Defender
116 checks from CIS Microsoft 365 Foundations Benchmark, Mito, ORCA: 16 High, 72 Medium, 23 Low, 5 Info.
| ID | Title | Severity | Suite |
|---|---|---|---|
| CIS.M365.2.1.1 | Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.2 | Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.3 | Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.4 | Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | High | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.6 | Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.7 | Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.9 | Ensure that DKIM is enabled for all Exchange Online Domains | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.11 | Ensure comprehensive attachment filtering is applied | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.12 | Ensure the connection filter IP allow list is not used (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.1.13 | Ensure the connection filter safe list is off (Only Checks Default Policy) | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.2.4.4 | Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled) | Medium | CIS Microsoft 365 Foundations Benchmark |
| MT.1059 | Microsoft Defender for Identity health issues should be resolved | Medium | Mito |
| MT.1077 | App registrations with privileged API permissions should not have owners. | Medium | Mito |
| MT.1078 | App registrations with highly privileged directory roles should not have owners. | Medium | Mito |
| MT.1079 | Privileged API permissions on service principals should not remain unused. | Medium | Mito |
| MT.1080 | Credentials, tokens, or cookies from highly privileged users should not be exposed on vulnerable endpoints. | Medium | Mito |
| MT.1081 | Hybrid users should not be assigned Entra ID role assignments. | Medium | Mito |
| MT.1085 | Pending approvals for Critical Asset Management should not be present. | Low | Mito |
| MT.1086 | Devices should not share both critical and non-critical user credentials. | Low | Mito |
| MT.1087 | Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE’s. | High | Mito |
| MT.1088 | Devices with critical credentials should be protected by TPM. | Medium | Mito |
| MT.1089 | Devices with critical credentials should be protected by Credential Guard. | Medium | Mito |
| MT.1111 | High privileged user should be linked to an identity. | Low | Mito |
| MT.1112 | Privileged user accounts should not remain enabled when the linked primary account is disabled. | Medium | Mito |
| MT.1148 | Archive Scanning should be enabled. | Medium | Mito |
| MT.1149 | Behavior Monitoring should be enabled. | High | Mito |
| MT.1150 | Cloud Protection should be enabled. | High | Mito |
| MT.1151 | Email Scanning should be enabled. | Medium | Mito |
| MT.1152 | Script Scanning should be enabled. | High | Mito |
| MT.1153 | Real-time Monitoring should be enabled. | High | Mito |
| MT.1154 | Full Scan Removable Drives should be enabled. | Medium | Mito |
| MT.1155 | Full Scan Mapped Drives should be disabled for performance. | Low | Mito |
| MT.1156 | Scanning Network Files should be enabled. | Medium | Mito |
| MT.1157 | CPU Load Factor should be optimized (20-30%). | Low | Mito |
| MT.1158 | Scan should be scheduled. | Low | Mito |
| MT.1159 | Quick Scan Time configuration is not required. | Info | Mito |
| MT.1160 | Signatures should be checked before scan. | Low | Mito |
| MT.1161 | Cloud Block Level should be High or higher. | Medium | Mito |
| MT.1162 | Cloud Extended Timeout should be 30-50 seconds. | Low | Mito |
| MT.1163 | Signature Update Interval should be 1-4 hours. | Low | Mito |
| MT.1164 | PUA Protection should be enabled. | Medium | Mito |
| MT.1165 | Network Protection should be enabled. | High | Mito |
| MT.1166 | Local Admin Merge should be disabled. | Medium | Mito |
| MT.1167 | Real-Time Scan Direction should cover both directions. | Medium | Mito |
| MT.1168 | Cleaned Malware should be retained for at least 30 days. | Low | Mito |
| MT.1169 | Catch-up Full Scan should be disabled. | Low | Mito |
| MT.1170 | Catch-up Quick Scan should be disabled. | Low | Mito |
| MT.1171 | Sample Submission should send safe samples automatically. | Medium | Mito |
| ORCA.100 | Bulk Complaint Level threshold is between 4 and 6. | Low | ORCA |
| ORCA.101 | Bulk is marked as spam. | Low | ORCA |
| ORCA.102 | Advanced Spam filter options are turned off. | Low | ORCA |
| ORCA.103 | Outbound spam filter policy settings configured. | Medium | ORCA |
| ORCA.104 | High Confidence Phish action set to Quarantine message. | High | ORCA |
| ORCA.105 | Safe Links Synchronous URL detonation is enabled. | Medium | ORCA |
| ORCA.106 | Quarantine retention period is 30 days. | Low | ORCA |
| ORCA.107 | End-user spam notification is enabled. | Low | ORCA |
| ORCA.108 | DKIM signing is set up for all your custom domains. | Medium | ORCA |
| ORCA.108.1 | DNS Records have been set up to support DKIM. | Medium | ORCA |
| ORCA.109 | Senders are not being allow listed in an unsafe manner. | Medium | ORCA |
| ORCA.110 | Internal Sender notifications are disabled. | Low | ORCA |
| ORCA.111 | Anti-phishing policy exists and EnableUnauthenticatedSender is true. | Medium | ORCA |
| ORCA.112 | Anti-spoofing protection action is configured to Move message to the recipients’ Junk Email folders in Anti-phishing policy. | Medium | ORCA |
| ORCA.113 | AllowClickThrough is disabled in Safe Links policies. | Medium | ORCA |
| ORCA.114 | No IP Allow Lists have been configured. | Medium | ORCA |
| ORCA.115 | Mailbox intelligence based impersonation protection is enabled in anti-phishing policies. | Medium | ORCA |
| ORCA.116 | Mailbox intelligence based impersonation protection action set to move message to junk mail folder. | Medium | ORCA |
| ORCA.118.1 | Domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | ORCA |
| ORCA.118.2 | Domains are not being allow listed in an unsafe manner in Transport Rules. | High | ORCA |
| ORCA.118.3 | Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies. | High | ORCA |
| ORCA.118.4 | Your own domains are not being allow listed in an unsafe manner in Transport Rules. | High | ORCA |
| ORCA.119 | Similar Domains Safety Tips is enabled. | Info | ORCA |
| ORCA.120.1 | Zero Hour Autopurge Enabled for Phish. | Medium | ORCA |
| ORCA.120.2 | Zero Hour Autopurge Enabled for Malware. | Medium | ORCA |
| ORCA.120.3 | Zero Hour Autopurge Enabled for Spam. | Medium | ORCA |
| ORCA.121 | Supported filter policy action used. | Medium | ORCA |
| ORCA.123 | Unusual Characters Safety Tips is enabled. | Info | ORCA |
| ORCA.124 | Safe attachments unknown malware response set to block messages. | High | ORCA |
| ORCA.139 | Spam action set to move message to junk mail folder or quarantine. | Low | ORCA |
| ORCA.140 | High Confidence Spam action set to Quarantine message. | Medium | ORCA |
| ORCA.141 | Bulk action set to Move message to Junk Email Folder. | Low | ORCA |
| ORCA.142 | Phish action set to Quarantine message. | Medium | ORCA |
| ORCA.143 | Safety Tips are enabled. | Info | ORCA |
| ORCA.156 | Safe Links Policies are tracking when user clicks on safe links. | Medium | ORCA |
| ORCA.158 | Safe Attachments is enabled for SharePoint and Teams. | Medium | ORCA |
| ORCA.179 | Safe Links is enabled intra-organization. | Medium | ORCA |
| ORCA.180 | Anti-phishing policy exists and EnableSpoofIntelligence is true. | Medium | ORCA |
| ORCA.189 | Safe Attachments is not bypassed. | Medium | ORCA |
| ORCA.189.2 | Safe Links is not bypassed. | High | ORCA |
| ORCA.205 | Common attachment type filter is enabled. | Medium | ORCA |
| ORCA.220 | Advanced Phish filter Threshold level is adequate. | Medium | ORCA |
| ORCA.221 | Mailbox intelligence is enabled in anti-phishing policies. | Medium | ORCA |
| ORCA.222 | Domain Impersonation action is set to move to Quarantine. | Medium | ORCA |
| ORCA.223 | User impersonation action is set to move to Quarantine. | Medium | ORCA |
| ORCA.224 | Similar Users Safety Tips is enabled. | Info | ORCA |
| ORCA.225 | Safe Documents is enabled for Office clients. | Medium | ORCA |
| ORCA.226 | Each domain has a Safe Link policy applied to it. | Medium | ORCA |
| ORCA.227 | Each domain has a Safe Attachments policy applied to it. | Medium | ORCA |
| ORCA.228 | No trusted senders in Anti-phishing policy. | Medium | ORCA |
| ORCA.229 | No trusted domains in Anti-phishing policy. | Medium | ORCA |
| ORCA.230 | Each domain has a Anti-phishing policy applied to it, or the default policy is being used. | Low | ORCA |
| ORCA.231 | Each domain has a anti-spam policy applied to it, or the default policy is being used. | Low | ORCA |
| ORCA.232 | Each domain has a malware filter policy applied to it, or the default policy is being used. | Low | ORCA |
| ORCA.233 | Domains are pointed directly at EOP or enhanced filtering is used. | Medium | ORCA |
| ORCA.233.1 | Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors. | Medium | ORCA |
| ORCA.234 | Click through is disabled for Safe Documents. | Medium | ORCA |
| ORCA.235 | SPF records is set up for all your custom domains. | Medium | ORCA |
| ORCA.236 | Safe Links is enabled for emails. | Medium | ORCA |
| ORCA.237 | Safe Links is enabled for teams messages. | Medium | ORCA |
| ORCA.238 | Safe Links is enabled for office documents. | Medium | ORCA |
| ORCA.239 | No exclusions for the built-in protection policies. | High | ORCA |
| ORCA.240 | Outlook is configured to display external tags for external emails. | Medium | ORCA |
| ORCA.241 | Anti-phishing policy exists and EnableFirstContactSafetyTips is true. | Medium | ORCA |
| ORCA.242 | Important protection alerts responsible for AIR activities are enabled. | High | ORCA |
| ORCA.243 | Authenticated Receive Chain is set up for domains not pointing to EOP/MDO, or all domains point to EOP/MDO. | Medium | ORCA |
| ORCA.244 | Policies are configured to honor sending domains DMARC. | Medium | ORCA |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.