_plan_names":[],"sku_aliases":[],"sku_part_numbers":[],"source_version":"2026-08","workloads":["azure","defender"]},{"backends":["graph","manual"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-for-identity/deploy-defender-identity","entitlement_kind":"included","id":"defender_identity","required_by_checks":["mdi-sensors-missing"],"service_plan_aliases":["Microsoft_Defender_for_Identity"],"service_plan_names":["ATA","MDI_Service_Plan"],"sku_aliases":[],"sku_part_numbers":["EMSPREMIUM","ENTERPRISEPREMIUM","SPE_E5"],"source_version":"2026-08","workloads":["defender","identity"]},{"backends":["exchange_powershell","graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-office-365/defender-for-office-365","entitlement_kind":"add_on","id":"defender_office_p1","required_by_checks":["mdo-alert-policies-enabled","mdo-malware-file-filter","mdo-malware-zap"],"service_plan_aliases":[],"service_plan_names":["ATP_ENTERPRISE"],"sku_aliases":[],"sku_part_numbers":["ATP_ENTERPRISE","ENTERPRISEPREMIUM","IDENTITY_THREAT_PROTECTION","SPE_E5"],"source_version":"2026-08","workloads":["defender","exchange"]},{"backends":["exchange_powershell","graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-office-365/preset-security-policies","entitlement_kind":"included","id":"defender_office_p2","required_by_checks":["id-protective-plan-assignment","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-mailbox-intelligence","mdo-p2-policies-default","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-documents","mdo-safe-links-block-list","mdo-safe-links-click-through","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled"],"service_plan_aliases":["THREAT_INTELLIGENCE_GOV"],"service_plan_names":["ATP_ENTERPRISE","THREAT_INTELLIGENCE"],"sku_aliases":["IDENTITY_THREAT_PROTECTION_GOV","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["ENTERPRISEPREMIUM","IDENTITY_THREAT_PROTECTION","SPE_E5"],"source_version":"2026-08","workloads":["defender","exchange"]},{"backends":["graph","mde"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-xdr/microsoft-365-defender","entitlement_kind":"included","id":"defender_xdr","required_by_checks":["xdr-incident-readiness"],"service_plan_aliases":["WINDEFATP"],"service_plan_names":["ATA","DEFENDER_ENDPOINT_P2","MDI_Service_Plan","THREAT_INTELLIGENCE"],"sku_aliases":["IDENTITY_THREAT_PROTECTION_GOV","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["EMSPREMIUM","IDENTITY_THREAT_PROTECTION","SPE_E5"],"source_version":"2026-08","workloads":["defender"]},{"backends":["graph"],"clouds":["commercial"],"docs_url":"https://learn.microsoft.com/entra/id-governance/entitlement-management-overview","entitlement_kind":"add_on","id":"entitlement_management","required_by_checks":["id-entitlement-access-packages"],"service_plan_aliases":[],"service_plan_names":["Entra_Identity_Governance"],"sku_aliases":[],"sku_part_numbers":["Microsoft_Entra_ID_Governance"],"source_version":"2026-08","workloads":["identity"]},{"backends":["graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-configure","entitlement_kind":"included","id":"entra_id_p2","required_by_checks":["id-access-reviews-scope","id-access-reviews-unused","id-break-glass-exclusion","id-dormant-privileged","id-ga-count-bounds","id-ga-finer-roles","id-pim-activation-controls","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-protective-plan-assignment"],"service_plan_aliases":["AAD_PREMIUM_P2_FOR_FACULTY"],"service_plan_names":["AAD_PREMIUM_P2"],"sku_aliases":["M365_E5_GOV","SPE_E5_USGOV_DOD","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["AAD_PREMIUM_P2","EMSPREMIUM","ENTERPRISEPREMIUM","SPE_E5"],"source_version":"2026-08","workloads":["identity"]},{"backends":["exchange_powershell","graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/exchange/exchange-online","entitlement_kind":"base","id":"exchange_online","required_by_checks":["exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published"],"service_plan_aliases":["EXCHANGE_S_ENTERPRISE_GOV","EXCHANGE_S_STANDARD_GOV"],"service_plan_names":["EXCHANGESTANDARD","EXCHANGE_S_ENTERPRISE","EXCHANGE_S_STANDARD"],"sku_aliases":["SPE_E3_USGOV_GCCHIGH","SPE_E5_USGOV_DOD","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","EXCHANGEENTERPRISE","EXCHANGESTANDARD","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["exchange"]},{"backends":["exchange_powershell","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/defender-office-365/eop-about","entitlement_kind":"included","id":"exchange_online_protection","required_by_checks":["mdo-anti-spam-no-allowed-domains","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-outbound-spam-forwarding-block","mdo-quarantine-policy","mdo-spam-phish-not-inbox","mdo-transport-rule-external-forward"],"service_plan_aliases":["EOP_ENTERPRISE_PREMIUM"],"service_plan_names":["EOP_ENTERPRISE","EXCHANGE_S_FOUNDATION"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","EXCHANGEENTERPRISE","EXCHANGESTANDARD","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["defender","exchange"]},{"backends":["graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/entra/id-protection/overview-identity-protection","entitlement_kind":"included","id":"identity_protection","required_by_checks":["id-ai-agents-risky-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-idprotect-notify-high-risk","id-idprotect-off","id-protective-plan-assignment"],"service_plan_aliases":[],"service_plan_names":["AAD_PREMIUM_P2"],"sku_aliases":["SPE_E5_USGOV_DOD","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["AAD_PREMIUM_P2","ENTERPRISEPREMIUM","SPE_E5"],"source_version":"2026-08","workloads":["identity"]},{"backends":["graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/mem/intune/fundamentals/what-is-intune","entitlement_kind":"included","id":"intune","required_by_checks":["endpoint-compliance-noncompliance-action","endpoint-compliance-policy-assigned","endpoint-enrollment-coverage","endpoint-mde-connector","endpoint-security-baseline","endpoint-security-policy-coverage","ep-bitlocker-policy","ep-compliance-enforcement","ep-mam-app-protection","id-ca-managed-devices","id-ca-mfa-registration-managed"],"service_plan_aliases":["INTUNE_A_GOV","INTUNE_EDU"],"service_plan_names":["INTUNE_A","INTUNE_A_VL","MDM_SALES_COLLABORATION"],"sku_aliases":["SPE_E3_USGOV_GCCHIGH","SPE_E5_USGOV_DOD","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["EMSPREMIUM","ENTERPRISEPACK","ENTERPRISEPREMIUM","INTUNE_A","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["endpoint","intune"]},{"backends":["arm"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/azure/azure-monitor/logs/log-analytics-overview","entitlement_kind":"consumption","id":"log_analytics","required_by_checks":["sen-log-analytics-retention"],"service_plan_aliases":[],"service_plan_names":[],"sku_aliases":[],"sku_part_numbers":[],"source_version":"2026-08","workloads":["azure","sentinel"]},{"backends":["arm","graph"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/azure/sentinel/overview","entitlement_kind":"consumption","id":"microsoft_sentinel","required_by_checks":["sen-analytics-rule-coverage","sen-automation-rules","sen-data-connectors","sen-entra-diagnostics-routed","sen-log-analytics-retention","sen-rule-telemetry-parity","sen-telemetry-ingestion-coverage","sen-ueba-not-enabled"],"service_plan_aliases":[],"service_plan_names":[],"sku_aliases":[],"sku_part_numbers":[],"source_version":"2026-08","workloads":["sentinel"]},{"backends":["graph","sharepoint_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/onedrive/onedrive-admin","entitlement_kind":"included","id":"onedrive_for_business","required_by_checks":["spo-onedrive-sharing-limited"],"service_plan_aliases":[],"service_plan_names":["ONEDRIVESTANDARD","SHAREPOINTENTERPRISE","SHAREPOINTWAC"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["collaboration"]},{"backends":["graph","power_bi"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/power-bi/enterprise/service-premium-per-user-faq","entitlement_kind":"add_on","id":"power_bi_premium","required_by_checks":["pbi-premium-capacity-governance"],"service_plan_aliases":[],"service_plan_names":["BI_AZURE_P3","POWER_BI_PREMIUM_PER_USER"],"sku_aliases":[],"sku_part_numbers":["PBI_PREMIUM_PER_USER","POWER_BI_PREMIUM_PER_USER"],"source_version":"2026-08","workloads":["power_bi"]},{"backends":["graph","power_bi"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/power-bi/enterprise/service-admin-planning","entitlement_kind":"base","id":"power_bi_pro","required_by_checks":["pbi-export-controls","pbi-external-invite-disabled","pbi-guest-access-disabled","pbi-publish-to-web-disabled","pbi-python-r-visuals-disabled","pbi-resource-key-auth-blocked","pbi-sensitivity-labels-enabled","pbi-sp-api-restricted","pbi-sp-profiles-disabled"],"service_plan_aliases":["BI_AZURE_P_2_GOV"],"service_plan_names":["BI_AZURE_P2","POWER_BI_PRO","POWER_BI_STANDARD"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","POWER_BI_PRO","POWER_BI_STANDARD","SPE_E5"],"source_version":"2026-08","workloads":["power_bi"]},{"backends":["graph","power_platform"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/power-platform/admin/admin-documentation","entitlement_kind":"included","id":"power_platform","required_by_checks":["pp-dlp-all-environments","pp-dlp-nondefault-envs","pp-env-creation-admin-only","pp-pages-creation-admin-only","pp-share-with-everyone-disabled","pp-tenant-isolation-allowlist","pp-tenant-isolation-enabled","pp-trial-creation-admin-only"],"service_plan_aliases":["FLOW_PER_USER","POWERAPPS_PER_USER"],"service_plan_names":["FLOW_O365_P2","FLOW_O365_P3","POWERAPPS_O365_P2","POWERAPPS_O365_P3"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","FLOW_PER_USER","POWERAPPS_PER_USER","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["power_platform"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/audit-solutions-overview","entitlement_kind":"included","id":"purview_audit","required_by_checks":["mdo-audit-retention","mdo-unified-audit-enabled"],"service_plan_aliases":["AUDIT_ENTERPRISE"],"service_plan_names":["EQUIVIO_ANALYTICS","M365_ADVANCED_AUDITING"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/communication-compliance","entitlement_kind":"add_on","id":"purview_communication_compliance","required_by_checks":["pur-communication-compliance-readiness"],"service_plan_aliases":[],"service_plan_names":["COMMUNICATION_COMPLIANCE","COMM_COMPLIANCE"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/dlp-learn-about-dlp","entitlement_kind":"included","id":"purview_dlp","required_by_checks":["id-protective-plan-assignment","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-not-enforced","pur-dlp-notifications","pur-dlp-policy-present","pur-endpoint-dlp"],"service_plan_aliases":["MIP_S_CLP1"],"service_plan_names":["INFORMATION_BARRIERS","MIP_S_CLP2"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/ediscovery","entitlement_kind":"included","id":"purview_ediscovery","required_by_checks":["pur-ediscovery-readiness"],"service_plan_aliases":["M365_ADVANCED_AUDITING"],"service_plan_names":["EQUIVIO_ANALYTICS","EXCHANGE_ANALYTICS","LOCKBOX_ENTERPRISE"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/insider-risk-management","entitlement_kind":"add_on","id":"purview_insider_risk","required_by_checks":["pur-insider-risk-readiness"],"service_plan_aliases":[],"service_plan_names":["INSIDER_RISK_MANAGEMENT","MIR_SERVICE"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","INSIDER_RISK_MANAGEMENT","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/retention","entitlement_kind":"included","id":"purview_retention","required_by_checks":["pur-retention-policy-coverage"],"service_plan_aliases":[],"service_plan_names":["Data_Lifecycle_Management","Records_Management"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","security_compliance_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/purview/sensitivity-labels","entitlement_kind":"included","id":"purview_sensitivity_labels","required_by_checks":["pur-default-and-mandatory-labels","pur-sensitivity-auto-labeling","pur-sensitivity-labels-published"],"service_plan_aliases":[],"service_plan_names":["INFORMATION_PROTECTION_COMPLIANCE","MIP_S_CLP1","MIP_S_CLP2"],"sku_aliases":[],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","INFORMATION_PROTECTION_COMPLIANCE","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["purview"]},{"backends":["graph","sharepoint_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/sharepoint/introduction","entitlement_kind":"base","id":"sharepoint_online","required_by_checks":["spo-anyone-link-expiration","spo-anyone-link-view","spo-default-link-specific","spo-default-link-view","spo-domain-restrictions","spo-sharing-capability-limited","spo-unmanaged-device-access","spo-verification-reauth"],"service_plan_aliases":["SHAREPOINTENTERPRISE_GOV"],"service_plan_names":["SHAREPOINTENTERPRISE","SHAREPOINTSTANDARD","SHAREPOINTWAC"],"sku_aliases":["SPE_E3_USGOV_GCCHIGH","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","SHAREPOINTENTERPRISE","SHAREPOINTSTANDARD","SPE_E3","SPE_E5"],"source_version":"2026-08","workloads":["collaboration"]},{"backends":["graph","teams_powershell"],"clouds":["commercial","dod","gcc","gcc_high"],"docs_url":"https://learn.microsoft.com/microsoftteams/teams-overview","entitlement_kind":"base","id":"teams","required_by_checks":["teams-anonymous-lobby","teams-anonymous-start-disabled","teams-broadcast-not-always-record","teams-custom-apps-governed","teams-dialin-lobby","teams-email-integration-disabled","teams-external-access-per-domain","teams-external-control-disabled","teams-guest-access-restricted","teams-internal-auto-admit","teams-microsoft-apps-governed","teams-recording-disabled","teams-third-party-apps-governed","teams-unmanaged-inbound-blocked","teams-unmanaged-outbound-blocked"],"service_plan_aliases":["MCOSTANDARD_GOV","TEAMS_GOV"],"service_plan_names":["MCOSTANDARD","TEAMS1","TEAMS_COMMERCIAL_TRIAL"],"sku_aliases":["SPE_E3_USGOV_GCCHIGH","SPE_E5_USGOV_GCCHIGH"],"sku_part_numbers":["ENTERPRISEPACK","ENTERPRISEPREMIUM","SPE_E3","SPE_E5","TEAMS_EXPLORATORY"],"source_version":"2026-08","workloads":["collaboration","teams"]},{"backends":["graph"],"clouds":["commercial"],"docs_url":"https://learn.microsoft.com/entra/workload-id/workload-identities-overview","entitlement_kind":"add_on","id":"workload_identities_premium","required_by_checks":["id-ca-workload-identity","id-identity-protection-workload"],"service_plan_aliases":["AAD_WRKLDID_P1"],"service_plan_names":["AAD_WRKLDID_P2"],"sku_aliases":[],"sku_part_numbers":["Workload_Identities_P2","Workload_Identities_Premium_CN"],"source_version":"2026-08","workloads":["identity"]}],"checks":[{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"az-cspm-out-of-scope","mappings":{},"required_capabilities":["defender_for_cloud_cspm"],"source_path":"checks/azure/az-cspm-out-of-scope.yaml","support_state":"manual"},{"collector":"defender_pricings_collector","evaluator_registered":true,"evidence_keys":["defender_for_cloud_pricings"],"flagship":false,"flagship_security_intent":"","id":"az-defender-plan-enabled","mappings":{},"required_capabilities":["defender_for_cloud_cspm","defender_for_cloud_servers"],"source_path":"checks/azure/az-defender-plan-enabled.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":false,"flagship_security_intent":"","id":"endpoint-compliance-noncompliance-action","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-2"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-compliance-noncompliance-action.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Define and assign Intune compliance policies so unhealthy devices are flagged and gated from work data.","id":"endpoint-compliance-policy-assigned","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-2"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-compliance-policy-assigned.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Enroll licensed devices into Intune so cloud identity and compliance controls reach every endpoint.","id":"endpoint-enrollment-coverage","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-2"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-enrollment-coverage.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":false,"flagship_security_intent":"","id":"endpoint-mde-connector","mappings":{"mitre":["T1059"],"nist":["SI-3","SI-4"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-mde-connector.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":false,"flagship_security_intent":"","id":"endpoint-security-baseline","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-2"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-security-baseline.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Cover managed devices with antivirus, firewall, disk-encryption, and ASR endpoint-security policies.","id":"endpoint-security-policy-coverage","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-3"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/endpoint-security-policy-coverage.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Configure and assign attack surface reduction rules to block ransomware and fileless malware behaviors.","id":"ep-asr-rules","mappings":{"mitre":["T1059","T1204"],"nist":["SI-3","CM-6"]},"required_capabilities":["defender_endpoint_p1","defender_endpoint_p2"],"source_path":"checks/endpoint/asr-rules.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Configure and assign a BitLocker disk-encryption policy so lost or stolen devices do not leak data.","id":"ep-bitlocker-policy","mappings":{"mitre":["T1486","T1040"],"nist":["SC-28","CM-6"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/bitlocker-policy.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":false,"flagship_security_intent":"","id":"ep-compliance-enforcement","mappings":{"mitre":["T1059"],"nist":["CM-6","SI-2"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/compliance-enforcement.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":false,"flagship_security_intent":"","id":"ep-mam-app-protection","mappings":{"mitre":["T1040","T1486"],"nist":["SC-28","AC-3"]},"required_capabilities":["intune"],"source_path":"checks/endpoint/mam-app-protection.yaml","support_state":"direct"},{"collector":"intune_collector","evaluator_registered":true,"evidence_keys":["intune_bundle"],"flagship":true,"flagship_security_intent":"Configure, assign, and prove tamper protection enabled so malware cannot silently disable Defender.","id":"ep-tamper-protection","mappings":{"mitre":["T1562"],"nist":["SI-3","SI-7"]},"required_capabilities":["defender_endpoint_p1","defender_endpoint_p2"],"source_path":"checks/endpoint/tamper-protection.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":true,"flagship_security_intent":"Enable DKIM signing for every accepted domain so unsigned mail is not trusted or spoofed.","id":"exo-dkim-enabled","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-dkim-enabled.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["dns_records"],"flagship":false,"flagship_security_intent":"","id":"exo-dmarc-agency-contact","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-dmarc-agency-contact.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["dns_records"],"flagship":false,"flagship_security_intent":"","id":"exo-dmarc-federal-contact","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-dmarc-federal-contact.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["dns_records"],"flagship":false,"flagship_security_intent":"","id":"exo-dmarc-published","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-dmarc-published.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["dns_records"],"flagship":true,"flagship_security_intent":"Set every domain's DMARC policy to reject so spoofed mail cannot reach inboxes.","id":"exo-dmarc-reject","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-dmarc-reject.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"exo-external-sender-warnings","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-external-sender-warnings.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"exo-forwarding-external-disabled","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-forwarding-external-disabled.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":true,"flagship_security_intent":"Keep mailbox auditing enabled organization-wide so illicit mailbox access is investigable.","id":"exo-mailbox-audit-enabled","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-mailbox-audit-enabled.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"exo-sharing-calendar-not-all-domains","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-sharing-calendar-not-all-domains.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"exo-sharing-contact-not-all-domains","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-sharing-contact-not-all-domains.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":true,"flagship_security_intent":"Disable SMTP AUTH organization-wide so basic-auth email submission cannot bypass modern sign-in protections.","id":"exo-smtp-auth-disabled","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-smtp-auth-disabled.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["dns_records"],"flagship":false,"flagship_security_intent":"","id":"exo-spf-published","mappings":{},"required_capabilities":["exchange_online"],"source_path":"checks/exchange/exo-spf-published.yaml","support_state":"direct"},{"collector":"graph_access_reviews","evaluator_registered":true,"evidence_keys":["access_review_definitions","access_review_instances"],"flagship":false,"flagship_security_intent":"","id":"id-access-reviews-scope","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-access-reviews-scope.yaml","support_state":"direct"},{"collector":"graph_access_reviews","evaluator_registered":true,"evidence_keys":["access_review_definitions"],"flagship":false,"flagship_security_intent":"","id":"id-access-reviews-unused","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-access-reviews-unused.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["ca_policies"],"flagship":false,"flagship_security_intent":"","id":"id-ai-agents-risky-block","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["identity_protection"],"source_path":"checks/identity/id-ai-agents-risky-block.yaml","support_state":"direct"},{"collector":"graph_authorization","evaluator_registered":true,"evidence_keys":["admin_consent_request_policy"],"flagship":false,"flagship_security_intent":"","id":"id-app-admin-consent-workflow","mappings":{"mitre":["T1098"],"nist":["AC-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-admin-consent-workflow.yaml","support_state":"direct"},{"collector":"graph_applications","evaluator_registered":true,"evidence_keys":["applications_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-app-certificate-lifetime","mappings":{"mitre":["T1098"],"nist":["IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-certificate-lifetime.yaml","support_state":"direct"},{"collector":"graph_applications","evaluator_registered":true,"evidence_keys":["applications_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-app-expiring-credentials","mappings":{"mitre":["T1098"],"nist":["IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-expiring-credentials.yaml","support_state":"direct"},{"collector":"graph_applications","evaluator_registered":true,"evidence_keys":["applications_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-app-ownerless-or-stale","mappings":{"mitre":["T1098"],"nist":["AC-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-ownerless-or-stale.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["ca_policies"],"flagship":false,"flagship_security_intent":"","id":"id-app-password-addition-blocked","mappings":{"mitre":["T1098"],"nist":["IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-password-addition-blocked.yaml","support_state":"direct"},{"collector":"graph_applications","evaluator_registered":true,"evidence_keys":["applications_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-app-password-lifetime","mappings":{"mitre":["T1098"],"nist":["IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-password-lifetime.yaml","support_state":"direct"},{"collector":"graph_authorization","evaluator_registered":true,"evidence_keys":["authorization_policy"],"flagship":false,"flagship_security_intent":"","id":"id-app-registration-admin-only","mappings":{"mitre":["T1098"],"nist":["AC-2","AC-6"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-registration-admin-only.yaml","support_state":"direct"},{"collector":"graph_applications","evaluator_registered":true,"evidence_keys":["applications_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-app-risky-delegated-consent","mappings":{"mitre":["T1098"],"nist":["AC-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-risky-delegated-consent.yaml","support_state":"direct"},{"collector":"graph_authorization","evaluator_registered":true,"evidence_keys":["authorization_policy"],"flagship":false,"flagship_security_intent":"","id":"id-app-user-consent-restricted","mappings":{"mitre":["T1098"],"nist":["AC-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-app-user-consent-restricted.yaml","support_state":"direct"},{"collector":"graph_auth_methods","evaluator_registered":true,"evidence_keys":["auth_methods_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-auth-authenticator-context","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-auth-authenticator-context.yaml","support_state":"direct"},{"collector":"graph_auth_methods","evaluator_registered":true,"evidence_keys":["auth_methods_bundle"],"flagship":true,"flagship_security_intent":"Complete the authentication methods policy migration so MFA and SSPR settings live in one place.","id":"id-auth-methods-migration","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-auth-methods-migration.yaml","support_state":"direct"},{"collector":"graph_auth_methods","evaluator_registered":true,"evidence_keys":["auth_methods_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-auth-weak-methods-disabled","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-auth-weak-methods-disabled.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","role_assignments","role_eligibilities"],"flagship":true,"flagship_security_intent":"Maintain documented break-glass emergency accounts and justify every Conditional Access exclusion.","id":"id-break-glass-exclusion","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["conditional_access","entra_id_p2"],"source_path":"checks/identity/id-break-glass-exclusion.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":false,"flagship_security_intent":"","id":"id-ca-device-code-block","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-device-code-block.yaml","support_state":"direct"},{"collector":"graph_identity_protection","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Block sign-ins marked high risk by Identity Protection via Conditional Access.","id":"id-ca-high-risk-signins","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["identity_protection"],"source_path":"checks/identity/id-ca-high-risk-signins.yaml","support_state":"direct"},{"collector":"graph_identity_protection","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":false,"flagship_security_intent":"","id":"id-ca-high-risk-users","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["identity_protection"],"source_path":"checks/identity/id-ca-high-risk-users.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Block legacy authentication clients tenant-wide so outdated sign-in methods cannot bypass modern MFA.","id":"id-ca-legacy-auth-block","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-legacy-auth-block.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Require compliant or hybrid-joined managed devices for cloud app access via Conditional Access.","id":"id-ca-managed-devices","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["conditional_access","intune"],"source_path":"checks/identity/id-ca-managed-devices.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Require multi-factor authentication for every user via Conditional Access to prevent password-only sign-in.","id":"id-ca-mfa-all-users","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-mfa-all-users.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":false,"flagship_security_intent":"","id":"id-ca-mfa-registration-managed","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access","intune"],"source_path":"checks/identity/id-ca-mfa-registration-managed.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Require phishing-resistant MFA for all users via Conditional Access to defeat phishing of ordinary MFA methods.","id":"id-ca-phishing-resistant-all","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-phishing-resistant-all.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","ca_policies","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Require phishing-resistant MFA for highly privileged directory roles via Conditional Access.","id":"id-ca-phishing-resistant-privileged","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-phishing-resistant-privileged.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["ca_policies","role_assignments","security_defaults_policy"],"flagship":true,"flagship_security_intent":"Gate privileged sign-ins with phishing-resistant MFA and block legacy authentication via Conditional Access.","id":"id-ca-priv-gaps","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-ca-priv-gaps.yaml","support_state":"direct"},{"collector":"graph_ca","evaluator_registered":true,"evidence_keys":["ca_policies"],"flagship":true,"flagship_security_intent":"Protect workload identities (service principals) with risk-based Conditional Access policies.","id":"id-ca-workload-identity","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["workload_identities_premium"],"source_path":"checks/identity/id-ca-workload-identity.yaml","support_state":"direct"},{"collector":"graph_guests","evaluator_registered":true,"evidence_keys":["guests_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-cross-tenant-defaults","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-3"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-cross-tenant-defaults.yaml","support_state":"direct"},{"collector":"graph_guests","evaluator_registered":true,"evidence_keys":["guests_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-cross-tenant-mfa-trust","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-cross-tenant-mfa-trust.yaml","support_state":"direct"},{"collector":"graph_signins_roles","evaluator_registered":true,"evidence_keys":["principal_directory","recent_signin_user_ids","role_assignments"],"flagship":true,"flagship_security_intent":"Disable or move to just-in-time access any privileged accounts that sit unused and become takeover targets.","id":"id-dormant-privileged","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-dormant-privileged.yaml","support_state":"direct"},{"collector":"graph_entitlement_management","evaluator_registered":true,"evidence_keys":["access_packages"],"flagship":false,"flagship_security_intent":"","id":"id-entitlement-access-packages","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entitlement_management"],"source_path":"checks/identity/id-entitlement-access-packages.yaml","support_state":"direct"},{"collector":"graph_pim","evaluator_registered":true,"evidence_keys":["role_assignments"],"flagship":false,"flagship_security_intent":"","id":"id-ga-count-bounds","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-ga-count-bounds.yaml","support_state":"direct"},{"collector":"graph_pim","evaluator_registered":true,"evidence_keys":["role_assignments"],"flagship":false,"flagship_security_intent":"","id":"id-ga-finer-roles","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-ga-finer-roles.yaml","support_state":"direct"},{"collector":"graph_authorization","evaluator_registered":true,"evidence_keys":["authorization_policy"],"flagship":false,"flagship_security_intent":"","id":"id-guest-directory-access-limited","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-3"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-guest-directory-access-limited.yaml","support_state":"direct"},{"collector":"graph_guests","evaluator_registered":true,"evidence_keys":["approved_guest_domains","guests_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-guest-invite-domains","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-3"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-guest-invite-domains.yaml","support_state":"manual"},{"collector":"graph_authorization","evaluator_registered":true,"evidence_keys":["authorization_policy"],"flagship":false,"flagship_security_intent":"","id":"id-guest-inviter-restricted","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-3"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-guest-inviter-restricted.yaml","support_state":"direct"},{"collector":"graph_identity_protection_workload","evaluator_registered":true,"evidence_keys":["risky_service_principals"],"flagship":false,"flagship_security_intent":"","id":"id-identity-protection-workload","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["workload_identities_premium"],"source_path":"checks/identity/id-identity-protection-workload.yaml","support_state":"direct"},{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"id-idprotect-notify-high-risk","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["identity_protection"],"source_path":"checks/identity/id-idprotect-notify-high-risk.yaml","support_state":"manual"},{"collector":"graph_identity_protection","evaluator_registered":true,"evidence_keys":["ca_policies"],"flagship":true,"flagship_security_intent":"Enforce Identity Protection user-risk and sign-in-risk policies so risky logins are blocked.","id":"id-idprotect-off","mappings":{"mitre":["T1078"],"nist":["AC-2","IA-2"]},"required_capabilities":["identity_protection"],"source_path":"checks/identity/id-idprotect-off.yaml","support_state":"direct"},{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"id-logs-to-soc","mappings":{"mitre":["T1078"],"nist":["AU-6","AU-12"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-logs-to-soc.yaml","support_state":"manual"},{"collector":"graph_auth_methods","evaluator_registered":true,"evidence_keys":["auth_methods_bundle"],"flagship":true,"flagship_security_intent":"Require Microsoft Authenticator number matching to defeat MFA-fatigue and push-bombing attacks.","id":"id-number-matching","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-number-matching.yaml","support_state":"direct"},{"collector":"graph_domains","evaluator_registered":true,"evidence_keys":["domains"],"flagship":false,"flagship_security_intent":"","id":"id-password-never-expire","mappings":{"mitre":["T1078"],"nist":["IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-password-never-expire.yaml","support_state":"direct"},{"collector":"graph_pim_policies","evaluator_registered":true,"evidence_keys":["pim_policies_bundle"],"flagship":true,"flagship_security_intent":"Require justification, an authentication context, and a short time limit for privileged-role activation.","id":"id-pim-activation-controls","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-activation-controls.yaml","support_state":"direct"},{"collector":"graph_pim_policies","evaluator_registered":true,"evidence_keys":["pim_policies_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-pim-ga-activation-alert","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-ga-activation-alert.yaml","support_state":"direct"},{"collector":"graph_pim_policies","evaluator_registered":true,"evidence_keys":["pim_policies_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-pim-ga-activation-approval","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-ga-activation-approval.yaml","support_state":"direct"},{"collector":"graph_pim","evaluator_registered":true,"evidence_keys":["role_assignments","role_eligibilities"],"flagship":false,"flagship_security_intent":"","id":"id-pim-no-outside-pam","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-no-outside-pam.yaml","support_state":"direct"},{"collector":"graph_pim","evaluator_registered":true,"evidence_keys":["role_assignments","role_eligibilities"],"flagship":true,"flagship_security_intent":"Remove permanent active assignments for highly privileged roles in favor of just-in-time PIM access.","id":"id-pim-no-permanent-privileged","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-no-permanent-privileged.yaml","support_state":"direct"},{"collector":"graph_pim_policies","evaluator_registered":true,"evidence_keys":["pim_policies_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-pim-other-activation-alert","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-other-activation-alert.yaml","support_state":"direct"},{"collector":"graph_pim_policies","evaluator_registered":true,"evidence_keys":["pim_policies_bundle"],"flagship":false,"flagship_security_intent":"","id":"id-pim-privileged-assignment-alert","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-privileged-assignment-alert.yaml","support_state":"direct"},{"collector":"graph_pim","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids","role_assignments","role_eligibilities"],"flagship":true,"flagship_security_intent":"Operationalize privileged access through PIM activation with MFA instead of standing permanent roles.","id":"id-pim-unused","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-pim-unused.yaml","support_state":"direct"},{"collector":"graph_signins_roles","evaluator_registered":true,"evidence_keys":["principal_directory","role_assignments"],"flagship":true,"flagship_security_intent":"Keep highly privileged accounts cloud-only and separate from on-premises directories.","id":"id-priv-cloud-only","mappings":{"mitre":["T1078"],"nist":["AC-2","AC-6"]},"required_capabilities":["entra_id_p2"],"source_path":"checks/identity/id-priv-cloud-only.yaml","support_state":"direct"},{"collector":"license_assignment_collector","evaluator_registered":true,"evidence_keys":["license_assignment"],"flagship":false,"flagship_security_intent":"","id":"id-protective-plan-assignment","mappings":{"mitre":["T1078"],"nist":["CM-8"]},"required_capabilities":["defender_endpoint_p2","defender_office_p2","entra_id_p2","identity_protection","purview_dlp"],"source_path":"checks/identity/id-protective-plan-assignment.yaml","support_state":"direct"},{"collector":"graph_security_defaults","evaluator_registered":true,"evidence_keys":["ca_policies","security_defaults_policy"],"flagship":false,"flagship_security_intent":"","id":"id-security-defaults-on","mappings":{"mitre":["T1078"],"nist":["IA-2","IA-5"]},"required_capabilities":["conditional_access"],"source_path":"checks/identity/id-security-defaults-on.yaml","support_state":"direct"},{"collector":"mde_onboarding","evaluator_registered":true,"evidence_keys":["mde_summary"],"flagship":true,"flagship_security_intent":"Onboard licensed devices to Defender for Endpoint so EDR coverage and license value are realized.","id":"mde-onboard-gap","mappings":{},"required_capabilities":["defender_endpoint_p1","defender_endpoint_p2"],"source_path":"checks/defender/mde-onboard-gap.yaml","support_state":"direct"},{"collector":"mde_health_collector","evaluator_registered":true,"evidence_keys":["mde_health"],"flagship":false,"flagship_security_intent":"","id":"mde-sensor-health","mappings":{"mitre":["T1059"],"nist":["SI-3","SI-4"]},"required_capabilities":["defender_endpoint_p1","defender_endpoint_p2"],"source_path":"checks/endpoint/mde-sensor-health.yaml","support_state":"direct"},{"collector":"mdi_sensors","evaluator_registered":true,"evidence_keys":["mdi_health","secure_score_controls"],"flagship":false,"flagship_security_intent":"","id":"mdi-sensors-missing","mappings":{},"required_capabilities":["defender_identity"],"source_path":"checks/defender/mdi-sensors-missing.yaml","support_state":"direct_with_proxy_fallback"},{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"mdo-alert-policies-enabled","mappings":{},"required_capabilities":["defender_office_p1"],"source_path":"checks/defender/mdo-alert-policies-enabled.yaml","support_state":"manual"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-anti-spam-no-allowed-domains","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-anti-spam-no-allowed-domains.yaml","support_state":"direct"},{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"mdo-audit-retention","mappings":{},"required_capabilities":["purview_audit"],"source_path":"checks/defender/mdo-audit-retention.yaml","support_state":"manual"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-connection-filter-no-ip-allow","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-connection-filter-no-ip-allow.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-connection-filter-no-safe-list","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-connection-filter-no-safe-list.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-impersonation-domains-owned","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-impersonation-domains-owned.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-impersonation-partner-domains","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-impersonation-partner-domains.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-impersonation-users-protected","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-impersonation-users-protected.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-mailbox-intelligence","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-mailbox-intelligence.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-malware-file-filter","mappings":{},"required_capabilities":["defender_office_p1"],"source_path":"checks/defender/mdo-malware-file-filter.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-malware-zap","mappings":{},"required_capabilities":["defender_office_p1"],"source_path":"checks/defender/mdo-malware-zap.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-outbound-spam-forwarding-block","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-outbound-spam-forwarding-block.yaml","support_state":"direct"},{"collector":"graph_mdo","evaluator_registered":true,"evidence_keys":["secure_score_controls"],"flagship":true,"flagship_security_intent":"Enforce Safe Attachments and Safe Links in block mode for all recipients to stop phishing and malware.","id":"mdo-p2-policies-default","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-p2-policies-default.yaml","support_state":"direct_with_proxy_fallback"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-quarantine-policy","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-quarantine-policy.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-attachments-block","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-attachments-block.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-attachments-spo-teams","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-attachments-spo-teams.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-documents","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-documents.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-links-block-list","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-links-block-list.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-links-click-through","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-links-click-through.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-links-click-tracking","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-links-click-tracking.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safe-links-real-time-scan","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safe-links-real-time-scan.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-safety-tips-enabled","mappings":{},"required_capabilities":["defender_office_p2"],"source_path":"checks/defender/mdo-safety-tips-enabled.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-spam-phish-not-inbox","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-spam-phish-not-inbox.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-transport-rule-external-forward","mappings":{},"required_capabilities":["exchange_online_protection"],"source_path":"checks/defender/mdo-transport-rule-external-forward.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"mdo-unified-audit-enabled","mappings":{},"required_capabilities":["purview_audit"],"source_path":"checks/defender/mdo-unified-audit-enabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-export-controls","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-export-controls.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-external-invite-disabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-external-invite-disabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-guest-access-disabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-guest-access-disabled.yaml","support_state":"direct"},{"collector":"pbi_capacity_collector","evaluator_registered":true,"evidence_keys":["pbi_capacity_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-premium-capacity-governance","mappings":{},"required_capabilities":["power_bi_premium"],"source_path":"checks/power-bi/pbi-premium-capacity-governance.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-publish-to-web-disabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-publish-to-web-disabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-python-r-visuals-disabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-python-r-visuals-disabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-resource-key-auth-blocked","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-resource-key-auth-blocked.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-sensitivity-labels-enabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-sensitivity-labels-enabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-sp-api-restricted","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-sp-api-restricted.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pbi-sp-profiles-disabled","mappings":{},"required_capabilities":["power_bi_pro"],"source_path":"checks/power-bi/pbi-sp-profiles-disabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-dlp-all-environments","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-dlp-all-environments.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-dlp-nondefault-envs","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-dlp-nondefault-envs.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-env-creation-admin-only","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-env-creation-admin-only.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-pages-creation-admin-only","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-pages-creation-admin-only.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-share-with-everyone-disabled","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-share-with-everyone-disabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-tenant-isolation-allowlist","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-tenant-isolation-allowlist.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-tenant-isolation-enabled","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-tenant-isolation-enabled.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pp-trial-creation-admin-only","mappings":{},"required_capabilities":["power_platform"],"source_path":"checks/power-platform/pp-trial-creation-admin-only.yaml","support_state":"direct"},{"collector":"noop","evaluator_registered":true,"evidence_keys":["break_glass_principal_ids"],"flagship":false,"flagship_security_intent":"","id":"pur-communication-compliance-readiness","mappings":{},"required_capabilities":["purview_communication_compliance"],"source_path":"checks/purview/pur-communication-compliance-readiness.yaml","support_state":"manual"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":true,"flagship_security_intent":"Assign a default sensitivity label and require labeling so unlabeled sensitive content does not leak.","id":"pur-default-and-mandatory-labels","mappings":{},"required_capabilities":["purview_sensitivity_labels"],"source_path":"checks/purview/pur-default-and-mandatory-labels.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-dlp-enforcement-block","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-dlp-enforcement-block.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-dlp-locations-complete","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-dlp-locations-complete.yaml","support_state":"direct"},{"collector":"purview_dlp","evaluator_registered":true,"evidence_keys":["purview_dlp"],"flagship":true,"flagship_security_intent":"Enforce Purview DLP policies in production so sensitive data cannot leak through mail, files, or endpoints.","id":"pur-dlp-not-enforced","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-dlp-not-enforced.yaml","support_state":"direct_with_proxy_fallback"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-dlp-notifications","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-dlp-notifications.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-dlp-policy-present","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-dlp-policy-present.yaml","support_state":"direct"},{"collector":"graph_purview_ediscovery","evaluator_registered":true,"evidence_keys":["purview_ediscovery"],"flagship":false,"flagship_security_intent":"","id":"pur-ediscovery-readiness","mappings":{},"required_capabilities":["purview_ediscovery"],"source_path":"checks/purview/pur-ediscovery-readiness.yaml","support_state":"direct"},{"collector":"exchange_collector","evaluator_registered":true,"evidence_keys":["exchange_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-endpoint-dlp","mappings":{},"required_capabilities":["purview_dlp"],"source_path":"checks/purview/pur-endpoint-dlp.yaml","support_state":"direct"},{"collector":"graph_purview_insider_risk","evaluator_registered":true,"evidence_keys":["purview_insider_risk"],"flagship":false,"flagship_security_intent":"","id":"pur-insider-risk-readiness","mappings":{},"required_capabilities":["purview_insider_risk"],"source_path":"checks/purview/pur-insider-risk-readiness.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-retention-policy-coverage","mappings":{},"required_capabilities":["purview_retention"],"source_path":"checks/purview/pur-retention-policy-coverage.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":false,"flagship_security_intent":"","id":"pur-sensitivity-auto-labeling","mappings":{},"required_capabilities":["purview_sensitivity_labels"],"source_path":"checks/purview/pur-sensitivity-auto-labeling.yaml","support_state":"direct"},{"collector":"power_data_collector","evaluator_registered":true,"evidence_keys":["power_data_bundle"],"flagship":true,"flagship_security_intent":"Publish sensitivity labels through an enabled label policy so classification and protection reach users.","id":"pur-sensitivity-labels-published","mappings":{},"required_capabilities":["purview_sensitivity_labels"],"source_path":"checks/purview/pur-sensitivity-labels-published.yaml","support_state":"direct"},{"collector":"sentinel_analytics","evaluator_registered":true,"evidence_keys":["sentinel_rules"],"flagship":true,"flagship_security_intent":"Run enabled Sentinel scheduled analytics rules so SIEM spend produces detection yield.","id":"sen-analytics-rule-coverage","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-analytics-rule-coverage.yaml","support_state":"direct"},{"collector":"sentinel_automation_rules_collector","evaluator_registered":true,"evidence_keys":["sentinel_automation_rules"],"flagship":false,"flagship_security_intent":"","id":"sen-automation-rules","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-automation-rules.yaml","support_state":"direct"},{"collector":"sentinel_data_connectors_collector","evaluator_registered":true,"evidence_keys":["sentinel_data_connectors"],"flagship":true,"flagship_security_intent":"Connect high-value data sources to Sentinel so the security workspace has real signals to correlate.","id":"sen-data-connectors","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-data-connectors.yaml","support_state":"direct"},{"collector":"la_usage_collector","evaluator_registered":true,"evidence_keys":["la_usage_by_table"],"flagship":false,"flagship_security_intent":"","id":"sen-entra-diagnostics-routed","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-entra-diagnostics-routed.yaml","support_state":"proxy"},{"collector":"sentinel_workspace_collector","evaluator_registered":true,"evidence_keys":["sentinel_workspace"],"flagship":false,"flagship_security_intent":"","id":"sen-log-analytics-retention","mappings":{},"required_capabilities":["log_analytics","microsoft_sentinel"],"source_path":"checks/sentinel/sen-log-analytics-retention.yaml","support_state":"direct"},{"collector":"sentinel_analytics","evaluator_registered":true,"evidence_keys":["la_usage_by_table","sentinel_rules","telemetry_expectations"],"flagship":true,"flagship_security_intent":"Confirm enabled analytics rules query tables that actually ingested in the last seven days.","id":"sen-rule-telemetry-parity","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-rule-telemetry-parity.yaml","support_state":"direct"},{"collector":"la_usage_collector","evaluator_registered":true,"evidence_keys":["la_usage_by_table","telemetry_expectations"],"flagship":true,"flagship_security_intent":"Confirm owned security capabilities send their core tables into the Sentinel workspace.","id":"sen-telemetry-ingestion-coverage","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-telemetry-ingestion-coverage.yaml","support_state":"direct"},{"collector":"sentinel_ueba","evaluator_registered":true,"evidence_keys":["sentinel_ueba"],"flagship":false,"flagship_security_intent":"","id":"sen-ueba-not-enabled","mappings":{},"required_capabilities":["microsoft_sentinel"],"source_path":"checks/sentinel/sen-ueba-not-enabled.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-anyone-link-expiration","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-anyone-link-expiration.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-anyone-link-view","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-anyone-link-view.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-default-link-specific","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-default-link-specific.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-default-link-view","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-default-link-view.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-domain-restrictions","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-domain-restrictions.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-onedrive-sharing-limited","mappings":{},"required_capabilities":["onedrive_for_business"],"source_path":"checks/collaboration/spo-onedrive-sharing-limited.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-sharing-capability-limited","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-sharing-capability-limited.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-unmanaged-device-access","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-unmanaged-device-access.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"spo-verification-reauth","mappings":{},"required_capabilities":["sharepoint_online"],"source_path":"checks/collaboration/spo-verification-reauth.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-anonymous-lobby","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-anonymous-lobby.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-anonymous-start-disabled","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-anonymous-start-disabled.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-broadcast-not-always-record","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-broadcast-not-always-record.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-custom-apps-governed","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-custom-apps-governed.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-dialin-lobby","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-dialin-lobby.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-email-integration-disabled","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-email-integration-disabled.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-external-access-per-domain","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-external-access-per-domain.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-external-control-disabled","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-external-control-disabled.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-guest-access-restricted","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-guest-access-restricted.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-internal-auto-admit","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-internal-auto-admit.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-microsoft-apps-governed","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-microsoft-apps-governed.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-recording-disabled","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-recording-disabled.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-third-party-apps-governed","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-third-party-apps-governed.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-unmanaged-inbound-blocked","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-unmanaged-inbound-blocked.yaml","support_state":"direct"},{"collector":"collaboration_collector","evaluator_registered":true,"evidence_keys":["collaboration_bundle"],"flagship":false,"flagship_security_intent":"","id":"teams-unmanaged-outbound-blocked","mappings":{},"required_capabilities":["teams"],"source_path":"checks/collaboration/teams-unmanaged-outbound-blocked.yaml","support_state":"direct"},{"collector":"security_alerts_collector","evaluator_registered":true,"evidence_keys":["security_alerts_bundle"],"flagship":false,"flagship_security_intent":"","id":"xdr-incident-readiness","mappings":{"mitre":["T1059"],"nist":["IR-4","AU-6"]},"required_capabilities":["defender_xdr"],"source_path":"checks/endpoint/xdr-incident-readiness.yaml","support_state":"direct"}],"coverage_rows":[{"disposition":"implemented_direct","local_check_ids":["id-ca-legacy-auth-block"],"policy_id":"MS.AAD.1.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-high-risk-users"],"policy_id":"MS.AAD.2.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.AAD.2.2v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-high-risk-signins"],"policy_id":"MS.AAD.2.3v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-phishing-resistant-all"],"policy_id":"MS.AAD.3.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-mfa-all-users"],"policy_id":"MS.AAD.3.2v2","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-auth-authenticator-context"],"policy_id":"MS.AAD.3.3v2","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-auth-methods-migration"],"policy_id":"MS.AAD.3.4v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-auth-weak-methods-disabled"],"policy_id":"MS.AAD.3.5v2","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-phishing-resistant-privileged"],"policy_id":"MS.AAD.3.6v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-managed-devices"],"policy_id":"MS.AAD.3.7v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-mfa-registration-managed"],"policy_id":"MS.AAD.3.8v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ca-device-code-block"],"policy_id":"MS.AAD.3.9v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.AAD.4.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-registration-admin-only"],"policy_id":"MS.AAD.5.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-user-consent-restricted"],"policy_id":"MS.AAD.5.2v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-admin-consent-workflow"],"policy_id":"MS.AAD.5.3v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-password-addition-blocked"],"policy_id":"MS.AAD.5.5v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-password-lifetime"],"policy_id":"MS.AAD.5.6v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-app-certificate-lifetime"],"policy_id":"MS.AAD.5.7v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-password-never-expire"],"policy_id":"MS.AAD.6.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ga-count-bounds"],"policy_id":"MS.AAD.7.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ga-finer-roles"],"policy_id":"MS.AAD.7.2v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-priv-cloud-only"],"policy_id":"MS.AAD.7.3v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-no-permanent-privileged"],"policy_id":"MS.AAD.7.4v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-no-outside-pam"],"policy_id":"MS.AAD.7.5v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-ga-activation-approval"],"policy_id":"MS.AAD.7.6v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-privileged-assignment-alert"],"policy_id":"MS.AAD.7.7v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-ga-activation-alert"],"policy_id":"MS.AAD.7.8v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-pim-other-activation-alert"],"policy_id":"MS.AAD.7.9v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-guest-directory-access-limited"],"policy_id":"MS.AAD.8.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-guest-inviter-restricted"],"policy_id":"MS.AAD.8.2v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.AAD.8.3v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_direct","local_check_ids":["id-ai-agents-risky-block"],"policy_id":"MS.AAD.9.1v1","product":"aad","source_path":"PowerShell/ScubaGear/baselines/aad.md"},{"disposition":"implemented_proxy","local_check_ids":["mdo-p2-policies-default"],"policy_id":"MS.DEFENDER.1.1v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.1.2v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_proxy","local_check_ids":["mdo-p2-policies-default"],"policy_id":"MS.DEFENDER.1.3v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.1.4v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.1.5v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-users-protected"],"policy_id":"MS.DEFENDER.2.1v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-domains-owned"],"policy_id":"MS.DEFENDER.2.2v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-partner-domains"],"policy_id":"MS.DEFENDER.2.3v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-attachments-spo-teams"],"policy_id":"MS.DEFENDER.3.1v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-policy-present"],"policy_id":"MS.DEFENDER.4.1v2","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-locations-complete"],"policy_id":"MS.DEFENDER.4.2v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-enforcement-block"],"policy_id":"MS.DEFENDER.4.3v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-notifications"],"policy_id":"MS.DEFENDER.4.4v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.4.5v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.4.6v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.5.1v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.5.2v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-unified-audit-enabled"],"policy_id":"MS.DEFENDER.6.1v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.DEFENDER.6.3v1","product":"defender","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"disposition":"implemented_direct","local_check_ids":["exo-forwarding-external-disabled","mdo-outbound-spam-forwarding-block","mdo-transport-rule-external-forward"],"policy_id":"MS.EXO.1.1v2","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-mailbox-audit-enabled"],"policy_id":"MS.EXO.13.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-spf-published"],"policy_id":"MS.EXO.2.2v3","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-dkim-enabled"],"policy_id":"MS.EXO.3.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-dmarc-published"],"policy_id":"MS.EXO.4.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-dmarc-reject"],"policy_id":"MS.EXO.4.2v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-dmarc-federal-contact"],"policy_id":"MS.EXO.4.3v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-dmarc-agency-contact"],"policy_id":"MS.EXO.4.4v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-smtp-auth-disabled"],"policy_id":"MS.EXO.5.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-sharing-contact-not-all-domains"],"policy_id":"MS.EXO.6.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-sharing-calendar-not-all-domains"],"policy_id":"MS.EXO.6.2v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["exo-external-sender-warnings"],"policy_id":"MS.EXO.7.1v1","product":"exo","source_path":"PowerShell/ScubaGear/baselines/exo.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-publish-to-web-disabled"],"policy_id":"MS.POWERBI.1.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-guest-access-disabled"],"policy_id":"MS.POWERBI.2.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-external-invite-disabled"],"policy_id":"MS.POWERBI.3.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-sp-api-restricted"],"policy_id":"MS.POWERBI.4.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-sp-profiles-disabled"],"policy_id":"MS.POWERBI.4.2v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-resource-key-auth-blocked"],"policy_id":"MS.POWERBI.5.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-python-r-visuals-disabled"],"policy_id":"MS.POWERBI.6.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pbi-sensitivity-labels-enabled"],"policy_id":"MS.POWERBI.7.1v1","product":"powerbi","source_path":"PowerShell/ScubaGear/baselines/powerbi.md"},{"disposition":"implemented_direct","local_check_ids":["pp-env-creation-admin-only"],"policy_id":"MS.POWERPLATFORM.1.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-trial-creation-admin-only"],"policy_id":"MS.POWERPLATFORM.1.2v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-dlp-all-environments"],"policy_id":"MS.POWERPLATFORM.2.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-dlp-nondefault-envs"],"policy_id":"MS.POWERPLATFORM.2.2v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-tenant-isolation-enabled"],"policy_id":"MS.POWERPLATFORM.3.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-tenant-isolation-allowlist"],"policy_id":"MS.POWERPLATFORM.3.2v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.POWERPLATFORM.4.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-pages-creation-admin-only"],"policy_id":"MS.POWERPLATFORM.5.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["pp-share-with-everyone-disabled"],"policy_id":"MS.POWERPLATFORM.6.1v1","product":"powerplatform","source_path":"PowerShell/ScubaGear/baselines/powerplatform.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-malware-file-filter"],"policy_id":"MS.SECURITYSUITE.1.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-malware-zap"],"policy_id":"MS.SECURITYSUITE.1.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-attachments-block"],"policy_id":"MS.SECURITYSUITE.1.3v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-attachments-spo-teams"],"policy_id":"MS.SECURITYSUITE.1.4v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-links-real-time-scan"],"policy_id":"MS.SECURITYSUITE.15.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-users-protected","mdo-mailbox-intelligence"],"policy_id":"MS.SECURITYSUITE.2.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-domains-owned"],"policy_id":"MS.SECURITYSUITE.2.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-impersonation-partner-domains"],"policy_id":"MS.SECURITYSUITE.2.3v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safety-tips-enabled"],"policy_id":"MS.SECURITYSUITE.2.4v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-policy-present"],"policy_id":"MS.SECURITYSUITE.3.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-locations-complete"],"policy_id":"MS.SECURITYSUITE.3.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-enforcement-block"],"policy_id":"MS.SECURITYSUITE.3.3v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["pur-dlp-notifications"],"policy_id":"MS.SECURITYSUITE.3.4v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.SECURITYSUITE.3.5v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.SECURITYSUITE.4.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.SECURITYSUITE.4.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-unified-audit-enabled"],"policy_id":"MS.SECURITYSUITE.5.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"manual","local_check_ids":[],"policy_id":"MS.SECURITYSUITE.5.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-spam-phish-not-inbox"],"policy_id":"MS.SECURITYSUITE.6.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-anti-spam-no-allowed-domains"],"policy_id":"MS.SECURITYSUITE.6.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-links-block-list"],"policy_id":"MS.SECURITYSUITE.7.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-links-real-time-scan"],"policy_id":"MS.SECURITYSUITE.7.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-safe-links-click-tracking"],"policy_id":"MS.SECURITYSUITE.7.3v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-connection-filter-no-ip-allow"],"policy_id":"MS.SECURITYSUITE.8.1v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["mdo-connection-filter-no-safe-list"],"policy_id":"MS.SECURITYSUITE.8.2v1","product":"securitysuite","source_path":"PowerShell/ScubaGear/baselines/securitysuite.md"},{"disposition":"implemented_direct","local_check_ids":["spo-sharing-capability-limited"],"policy_id":"MS.SHAREPOINT.1.1v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-onedrive-sharing-limited"],"policy_id":"MS.SHAREPOINT.1.2v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-domain-restrictions"],"policy_id":"MS.SHAREPOINT.1.3v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-default-link-specific"],"policy_id":"MS.SHAREPOINT.2.1v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-default-link-view"],"policy_id":"MS.SHAREPOINT.2.2v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-anyone-link-expiration"],"policy_id":"MS.SHAREPOINT.3.1v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-anyone-link-view"],"policy_id":"MS.SHAREPOINT.3.2v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-verification-reauth"],"policy_id":"MS.SHAREPOINT.3.3v2","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["spo-unmanaged-device-access"],"policy_id":"MS.SHAREPOINT.4.1v1","product":"sharepoint","source_path":"PowerShell/ScubaGear/baselines/sharepoint.md"},{"disposition":"implemented_direct","local_check_ids":["teams-external-control-disabled"],"policy_id":"MS.TEAMS.1.1v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-anonymous-start-disabled"],"policy_id":"MS.TEAMS.1.2v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-anonymous-lobby"],"policy_id":"MS.TEAMS.1.3v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-internal-auto-admit"],"policy_id":"MS.TEAMS.1.4v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-dialin-lobby"],"policy_id":"MS.TEAMS.1.5v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-recording-disabled"],"policy_id":"MS.TEAMS.1.6v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-broadcast-not-always-record"],"policy_id":"MS.TEAMS.1.7v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-external-access-per-domain"],"policy_id":"MS.TEAMS.2.1v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-unmanaged-inbound-blocked"],"policy_id":"MS.TEAMS.2.2v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-unmanaged-outbound-blocked"],"policy_id":"MS.TEAMS.2.3v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-guest-access-restricted"],"policy_id":"MS.TEAMS.3.1v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-email-integration-disabled"],"policy_id":"MS.TEAMS.4.1v1","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-microsoft-apps-governed"],"policy_id":"MS.TEAMS.5.1v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-third-party-apps-governed"],"policy_id":"MS.TEAMS.5.2v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"disposition":"implemented_direct","local_check_ids":["teams-custom-apps-governed"],"policy_id":"MS.TEAMS.5.3v2","product":"teams","source_path":"PowerShell/ScubaGear/baselines/teams.md"}],"excluded_items":[{"item":"Automatic remediation / write-back","reason":"Read-only tool by design (docs/limitations.md); the remediation loop uses the portal deep link plus rescan."},{"item":"Azure Defender for Cloud / CSPM expansion","reason":"Outside M365-entitlement realization; the az-cspm-out-of-scope check flags that boundary explicitly."},{"item":"Azure resource posture (NSGs, key vaults, storage)","reason":"Not LicenseLens's job \u2014 the product assesses M365 entitlements, not Azure infrastructure hardening."},{"item":"Entra Verified ID / decentralized identity","reason":"Niche identity scenario, not an entitlement-realization control."},{"item":"Microsoft Sentinel depth","reason":"Azure-billed surface, not an M365 entitlement; the five existing sentinel checks are the coverage ceiling."},{"item":"SaaS backend, dashboards, telemetry, database","reason":"Out of thesis (product brief): local, offline, self-contained tooling only."}],"graph_permissions":["AccessReview.Read.All","Application.Read.All","AuditLog.Read.All","CustomDetection.Read.All","DelegatedPermissionGrant.Read.All","Device.Read.All","DeviceManagementApps.Read.All","DeviceManagementConfiguration.Read.All","DeviceManagementManagedDevices.Read.All","Directory.Read.All","DlpPolicy.Read.All","Domain.Read.All","EntitlementManagement.Read.All","IdentityRiskyServicePrincipal.Read.All","Organization.Read.All","Policy.Read.All","RoleManagement.Read.Directory","SecurityAlert.Read.All","SecurityEvents.Read.All","SecurityIdentitiesHealth.Read.All","SecurityIdentitiesSensors.Read.All","SecurityIncident.Read.All","User.Read.All","eDiscovery.Read.All"],"permission_modules":["Defender for Endpoint API (separate resource)","Exchange Online / Security & Compliance (PowerShell bridge)","Microsoft Graph (application permissions)","Microsoft Sentinel / selective Azure (Azure RBAC)","Power BI / Fabric admin REST (separate resource)","Teams / SharePoint Online / OneDrive (PowerShell bridge)"],"profiles":[{"check_ids":[],"id":"collaboration","packs":["collaboration"],"resolved_check_ids":["spo-anyone-link-expiration","spo-anyone-link-view","spo-default-link-specific","spo-default-link-view","spo-domain-restrictions","spo-onedrive-sharing-limited","spo-sharing-capability-limited","spo-unmanaged-device-access","spo-verification-reauth","teams-anonymous-lobby","teams-anonymous-start-disabled","teams-broadcast-not-always-record","teams-custom-apps-governed","teams-dialin-lobby","teams-email-integration-disabled","teams-external-access-per-domain","teams-external-control-disabled","teams-guest-access-restricted","teams-internal-auto-admit","teams-microsoft-apps-governed","teams-recording-disabled","teams-third-party-apps-governed","teams-unmanaged-inbound-blocked","teams-unmanaged-outbound-blocked"]},{"check_ids":[],"id":"core","packs":["endpoint","identity"],"resolved_check_ids":["endpoint-compliance-noncompliance-action","endpoint-compliance-policy-assigned","endpoint-enrollment-coverage","endpoint-mde-connector","endpoint-security-baseline","endpoint-security-policy-coverage","ep-asr-rules","ep-bitlocker-policy","ep-compliance-enforcement","ep-mam-app-protection","ep-tamper-protection","id-access-reviews-scope","id-access-reviews-unused","id-ai-agents-risky-block","id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-break-glass-exclusion","id-ca-device-code-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-ca-workload-identity","id-cross-tenant-defaults","id-cross-tenant-mfa-trust","id-dormant-privileged","id-entitlement-access-packages","id-ga-count-bounds","id-ga-finer-roles","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-identity-protection-workload","id-idprotect-notify-high-risk","id-idprotect-off","id-logs-to-soc","id-number-matching","id-password-never-expire","id-pim-activation-controls","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-protective-plan-assignment","id-security-defaults-on","mde-onboard-gap","mde-sensor-health","xdr-incident-readiness"]},{"check_ids":["mdo-unified-audit-enabled","pur-communication-compliance-readiness","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-not-enforced","pur-dlp-notifications","pur-dlp-policy-present","pur-ediscovery-readiness","pur-insider-risk-readiness","pur-retention-policy-coverage","pur-sensitivity-auto-labeling","pur-sensitivity-labels-published"],"id":"data-protection","packs":["data-protection"],"resolved_check_ids":["mdo-unified-audit-enabled","pur-communication-compliance-readiness","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-not-enforced","pur-dlp-notifications","pur-dlp-policy-present","pur-ediscovery-readiness","pur-insider-risk-readiness","pur-retention-policy-coverage","pur-sensitivity-auto-labeling","pur-sensitivity-labels-published"]},{"check_ids":["exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published","mdo-alert-policies-enabled","mdo-anti-spam-no-allowed-domains","mdo-audit-retention","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-malware-file-filter","mdo-malware-zap","mdo-p2-policies-default","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-links-block-list","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled","mdo-spam-phish-not-inbox","mdo-unified-audit-enabled","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-notifications","pur-dlp-policy-present"],"id":"email","packs":["email"],"resolved_check_ids":["exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published","mdo-alert-policies-enabled","mdo-anti-spam-no-allowed-domains","mdo-audit-retention","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-mailbox-intelligence","mdo-malware-file-filter","mdo-malware-zap","mdo-outbound-spam-forwarding-block","mdo-p2-policies-default","mdo-quarantine-policy","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-documents","mdo-safe-links-block-list","mdo-safe-links-click-through","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled","mdo-spam-phish-not-inbox","mdo-transport-rule-external-forward","mdo-unified-audit-enabled","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-notifications","pur-dlp-policy-present","pur-endpoint-dlp"]},{"check_ids":["mde-onboard-gap","mdi-sensors-missing"],"id":"endpoint","packs":["endpoint"],"resolved_check_ids":["endpoint-compliance-noncompliance-action","endpoint-compliance-policy-assigned","endpoint-enrollment-coverage","endpoint-mde-connector","endpoint-security-baseline","endpoint-security-policy-coverage","ep-asr-rules","ep-bitlocker-policy","ep-compliance-enforcement","ep-mam-app-protection","ep-tamper-protection","mde-onboard-gap","mde-sensor-health","mdi-sensors-missing","xdr-incident-readiness"]},{"check_ids":["exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published","id-access-reviews-unused","id-ca-priv-gaps","id-dormant-privileged","id-idprotect-off","id-pim-unused","id-security-defaults-on","mde-onboard-gap","mdi-sensors-missing","mdo-alert-policies-enabled","mdo-anti-spam-no-allowed-domains","mdo-audit-retention","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-malware-file-filter","mdo-malware-zap","mdo-p2-policies-default","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-links-block-list","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled","mdo-spam-phish-not-inbox","mdo-unified-audit-enabled","pur-communication-compliance-readiness","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-not-enforced","pur-dlp-notifications","pur-dlp-policy-present","pur-ediscovery-readiness","pur-insider-risk-readiness","pur-retention-policy-coverage","pur-sensitivity-auto-labeling","pur-sensitivity-labels-published","sen-analytics-rule-coverage","sen-ueba-not-enabled"],"id":"full","packs":["collaboration","data-protection","email","endpoint","identity","power-bi","power-platform","secops"],"resolved_check_ids":["endpoint-compliance-noncompliance-action","endpoint-compliance-policy-assigned","endpoint-enrollment-coverage","endpoint-mde-connector","endpoint-security-baseline","endpoint-security-policy-coverage","ep-asr-rules","ep-bitlocker-policy","ep-compliance-enforcement","ep-mam-app-protection","ep-tamper-protection","exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published","id-access-reviews-scope","id-access-reviews-unused","id-ai-agents-risky-block","id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-break-glass-exclusion","id-ca-device-code-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-ca-workload-identity","id-cross-tenant-defaults","id-cross-tenant-mfa-trust","id-dormant-privileged","id-entitlement-access-packages","id-ga-count-bounds","id-ga-finer-roles","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-identity-protection-workload","id-idprotect-notify-high-risk","id-idprotect-off","id-logs-to-soc","id-number-matching","id-password-never-expire","id-pim-activation-controls","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-protective-plan-assignment","id-security-defaults-on","mde-onboard-gap","mde-sensor-health","mdi-sensors-missing","mdo-alert-policies-enabled","mdo-anti-spam-no-allowed-domains","mdo-audit-retention","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-mailbox-intelligence","mdo-malware-file-filter","mdo-malware-zap","mdo-outbound-spam-forwarding-block","mdo-p2-policies-default","mdo-quarantine-policy","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-documents","mdo-safe-links-block-list","mdo-safe-links-click-through","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled","mdo-spam-phish-not-inbox","mdo-transport-rule-external-forward","mdo-unified-audit-enabled","pbi-export-controls","pbi-external-invite-disabled","pbi-guest-access-disabled","pbi-premium-capacity-governance","pbi-publish-to-web-disabled","pbi-python-r-visuals-disabled","pbi-resource-key-auth-blocked","pbi-sensitivity-labels-enabled","pbi-sp-api-restricted","pbi-sp-profiles-disabled","pp-dlp-all-environments","pp-dlp-nondefault-envs","pp-env-creation-admin-only","pp-pages-creation-admin-only","pp-share-with-everyone-disabled","pp-tenant-isolation-allowlist","pp-tenant-isolation-enabled","pp-trial-creation-admin-only","pur-communication-compliance-readiness","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-not-enforced","pur-dlp-notifications","pur-dlp-policy-present","pur-ediscovery-readiness","pur-endpoint-dlp","pur-insider-risk-readiness","pur-retention-policy-coverage","pur-sensitivity-auto-labeling","pur-sensitivity-labels-published","sen-analytics-rule-coverage","sen-ueba-not-enabled","spo-anyone-link-expiration","spo-anyone-link-view","spo-default-link-specific","spo-default-link-view","spo-domain-restrictions","spo-onedrive-sharing-limited","spo-sharing-capability-limited","spo-unmanaged-device-access","spo-verification-reauth","teams-anonymous-lobby","teams-anonymous-start-disabled","teams-broadcast-not-always-record","teams-custom-apps-governed","teams-dialin-lobby","teams-email-integration-disabled","teams-external-access-per-domain","teams-external-control-disabled","teams-guest-access-restricted","teams-internal-auto-admit","teams-microsoft-apps-governed","teams-recording-disabled","teams-third-party-apps-governed","teams-unmanaged-inbound-blocked","teams-unmanaged-outbound-blocked","xdr-incident-readiness"]},{"check_ids":["id-access-reviews-unused","id-ai-agents-risky-block","id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-ca-device-code-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-cross-tenant-defaults","id-dormant-privileged","id-ga-count-bounds","id-ga-finer-roles","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-idprotect-notify-high-risk","id-idprotect-off","id-logs-to-soc","id-password-never-expire","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-security-defaults-on"],"id":"identity","packs":["identity"],"resolved_check_ids":["id-access-reviews-scope","id-access-reviews-unused","id-ai-agents-risky-block","id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-break-glass-exclusion","id-ca-device-code-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-ca-workload-identity","id-cross-tenant-defaults","id-cross-tenant-mfa-trust","id-dormant-privileged","id-entitlement-access-packages","id-ga-count-bounds","id-ga-finer-roles","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-identity-protection-workload","id-idprotect-notify-high-risk","id-idprotect-off","id-logs-to-soc","id-number-matching","id-password-never-expire","id-pim-activation-controls","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-protective-plan-assignment","id-security-defaults-on"]},{"check_ids":[],"id":"power-bi","packs":["power-bi"],"resolved_check_ids":["pbi-export-controls","pbi-external-invite-disabled","pbi-guest-access-disabled","pbi-premium-capacity-governance","pbi-publish-to-web-disabled","pbi-python-r-visuals-disabled","pbi-resource-key-auth-blocked","pbi-sensitivity-labels-enabled","pbi-sp-api-restricted","pbi-sp-profiles-disabled"]},{"check_ids":[],"id":"power-platform","packs":["power-platform"],"resolved_check_ids":["pp-dlp-all-environments","pp-dlp-nondefault-envs","pp-env-creation-admin-only","pp-pages-creation-admin-only","pp-share-with-everyone-disabled","pp-tenant-isolation-allowlist","pp-tenant-isolation-enabled","pp-trial-creation-admin-only"]},{"check_ids":[],"id":"scuba","packs":["collaboration","data-protection","email","endpoint","identity","power-bi","power-platform","secops"],"resolved_check_ids":["endpoint-compliance-noncompliance-action","endpoint-compliance-policy-assigned","endpoint-enrollment-coverage","endpoint-mde-connector","endpoint-security-baseline","endpoint-security-policy-coverage","ep-asr-rules","ep-bitlocker-policy","ep-compliance-enforcement","ep-mam-app-protection","ep-tamper-protection","exo-dkim-enabled","exo-dmarc-agency-contact","exo-dmarc-federal-contact","exo-dmarc-published","exo-dmarc-reject","exo-external-sender-warnings","exo-forwarding-external-disabled","exo-mailbox-audit-enabled","exo-sharing-calendar-not-all-domains","exo-sharing-contact-not-all-domains","exo-smtp-auth-disabled","exo-spf-published","id-access-reviews-scope","id-access-reviews-unused","id-ai-agents-risky-block","id-app-admin-consent-workflow","id-app-certificate-lifetime","id-app-expiring-credentials","id-app-ownerless-or-stale","id-app-password-addition-blocked","id-app-password-lifetime","id-app-registration-admin-only","id-app-risky-delegated-consent","id-app-user-consent-restricted","id-auth-authenticator-context","id-auth-methods-migration","id-auth-weak-methods-disabled","id-break-glass-exclusion","id-ca-device-code-block","id-ca-high-risk-signins","id-ca-high-risk-users","id-ca-legacy-auth-block","id-ca-managed-devices","id-ca-mfa-all-users","id-ca-mfa-registration-managed","id-ca-phishing-resistant-all","id-ca-phishing-resistant-privileged","id-ca-priv-gaps","id-ca-workload-identity","id-cross-tenant-defaults","id-cross-tenant-mfa-trust","id-dormant-privileged","id-entitlement-access-packages","id-ga-count-bounds","id-ga-finer-roles","id-guest-directory-access-limited","id-guest-invite-domains","id-guest-inviter-restricted","id-identity-protection-workload","id-idprotect-notify-high-risk","id-idprotect-off","id-logs-to-soc","id-number-matching","id-password-never-expire","id-pim-activation-controls","id-pim-ga-activation-alert","id-pim-ga-activation-approval","id-pim-no-outside-pam","id-pim-no-permanent-privileged","id-pim-other-activation-alert","id-pim-privileged-assignment-alert","id-pim-unused","id-priv-cloud-only","id-protective-plan-assignment","id-security-defaults-on","mde-onboard-gap","mde-sensor-health","mdo-alert-policies-enabled","mdo-anti-spam-no-allowed-domains","mdo-audit-retention","mdo-connection-filter-no-ip-allow","mdo-connection-filter-no-safe-list","mdo-impersonation-domains-owned","mdo-impersonation-partner-domains","mdo-impersonation-users-protected","mdo-mailbox-intelligence","mdo-malware-file-filter","mdo-malware-zap","mdo-outbound-spam-forwarding-block","mdo-p2-policies-default","mdo-quarantine-policy","mdo-safe-attachments-block","mdo-safe-attachments-spo-teams","mdo-safe-documents","mdo-safe-links-block-list","mdo-safe-links-click-through","mdo-safe-links-click-tracking","mdo-safe-links-real-time-scan","mdo-safety-tips-enabled","mdo-spam-phish-not-inbox","mdo-transport-rule-external-forward","mdo-unified-audit-enabled","pbi-export-controls","pbi-external-invite-disabled","pbi-guest-access-disabled","pbi-premium-capacity-governance","pbi-publish-to-web-disabled","pbi-python-r-visuals-disabled","pbi-resource-key-auth-blocked","pbi-sensitivity-labels-enabled","pbi-sp-api-restricted","pbi-sp-profiles-disabled","pp-dlp-all-environments","pp-dlp-nondefault-envs","pp-env-creation-admin-only","pp-pages-creation-admin-only","pp-share-with-everyone-disabled","pp-tenant-isolation-allowlist","pp-tenant-isolation-enabled","pp-trial-creation-admin-only","pur-dlp-enforcement-block","pur-dlp-locations-complete","pur-dlp-notifications","pur-dlp-policy-present","pur-endpoint-dlp","sen-ueba-not-enabled","spo-anyone-link-expiration","spo-anyone-link-view","spo-default-link-specific","spo-default-link-view","spo-domain-restrictions","spo-onedrive-sharing-limited","spo-sharing-capability-limited","spo-unmanaged-device-access","spo-verification-reauth","teams-anonymous-lobby","teams-anonymous-start-disabled","teams-broadcast-not-always-record","teams-custom-apps-governed","teams-dialin-lobby","teams-email-integration-disabled","teams-external-access-per-domain","teams-external-control-disabled","teams-guest-access-restricted","teams-internal-auto-admit","teams-microsoft-apps-governed","teams-recording-disabled","teams-third-party-apps-governed","teams-unmanaged-inbound-blocked","teams-unmanaged-outbound-blocked","xdr-incident-readiness"]},{"check_ids":["sen-analytics-rule-coverage","sen-ueba-not-enabled"],"id":"secops","packs":["secops"],"resolved_check_ids":["sen-analytics-rule-coverage","sen-ueba-not-enabled"]}],"untracked_coverage_rows":[{"policy_id":"MS.EXO.16.1v1","product":"exo","rationale":"Removed upstream; reworked into mapped MS.SECURITYSUITE.4.1v1.","source_path":"PowerShell/ScubaGear/baselines/defender.md"},{"policy_id":"MS.TEAMS.5.1v1","product":"teams","rationale":"Legacy v1 superseded by mapped MS.TEAMS.5.1v2.","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"policy_id":"MS.TEAMS.5.2v1","product":"teams","rationale":"Legacy v1 superseded by mapped MS.TEAMS.5.2v2.","source_path":"PowerShell/ScubaGear/baselines/teams.md"},{"policy_id":"MS.TEAMS.5.3v1","product":"teams","rationale":"Legacy v1 superseded by mapped MS.TEAMS.5.3v2.","source_path":"PowerShell/ScubaGear/baselines/teams.md"}]}