Entra ID
179 checks from CIS Microsoft 365 Foundations Benchmark, CISA SCuBA baselines, EIDSCA, Mito: 81 High, 79 Medium, 19 Low.
| ID | Title | Severity | Suite |
|---|---|---|---|
| CIS.M365.5.1.2.2 | Ensure users cannot register applications | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.2.3 | Ensure ‘Restrict non-admin users from creating tenants’ is set to ‘Yes’ | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.4.6 | Ensure users are restricted from recovering BitLocker keys | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowed | High | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.5.2 | Ensure the admin consent workflow is enabled | High | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.1.6.2 | Ensure that guest user access is restricted | Medium | CIS Microsoft 365 Foundations Benchmark |
| CIS.M365.5.2.3.5 | Ensure weak authentication methods are disabled | High | CIS Microsoft 365 Foundations Benchmark |
| CISA.MS.AAD.1.1 | Legacy authentication SHALL be blocked. | High | CISA SCuBA baselines |
| CISA.MS.AAD.2.1 | Users detected as high risk SHALL be blocked. | High | CISA SCuBA baselines |
| CISA.MS.AAD.2.2 | A notification SHOULD be sent to the administrator when high-risk users are detected. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.2.3 | Sign-ins detected as high risk SHALL be blocked. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.1 | Phishing-resistant MFA SHALL be enforced for all users. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.2 | If phishing-resistant MFA has not been enforced, an alternative MFA method SHALL be enforced for all users. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.3 | If Microsoft Authenticator is enabled, it SHALL be configured to show login context information. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.3.4 | The Authentication Methods Manage Migration feature SHALL be set to Migration Complete. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.5 | The authentication methods SMS, Voice Call, and Email One-Time Passcode (OTP) SHALL be disabled. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.6 | Phishing-resistant MFA SHALL be required for highly privileged roles. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.7 | Managed devices SHOULD be required for authentication. | High | CISA SCuBA baselines |
| CISA.MS.AAD.3.8 | Managed Devices SHOULD be required to register MFA. | High | CISA SCuBA baselines |
| CISA.MS.AAD.4.1 | Security logs SHALL be sent to the agency’s security operations center for monitoring. (not run by Mito) | High | CISA SCuBA baselines |
| CISA.MS.AAD.5.1 | Only administrators SHALL be allowed to register applications. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.5.2 | Only administrators SHALL be allowed to consent to applications. | High | CISA SCuBA baselines |
| CISA.MS.AAD.5.3 | An admin consent workflow SHALL be configured for applications. | High | CISA SCuBA baselines |
| CISA.MS.AAD.5.4 | Group owners SHALL NOT be allowed to consent to applications. | High | CISA SCuBA baselines |
| CISA.MS.AAD.6.1 | User passwords SHALL NOT expire. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.7.1 | A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.2 | Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.3 | Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.4 | Permanent active role assignments SHALL NOT be allowed for highly privileged roles. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.5 | Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.6 | Activation of the Global Administrator role SHALL require approval. | High | CISA SCuBA baselines |
| CISA.MS.AAD.7.7 | Eligible and Active highly privileged role assignments SHALL trigger an alert. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.7.8 | User activation of the Global Administrator role SHALL trigger an alert. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.7.9 | User activation of other highly privileged roles SHOULD trigger an alert. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.8.1 | Guest users SHOULD have limited or restricted access to Entra ID directory objects. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.8.2 | Only users with the Guest Inviter role SHOULD be able to invite guest users. | Medium | CISA SCuBA baselines |
| CISA.MS.AAD.8.3 | Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes. | Medium | CISA SCuBA baselines |
| EIDSCA.AF01 | Authentication Method - FIDO2 security key - State. | High | EIDSCA |
| EIDSCA.AF02 | Authentication Method - FIDO2 security key - Allow self-service set up. | High | EIDSCA |
| EIDSCA.AF03 | Authentication Method - FIDO2 security key - Enforce attestation. | High | EIDSCA |
| EIDSCA.AF04 | Authentication Method - FIDO2 security key - Enforce key restrictions. | Medium | EIDSCA |
| EIDSCA.AF05 | Authentication Method - FIDO2 security key - Restricted. | Medium | EIDSCA |
| EIDSCA.AF06 | Authentication Method - FIDO2 security key - Restrict specific keys. | Medium | EIDSCA |
| EIDSCA.AG01 | Authentication Method - General Settings - Manage migration. | High | EIDSCA |
| EIDSCA.AG02 | Authentication Method - General Settings - Report suspicious activity - State. | Medium | EIDSCA |
| EIDSCA.AG03 | Authentication Method - General Settings - Report suspicious activity - Included users/groups. | Medium | EIDSCA |
| EIDSCA.AM01 | Authentication Method - Microsoft Authenticator - State. | High | EIDSCA |
| EIDSCA.AM02 | Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP. | Medium | EIDSCA |
| EIDSCA.AM03 | Authentication Method - Microsoft Authenticator - Require number matching for push notifications. | High | EIDSCA |
| EIDSCA.AM04 | Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications. | High | EIDSCA |
| EIDSCA.AM06 | Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications. | Medium | EIDSCA |
| EIDSCA.AM07 | Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications. | Medium | EIDSCA |
| EIDSCA.AM09 | Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications. | Medium | EIDSCA |
| EIDSCA.AM10 | Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications. | Medium | EIDSCA |
| EIDSCA.AP01 | Default Authorization Settings - Enabled Self service password reset for administrators. | High | EIDSCA |
| EIDSCA.AP04 | Default Authorization Settings - Guest invite restrictions. | Medium | EIDSCA |
| EIDSCA.AP05 | Default Authorization Settings - Sign-up for email based subscription. | Medium | EIDSCA |
| EIDSCA.AP06 | Default Authorization Settings - User can join the tenant by email validation. | Medium | EIDSCA |
| EIDSCA.AP07 | Default Authorization Settings - Guest user access. | Medium | EIDSCA |
| EIDSCA.AP08 | Default Authorization Settings - User consent policy assigned for applications. | High | EIDSCA |
| EIDSCA.AP09 | Default Authorization Settings - Allow user consent on risk-based apps. | High | EIDSCA |
| EIDSCA.AP10 | Default Authorization Settings - Default User Role Permissions - Allowed to create Apps. | Medium | EIDSCA |
| EIDSCA.AP14 | Default Authorization Settings - Default User Role Permissions - Allowed to read other users. | Low | EIDSCA |
| EIDSCA.AS04 | Authentication Method - SMS - Use for sign-in. | High | EIDSCA |
| EIDSCA.AT01 | Authentication Method - Temporary Access Pass - State. | Medium | EIDSCA |
| EIDSCA.AT02 | Authentication Method - Temporary Access Pass - One-time. | Medium | EIDSCA |
| EIDSCA.AV01 | Authentication Method - Voice call - State. | High | EIDSCA |
| EIDSCA.CP01 | Default Settings - Consent Policy Settings - Group owner consent for apps accessing data. | High | EIDSCA |
| EIDSCA.CP03 | Default Settings - Consent Policy Settings - Block user consent for risky apps. | High | EIDSCA |
| EIDSCA.CP04 | Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to. | High | EIDSCA |
| EIDSCA.CR01 | Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature. | High | EIDSCA |
| EIDSCA.CR02 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests. | Low | EIDSCA |
| EIDSCA.CR03 | Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire. | Low | EIDSCA |
| EIDSCA.CR04 | Consent Framework - Admin Consent Request - Consent request duration (days). | Low | EIDSCA |
| EIDSCA.PR01 | Default Settings - Password Rule Settings - Password Protection - Mode. | High | EIDSCA |
| EIDSCA.PR02 | Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory. | High | EIDSCA |
| EIDSCA.PR03 | Default Settings - Password Rule Settings - Enforce custom list. | Medium | EIDSCA |
| EIDSCA.PR05 | Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds. | Medium | EIDSCA |
| EIDSCA.PR06 | Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold. | Medium | EIDSCA |
| EIDSCA.ST08 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner. | Medium | EIDSCA |
| EIDSCA.ST09 | Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content. | Low | EIDSCA |
| MT.1001 | At least one Conditional Access policy is configured with device compliance. | Medium | Mito |
| MT.1002 | App management restrictions on applications and service principals is configured and enabled. | Medium | Mito |
| MT.1003 | At least one Conditional Access policy is configured with All Apps. | High | Mito |
| MT.1004 | At least one Conditional Access policy is configured with All Apps and All Users. | High | Mito |
| MT.1005 | All Conditional Access policies are configured to exclude at least one emergency/break glass account or group. | High | Mito |
| MT.1006 | At least one Conditional Access policy is configured to require MFA for admins. | High | Mito |
| MT.1007 | At least one Conditional Access policy is configured to require MFA for all users. | High | Mito |
| MT.1008 | At least one Conditional Access policy is configured to require MFA for Azure management. | High | Mito |
| MT.1009 | At least one Conditional Access policy is configured to block other legacy authentication. | High | Mito |
| MT.1010 | At least one Conditional Access policy is configured to block legacy authentication for Exchange ActiveSync. | High | Mito |
| MT.1011 | At least one Conditional Access policy is configured to secure security info registration only from a trusted location. | High | Mito |
| MT.1012 | At least one Conditional Access policy is configured to require MFA for risky sign-ins. | High | Mito |
| MT.1013 | At least one Conditional Access policy is configured to require new password when user risk is high. | High | Mito |
| MT.1014 | At least one Conditional Access policy is configured to require compliant or Entra hybrid joined devices for admins. | High | Mito |
| MT.1015 | At least one Conditional Access policy is configured to block access for unknown or unsupported device platforms. | Medium | Mito |
| MT.1016 | At least one Conditional Access policy is configured to require MFA for guest access. | High | Mito |
| MT.1017 | At least one Conditional Access policy is configured to enforce non persistent browser session for non-corporate devices. | Medium | Mito |
| MT.1018 | At least one Conditional Access policy is configured to enforce sign-in frequency for non-corporate devices. | Medium | Mito |
| MT.1019 | At least one Conditional Access policy is configured to enable application enforced restrictions. | Medium | Mito |
| MT.1020 | All Conditional Access policies are configured to exclude Directory/OnPremises synchronization accounts or do not scope them. | Medium | Mito |
| MT.1021 | Security Defaults are enabled. | High | Mito |
| MT.1022 | All users utilizing a P1 license should be licensed. | Low | Mito |
| MT.1023 | All users utilizing a P2 license should be licensed. | Low | Mito |
| MT.1024 | Entra recommendations should be completed. | Medium | Mito |
| MT.1025 | No external user with permanent role assignment on Control Plane. | High | Mito |
| MT.1026 | No hybrid user with permanent role assignment on Control Plane. | High | Mito |
| MT.1027 | No Service Principal with Client Secret and permanent role assignment on Control Plane. | High | Mito |
| MT.1028 | No user with mailbox and permanent role assignment on Control Plane. | High | Mito |
| MT.1029 | Stale accounts are not assigned to privileged roles. | High | Mito |
| MT.1030 | Eligible role assignments on Control Plane are in use by administrators. | High | Mito |
| MT.1031 | Privileged role on Control Plane are managed by PIM only. | High | Mito |
| MT.1032 | Limited number of Global Admins are assigned. | High | Mito |
| MT.1033 | Users should be blocked from using legacy authentication. | High | Mito |
| MT.1034 | Emergency access users should not be blocked. | High | Mito |
| MT.1035 | All security groups assigned to Conditional Access Policies should be protected by RMAU. | High | Mito |
| MT.1036 | All excluded objects should have a fallback include in another policy. | Medium | Mito |
| MT.1038 | Conditional Access policies should not include or exclude deleted groups. | Medium | Mito |
| MT.1049 | Conditional Access policies for User Risk and Sign-in Risk should be configured separately. | High | Mito |
| MT.1050 | Apps with high-risk permissions having a direct path to Global Administrator | High | Mito |
| MT.1051 | Apps with high-risk permissions having an indirect path to Global Administrator | High | Mito |
| MT.1052 | At least one Conditional Access policy is targeting the Device Code authentication flow. | High | Mito |
| MT.1055 | Microsoft 365 Group (and Team) creation should be restricted to approved users. | Medium | Mito |
| MT.1057 | App registrations should no longer use secrets. | Medium | Mito |
| MT.1058 | Exchange application access policies must be configured. | Medium | Mito |
| MT.1061 | Device registration MFA control conflicts with Conditional Access policies. | Medium | Mito |
| MT.1063 | All App registration owners should have MFA registered | High | Mito |
| MT.1066 | Conditional Access policies should not reference non-existent users, groups, or roles. | Medium | Mito |
| MT.1067 | Authentication method policies should not reference non-existent groups. | Low | Mito |
| MT.1068 | Restrict non-admin users from creating tenants. | Medium | Mito |
| MT.1069 | Restrict non-admin users from creating security groups. | Low | Mito |
| MT.1070 | Restrict device join to selected users/groups or none. | Medium | Mito |
| MT.1071 | At least one Conditional Access policy explicitly includes Azure DevOps. | Medium | Mito |
| MT.1072 | Conditional Access policies should not use the deprecated Approved Client App grant. | High | Mito |
| MT.1073 | Soft- and hard-matching of synchronized objects should be blocked. | Medium | Mito |
| MT.1075 | Require explicit assignment of Third Party Entra Apps. | Medium | Mito |
| MT.1084 | Microsoft Entra seamless single sign-on should be disabled for all domains in EntraID Connect servers. | High | Mito |
| MT.1090 | Global Administrator role should not be added as local administrator on the device during Microsoft Entra join | Medium | Mito |
| MT.1091 | Registering user should not be added as local administrator on the device during Microsoft Entra join | Medium | Mito |
| MT.1106 | Catalog resources must have valid roles (no stale / removed app roles or SPNs). | Low | Mito |
| MT.1107 | Access packages and catalogs should not reference deleted groups. | Low | Mito |
| MT.1108 | Access packages should not reference inactive or orphaned assignment policies. | Low | Mito |
| MT.1109 | Access package approval workflows must have valid approvers. | Low | Mito |
| MT.1110 | No catalog should contain resources without any associated access packages. | Low | Mito |
| MT.1147 | Do not sync krbtgt_AzureAD to Entra ID. | High | Mito |
| MT.1181 | Conditional Access policy is present that blocks high agent risk sign-ins. | High | Mito |
| MT.1182 | Mature DMARC policy SHALL be published for every Entra managed and verified domain. | Medium | Mito |
| MT.1183 | Temporary bypass for onPremisesObjectIdentifier updates should be disabled. | Medium | Mito |
| MT.1184 | Conditional Access policy without any target resources configured. | Medium | Mito |
| MT.1185 | Block legacy MSOnline (MSOL) PowerShell module. | Medium | Mito |
| MT.1186 | Require explicit assignment of high-privilege first-party Entra Apps. | Medium | Mito |
| MT.1187 | The Microsoft 365 traffic forwarding profile in Global Secure Access should be enabled. | Medium | Mito |
| MT.1188 | Entra Private Access applications should be covered by a Conditional Access policy that requires a managed device. | Medium | Mito |
| MT.1189 | Groups assigned to Global Secure Access traffic forwarding profiles should not be nested. | Medium | Mito |
| MT.1190 | Entra Private Access applications should not use the Default connector group. | Low | Mito |
| MT.1191 | Break-glass accounts should be excluded from the Compliant Network Conditional Access policy. | Medium | Mito |
| MT.1192 | Groups assigned to Entra Private Access applications should not be nested. | Low | Mito |
| MT.1193 | Entra Private Access application segments should avoid broad or risky destinations. | Medium | Mito |
| MT.1194 | The baseline Global Secure Access security profile should enforce a threat-intelligence floor. | Medium | Mito |
| MT.1195 | The Quick Access app should not be subject to a sign-in frequency Conditional Access control. | Low | Mito |
| MT.1196 | Review who can change attributes used by dynamic group rules. | Medium | Mito |
| MT.1197 | Remove memberOf rules. | Medium | Mito |
| MT.1198 | App registration certificates should not have excessive validity periods. | Medium | Mito |
| MT.1199 | App registration credentials should not be expired or expiring soon. | Low | Mito |
| MT.1200 | Agent Identities should have an active Agent Identity Blueprint Principal (Preview). | Medium | Mito |
| MT.1201 | Agent Users should have an existing parent Agent Identity (Preview). | Medium | Mito |
| MT.1203 | Agent Identity Blueprint Principals should have an existing Blueprint (Preview). | Medium | Mito |
| MT.1204 | Agent Identities, Blueprint Principals, and Blueprints should have active, enabled owners (Preview). | Medium | Mito |
| MT.1205 | Agent Identity Blueprints and Blueprint Principals should have assigned sponsors (Preview). | Medium | Mito |
| MT.1206 | Enabled Agent Identities should have active sign-in activity within the last 180 days (Preview). | Medium | Mito |
| MT.1207 | Foreign or multi-tenant Agent Blueprint Principals and Agent Identities should not hold privileged directory roles (Preview). | High | Mito |
| MT.1208 | Agent Identity Blueprints should not have expired, excessive, or long-lived client credentials (Preview). | Medium | Mito |
| MT.1209 | Agent Identities and Blueprint Principals should not be assigned privileged Entra directory roles (Preview). | High | Mito |
| MT.1210 | Agent Users should not have privileged directory roles or membership in role-assignable groups (Preview). | High | Mito |
| MT.1211 | Agent Identity Blueprints should not use the allAllowed inheritance pattern for delegated scopes or application roles (Preview). | High | Mito |
| MT.1212 | Agent Identity Blueprint Principals should require assignment for the application roles they expose (Preview). | Medium | Mito |
| MT.1213 | Agent Identity Blueprints should not use wildcard or plain-http redirect URIs (Preview). | High | Mito |
| MT.1223 | Agent Identities should not have high-risk Microsoft Graph permissions (Preview). | High | Mito |
| MT.1224 | Microsoft-managed Conditional Access policies should not be left in report-only mode. | Low | Mito |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.