CIS Microsoft 365 Foundations Benchmark
Checks that implement recommendations of the CIS Microsoft 365 Foundations Benchmark (and a few of the CIS GitHub Benchmark).
49 checks: 9 High, 40 Medium.
| ID | Title | Severity | Product |
|---|---|---|---|
| CIS.GH.1.2.2 | Ensure repository creation is limited to specific members (not run by Mito) | Medium | GitHub |
| CIS.GH.1.2.3 | Ensure repository deletion is limited to specific users (not run by Mito) | High | GitHub |
| CIS.GH.1.2.4 | Ensure issue deletion is limited to specific users (not run by Mito) | Medium | GitHub |
| CIS.GH.1.3.2 | Ensure team creation is limited to specific members (not run by Mito) | Medium | GitHub |
| CIS.GH.1.3.8 | Ensure strict base permissions are set for repositories (not run by Mito) | High | GitHub |
| CIS.M365.1.1.1 | Ensure Administrative accounts are cloud-only | High | Microsoft 365 |
| CIS.M365.1.1.3 | Ensure that between two and four global admins are designated | High | Microsoft 365 |
| CIS.M365.1.2.1 | Ensure that only organizationally managed/approved public groups exist | Medium | Microsoft 365 |
| CIS.M365.1.2.2 | Ensure sign-in to shared mailboxes is blocked | Medium | Microsoft 365 |
| CIS.M365.1.3.1 | Ensure the ‘Password expiration policy’ is set to ‘Set passwords to never expire (recommended)’ | Medium | Microsoft 365 |
| CIS.M365.1.3.3 | Ensure ‘External sharing’ of calendars is not available | Medium | Microsoft 365 |
| CIS.M365.1.3.4 | Ensure ‘User owned apps and services’ is restricted | Medium | Microsoft 365 |
| CIS.M365.1.3.5 | Ensure internal phishing protection for Forms is enabled | Medium | Microsoft 365 |
| CIS.M365.1.3.6 | Ensure the customer lockbox feature is enabled | Medium | Microsoft 365 |
| CIS.M365.1.3.7 | Ensure ‘third-party storage services’ are restricted in ‘Microsoft 365 on the web’ | Medium | Microsoft 365 |
| CIS.M365.2.1.1 | Ensure Safe Links for Office Applications is Enabled (Only Checks Priority 0 Policy) | Medium | Defender |
| CIS.M365.2.1.2 | Ensure the Common Attachment Types Filter is enabled (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.1.3 | Ensure notifications for internal users sending malware is Enabled (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.1.4 | Ensure Safe Attachments policy is enabled (Only Checks Default Policy) | High | Defender |
| CIS.M365.2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled | Medium | Defender |
| CIS.M365.2.1.6 | Ensure Exchange Online Spam Policies are set to notify administrators (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.1.7 | Ensure that an anti-phishing policy has been created (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.1.9 | Ensure that DKIM is enabled for all Exchange Online Domains | Medium | Defender |
| CIS.M365.2.1.11 | Ensure comprehensive attachment filtering is applied | Medium | Defender |
| CIS.M365.2.1.12 | Ensure the connection filter IP allow list is not used (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.1.13 | Ensure the connection filter safe list is off (Only Checks Default Policy) | Medium | Defender |
| CIS.M365.2.4.4 | Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled) | Medium | Defender |
| CIS.M365.3.1.1 | Ensure Microsoft 365 audit log search is Enabled | High | Purview |
| CIS.M365.4.1 | Ensure devices without a compliance policy are marked ‘not compliant’ | Medium | Intune |
| CIS.M365.5.1.2.2 | Ensure users cannot register applications | Medium | Entra ID |
| CIS.M365.5.1.2.3 | Ensure ‘Restrict non-admin users from creating tenants’ is set to ‘Yes’ | Medium | Entra ID |
| CIS.M365.5.1.4.6 | Ensure users are restricted from recovering BitLocker keys | Medium | Entra ID |
| CIS.M365.5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowed | High | Entra ID |
| CIS.M365.5.1.5.2 | Ensure the admin consent workflow is enabled | High | Entra ID |
| CIS.M365.5.1.6.2 | Ensure that guest user access is restricted | Medium | Entra ID |
| CIS.M365.5.2.3.5 | Ensure weak authentication methods are disabled | High | Entra ID |
| CIS.M365.6.5.3 | Ensure additional storage providers are restricted in Outlook on the web | Medium | Exchange Online |
| CIS.M365.7.2.2 | Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled (not run by Mito) | Medium | SharePoint |
| CIS.M365.7.2.5 | Ensure that SharePoint guest users cannot share items they don’t own (not run by Mito) | Medium | SharePoint |
| CIS.M365.7.2.7 | Ensure link sharing is restricted in SharePoint and OneDrive (not run by Mito) | Medium | SharePoint |
| CIS.M365.7.2.9 | Ensure guest access to a site or OneDrive will expire automatically (not run by Mito) | Medium | SharePoint |
| CIS.M365.7.2.11 | Ensure the SharePoint default sharing link permission is set (not run by Mito) | Medium | SharePoint |
| CIS.M365.7.3.1 | Ensure Office 365 SharePoint infected files are disallowed for download (not run by Mito) | Medium | SharePoint |
| CIS.M365.8.1.1 | Ensure external file sharing in Teams is enabled for only approved cloud storage services | Medium | Teams |
| CIS.M365.8.2.2 | Ensure communication with unmanaged Teams users is disabled | Medium | Teams |
| CIS.M365.8.2.3 | Ensure external Teams users cannot initiate conversations | Medium | Teams |
| CIS.M365.8.4.1 | Ensure app permission policies are configured | Medium | Teams |
| CIS.M365.8.5.3 | Ensure only people in my org can bypass the lobby | Medium | Teams |
| CIS.M365.8.6.1 | Ensure users can report security concerns in Teams | Medium | Teams |
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.