# Welcome to Tminus365 Docs
## Overview
Tminus365 Docs is a robust expansion of [my blog](https://tminus365.com/). I create many how-to guides, configuration docs, and in-depth technical tutorials so I wanted to start adding them in a structured repository. This also makes it easier to track version control for updates.
## Section Overview
Security
The security section shows recommend security controls across the Microsoft 365 Suite offerings based on the CIS Controls. Each control contains the following subsections and enablement materials:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
Configurations
The configurations section contains relevant how-to information for configuring certain settings across various services and/or vendors.
CIS Controls
This section will likely evolve into "Compliance" over time but today it contains links to obtain my premium content where I map Microsoft 365 security configurations to the CIS Controls.
Vendor Integrations
This section includes any vendor integration documentation I have created over time. In many cases, it is leveraging the vendor API to perform some type of automation or integration with Microsoft 365.
## Receiving Updates
If you would like to receive updates when new content is added or existing content is modified, please sign up here. Please know that I am not here to spam you with every text change I make to docs. This will just be monthly, summarized update on high level changes/additions:
{% @mailchimp/mailchimpSubscribe %}
# Azure AD (Entra)
High | Azure AD P1 | Enforcing Per User MFA or MFA via Security Defaults |
| [MFA is enforced on accounts with Highly Privileged Roles](/security/azure-ad-entra/mfa-is-enforced-on-accounts-with-highly-privileged-roles) | Low | Azure AD P1 | Enforcing Per User MFA or MFA via Security Default |
| [MFA is enforced for Azure Management](/security/azure-ad-entra/mfa-is-enforced-for-azure-management) | Low | Azure AD P1 | N/A |
| [MFA registration and usage shall be periodically reviewed](/security/azure-ad-entra/mfa-registration-and-usage-shall-be-periodically-reviewed) | None | Any | Any |
| [Legacy Authentication shall be blocked](/security/azure-ad-entra/legacy-authentication-shall-be-blocked) | Medium | Azure AD P1 | Legacy Auth methods can be disabled in an account manually without P1 via Security defaults |
| [High Risk Users Shall Be Blocked](/security/azure-ad-entra/high-risk-users-shall-be-blocked) | High | Azure AD P2 | N/A |
| [High Risk Sign-Ins Shall Be Blocked](/security/azure-ad-entra/high-risk-sign-ins-shall-be-blocked) | High | Azure AD P2 | N/A |
| [Browser Sessions shall not be persistent for privileged users](/security/azure-ad-entra/browser-sessions-shall-not-be-persistent-for-privileged-users) | Medium | Azure AD P1 | N/A |
| [MFA shall be required to enroll devices to Azure AD](/security/azure-ad-entra/mfa-shall-be-required-to-enroll-devices-to-azure-ad) | Medium | Any | N/A |
| [Managed Devices shall be required for authentication](/security/azure-ad-entra/managed-devices-shall-be-required-for-authentication) | High | Azure AD P1 + Intune | N/A |
| [Guest User Access Shall be restricted](/security/azure-ad-entra/guest-user-access-shall-be-restricted) | Low | Any | N/A |
| [The number of users with highly privileged roles shall be limited](/security/azure-ad-entra/the-number-of-users-with-highly-privileged-roles-shall-be-limited) | Low | Any | N/A |
| [Users assigned highly privileged roles shall not have permanent permissions](/security/azure-ad-entra/users-assigned-highly-privileged-roles-shall-not-have-permanent-permissions) | Low | Azure AD P2 | N/A |
| [Activation of privileged roles should be monitored and require approval](/security/azure-ad-entra/activation-of-privileged-roles-should-be-monitored-and-require-approval) | Low | Azure AD P2 | N/A |
| [Highly privileged accounts shall be cloud-only](/security/azure-ad-entra/highly-privileged-accounts-shall-be-cloud-only) | Low | Any | N/A |
| [Highly privileged role assignments shall be periodically reviewed](/security/azure-ad-entra/highly-privileged-role-assignments-shall-be-periodically-reviewed) | Low | Azure AD P2 | Manual monitoring can be performed in the Azure Portal or with PowerShell |
| [Passwords shall not expire](/security/azure-ad-entra/passwords-shall-not-expire) | Medium | Any | N/A |
| [Azure AD Logs shall be collected](/security/azure-ad-entra/azure-ad-logs-shall-be-collected) | None | Azure AD P1 | Without P1, logs are retained for 7 days |
| [Only Admins shall be allowed to register 3rd party applications](/security/azure-ad-entra/only-admins-shall-be-allowed-to-register-3rd-party-applications) | Low | Any | N/A |
| [Non-admin users shall be prevented from providing consent to 3rd party applications](/security/azure-ad-entra/non-admin-users-shall-be-prevented-from-providing-consent-to-3rd-party-applications) | Low | Any | N/A |
| [Authorized Applications shall be configured for Single Sign-On](/security/azure-ad-entra/authorized-applications-shall-be-configured-for-single-sign-on) | Medium | Azure AD P1 | N/A |
| [Inactive accounts shall be blocked or deleted](/security/azure-ad-entra/inactive-accounts-shall-be-blocked-or-deleted) | None | Any | N/A |
# MFA Shall Be Required for All Users
## Description
MFA, or multi-factor authentication, is a security measure that requires users to provide multiple forms of identification to gain access to a system or network. By enforcing MFA within an organization, companies can better protect themselves against cyber threats, such as hacking and identity theft.
At a minimum, users with privileged roles such as Global Administrators should have MFA enforced. Where possible, phishing-resistant MFA should be required for all users. Phishing-resistant multifactor authentication protects against sophisticated phishing attacks. Phishing-resistant MFA may not always be immediately available, especially on mobile devices. Where phishing-resistant MFA is not yet available, organization should adopt an MFA method from the list below
High
{% endhint %}
End-User impact is high due to the necessary configuration steps along and prompts to fulfill MFA request. The user experience will vary depending on which MFA methods you have set up. In my [CIS section](/cis-controls/cis-mapped-to-m365), I have end-user notifications available as part of the Security Baselines document.
" %}
{% embed url="" %}
# MFA is enforced on accounts with Highly Privileged Roles
## Description
Require users to perform MFA to access highly privileged roles. This configuration provides a backup policy to enforce MFA for highly privileged users in case the main conditional access policy—which requires MFA for all users—is disabled or misconfigured.
## Policy
* MFA shall be required for users to access highly privileged roles
* Highly Privileged roles include the following:
* Global Administrator
* Privileged Role Administrator
* User Administrator
* SharePoint Administrator
* Exchange Administrator
* Hybrid Identity Administrator
* Application Administrator
* Teams Administrator
* One emergency access account shall be excluded from the MFA policy
## Licensing Considerations
Enforcing MFA for privileged roles through conditional access requires an Azure AD P1 license which can be purchased standalone or through the following common plans:
o Microsoft 365 Business Premium
o EMS + E3 or EMS + E5
o Microsoft 365 E3
o Microsoft 365 E5
## Set Up Instructions
1\. Create a Conditional Access Policy with the [Templates: available](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common#conditional-access-templates-preview)
2\. Chose the “Require Multi-Factor authentication for Admins” setting
3\. Modify the policy to ensure your emergency access user/group is excluded
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
End-User impact is low due to this policy scoped to a small set of users. The end-user experience is the same as the previous section. The user experience will vary depending on which MFA methods you have set up.
{% hint style="info" %}
Tips
* Create a group in Azure Active Directory used to place all accounts excluded from MFA. This would be your emergency break-glass account and a service accounts such as the Azure AD Connect sync service account.
* If you are able to enforce phishing-resistant MFA across all users, at minimum try to enable it for accounts with privileged roles (Global Admins, User Admins, etc.)
* Turn the Conditional Access Policy to “Report-Only” mode to get information around how many users in the organization this will impact before turning the policy on.
{% endhint %}
## PowerShell Scripts
Viewing Global Admins without MFA: [Security/Customer-Global Admin without MFA.ps1 at master · msp4msps/Security (github.com)](https://github.com/msp4msps/Security/blob/master/Customer-Global%20Admin%20without%20MFA.ps1)
Conditional Access Policies as Code: [Azure-Samples/azure-ad-conditional-access-apis: Use Conditional Access Graph APIs to manage policies like code. Automate approvals to promote policies from preproduction environments, backup and restore, monitor change, and plan ahead for emergencies. (github.com)](https://github.com/Azure-Samples/azure-ad-conditional-access-apis)
## Videos
{% embed url="" %}
# MFA is enforced for Azure Management
## Description
Organizations use many Azure services and manage them from Azure Resource Manager based tools like:
* Azure portal
* Azure PowerShell
* Azure CLI
These tools can provide highly privileged access to resources that can make the following changes:
* Alter subscription-wide configurations
* Service settings
* Subscription billing
To protect these privileged resources, Microsoft recommends requiring multifactor authentication for any user accessing these resources. This configuration provides a backup policy to enforce MFA for users accessing Azure Resources in case the main conditional access policy—which requires MFA for all users—is disabled or misconfigured.
## Policy
* MFA shall be required for users to access Azure Resources
* One emergency access account shall be excluded from the MFA policy
## Licensing Considerations
Enforcing MFA for Azure Management through conditional access requires an Azure AD P1 license which can be purchased standalone or through the following common plans:
* Microsoft 365 Business Premium
* EMS + E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Create a Conditional Access Policy with the [Templates available](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common#conditional-access-templates-preview)
2. Chose the “Require Multi-Factor authentication for Azure Management” setting
3. Modify the policy to ensure your emergency access user/group is excluded
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
End-User impact is low due to this policy scoped to a small set of users. The end-user experience is the same as the previous section. The user experience will vary depending on which MFA methods you have set up. Below you will find links to end-user communication templates that help for various rollout scenarios.
{% hint style="info" %}
Tips
Create a group in Azure Active Directory used to place all accounts excluded from MFA. This would be your emergency break-glass account and a service accounts such as the Azure AD Connect sync service account.
Turn the Conditional Access Policy to “Report-Only” mode to get information around how many users in the organization this will impact before turning the policy on.
{% endhint %}
## PowerShell Scripts
Conditional Access Policies as Code: [Azure-Samples/azure-ad-conditional-access-apis: Use Conditional Access Graph APIs to manage policies like code. Automate approvals to promote policies from preproduction environments, backup and restore, monitor change, and plan ahead for emergencies. (github.com)](https://github.com/Azure-Samples/azure-ad-conditional-access-apis)
## Videos
{% embed url="" %}
# MFA registration and usage shall be periodically reviewed
## Description
MFA registration should periodically be reviewed to ensure that there are no gaps or misconfigurations of deployment. MFA can be monitored natively within Azure Active Directory or with 3rd party tools.
## Policy
* MFA registration details and usage shall be monitored on a defined schedule.
## Licensing Considerations
Viewing Authentication Activity in Azure AD requires an Azure AD P1 license which can be purchased standalone or through the following common plans:
* Microsoft 365 Business Premium
* EMS + E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
MFA reports can also be derived from PowerShell which does not require an Azure AD P1 license and can be used with any Microsoft licensing model
## Set Up Instructions
To view the Authentication Activity: [Authentication Methods Activity - Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-methods-activity)
Using the Azure AD sign-ins report: [Sign-in event details for Azure AD Multi-Factor Authentication - Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-reporting)
Usage Graph API: [List credentialUserRegistrationDetails - Microsoft Graph beta | Microsoft Learn](https://learn.microsoft.com/en-us/graph/api/reportroot-list-credentialuserregistrationdetails?view=graph-rest-beta\&tabs=http)
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no end-user impact when looking at log information or reports on MFA.
{% hint style="info" %}
Tips
Try to review this information at least quarterly
The [registration and reset events](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-methods-activity#registration-and-reset-events) of the Authentication methods section can also be used to investigate potential post-breach activity. Attackers sometimes reset MFA registration methods after accessing a compromised account.
{% endhint %}
## PowerShell Scripts
MFA Status Reporting (Multi-tenant): [Security/MFA Status\_Custom Control\_All Customers.ps1 at master · msp4msps/Security (github.com)](https://github.com/msp4msps/Security/blob/master/MFA%20Status_Custom%20Control_All%20Customers.ps1)
Find Global Admins without MFA: [Security/Customer-Global Admin without MFA.ps1 at master · msp4msps/Security (github.com)](https://github.com/msp4msps/Security/blob/master/Customer-Global%20Admin%20without%20MFA.ps1)
## Videos
{% embed url="" %}
{% embed url="" %}
# Legacy Authentication shall be blocked
## Description
Block legacy authentication protocols using a conditional access policy. Legacy authentication does not support multifactor authentication (MFA), which is required to minimize the impact of user credential theft.
## Policy
* Legacy Authentication shall be blocked.
## Licensing Considerations
Enabling a conditional access policy to block legacy authentication requires an Azure AD P1 license which can be purchased standalone or through the following common plans:
* Microsoft 365 Business Premium
* EMS + E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
Legacy Auth can be blocked by enabling Security Defaults which does not require an Azure AD P1 license and can be used with any Microsoft licensing model
## Set Up Instructions
1. Before enabling the policy, you can [review if there is any authentication in use.](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication#identify-legacy-authentication-use)
2. Create a Conditional Access Policy with the [Templates available](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common#conditional-access-templates-preview)
3. Chose the “Block Legacy Authentication” setting
4. Modify the policy to ensure your emergency access user/group is excluded
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
The level of impact here will vary by organization depending on the use of legacy authentication. It is possible there will be no impact at all if no legacy authentication protocols are in use. If there are some in use like IMAP/POP, there would be significant end-user impact. Its best to leverage the sign-in logs as mentioned in the previous section to identify any legacy authentication present and take proactive steps on remediation.
{% hint style="info" %}
Tips
Turn the Conditional Access Policy to “Report-Only” mode to get information around how many users in the organization this will impact before turning the policy on.
Viewing legacy auth sign-ins within Azure AD: [Identify legacy authentication use – Practice Protect Support](https://support.practiceprotect.com/knowledge-base/identify-legacy-authentication-use/?doing_wp_cron=1678631042.2050209045410156250000#:~:text=View%20Legacy%20Protocol%20and%20Authentication%20Logs%201%20Login,chose%20Client%20App%20and%20click%20Apply.%20More%20items)
{% endhint %}
## PowerShell Scripts
Basic Auth Reporting [msp4msps/Basic-Authentication-Reporting (github.com)](https://github.com/msp4msps/Basic-Authentication-Reporting)
## Videos
{% embed url="" %}
{% embed url="" %}
# High Risk Users Shall Be Blocked
## Description
Azure AD Identity Protection uses various signals to detect the risk level for each user and determine if an account has likely been compromised. Users who are determined to be high risk are to be blocked from accessing the system via Conditional Access until an administrator remediates their account.
## Policy
* Users detected as high risk shall be blocked.
* Notifications will be sent to admins when high-risk users are detected.
## Licensing Considerations
Azure AD P2. Can be purchased standalone or part of the following bundles:
* EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Create a conditional access policy for Sign-In risk: [Risk policies - Azure Active Directory Identity Protection - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies)
2. Under Access Controls> Grant, select Block Access
3. To Create notifications for admins: [Azure Active Directory Identity Protection notifications - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications)
Identity Protection Overview: [Azure Active Directory Identity Protection notifications - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications)
## End-User Impact
{% hint style="info" %}
Level: High
{% endhint %}
Once a respective conditional access policy is implemented, if a high-risk user attempts to login, the user will receive an error message with instructions to contact the administrator to re-enable their access.
" %}
{% embed url="" %}
{% embed url="" %}
# High Risk Sign-Ins Shall Be Blocked
## Description
Azure AD Identity Protection uses various signals to detect the risk level for each user sign-in. Sign-ins detected as high risk are to be blocked via Conditional Access.
## Policy
* Sign-Ins detected as high risk shall be blocked.
* Notifications will be sent to admins when high-risk sign-ins are detected.
## Licensing Considerations
Azure AD P2. Can be purchased standalone or part of the following bundles:
* EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Create a conditional access policy for Sign-In risk: [Risk policies - Azure Active Directory Identity Protection - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies)
2. Under Access Controls> Grant, select Block Access
3. To Create notifications for admins: [Azure Active Directory Identity Protection notifications - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications)
Identity Protection Overview: [Azure Active Directory Identity Protection notifications - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications)
## End-User Impact
{% hint style="info" %}
Level: High
{% endhint %}
Once a respective conditional access policy is implemented, if a high-risk user attempts to login, the user will receive an error message with instructions to contact the administrator to re-enable their access.
" %}
# Browser Sessions shall not be persistent for privileged users
## Description
To reduce the risk of credential theft during user sessions, disallow persistent browser sessions for highly privileged users.
## Policy
* Highly privileged users shall not have persistent browser sessions.
## Licensing Considerations
Azure AD P1. Can be purchased standalone or part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Create a conditional access policy for Persistent Browser sessions: [Configure authentication session management - Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime#policy-2-persistent-browser-session)
2. Under Users>Include\Medium
{% endhint %}
Since this will be only scoped to privileged roles, the impact will be limited. The severity of impact is increased to medium since it does require the scoped users to reauthenticate once every time the user closes and reopens the browser.
{% hint style="info" %}
Tips
This is a policy that you could scope additionally to guest users and for external access on personal devices that are not MDM or MAM enrolled.
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
None Currently
# MFA shall be required to enroll devices to Azure AD
## Description
It is recommended to enforce MFA before a user can register or join their device to Azure AD. This ensures that compromised accounts cannot be used to add rogue devices to Azure Active Directory.
## Policy
* MFA shall be required to enroll devices to Azure AD.
## Licensing Considerations
This setting can be configured manually in all tenants via the Azure AD Portal. To enable this setting via Conditional Access, an Azure AD P1 license is required. Can be purchased standalone or part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. [Create a conditional access policy](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policies). Under **Cloud Apps or actions**, select **User Actions** from the dropdown
2. Checkmark the **Register or Join Devices options**
Medium
{% endhint %}
Users will get prompted with MFA when trying to register or join devices to Azure Active Directory. This could be through the out-of-box experience, users signing in via the company portal app, or users registering their devices through the account settings. If the user is brand new, has not set up MFA, and tries to join a device out-of-the box, a [temporary access pass](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-temporary-access-pass) will need to be provided which will allow them to fulfill the MFA requirement.
{% hint style="info" %}
Tips
For users trying to join Azure AD devices as part of the out-of-box experience or prior to getting to configure MFA, [Temporary Access passes](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-temporary-access-pass) can be leveraged to fulfill the requirement
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Managed Devices shall be required for authentication
## Description
Require that users connect to M365 from a device that is managed using conditional access. Companies that are implementing a hybrid Azure AD environment will likely use the conditional access control option named Hybrid Azure AD joined, whereas companies that are using devices that connect directly to the cloud and do not join an on-premises AD will use the conditional access control option named, Require device to be marked as compliant.
Guest user access note: This conditional access policy will impact guest access to the tenant because guest users will be required to authenticate from a managed device similar to regular Azure AD users. For guest users, the organization that manages their home tenant is responsible for managing their devices and the resource tenant must be configured to trust the device claims from the home tenant, otherwise guest users will be blocked by the policy. [This link describes the detailed authentication flow for guest users and how conditional access related to devices is applied](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/authentication-conditional-access). The implementation section describes the cross-tenant settings that must be configured in both the home and the resource tenants to facilitate guest access with managed devices.
## Policy
* Managed Devices shall be required for authentication.
## Licensing Considerations
Azure AD P1 & Microsoft Intune. Can be purchased standalone or part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Create a conditional access policy to require devices to be marked as compliant in order to gain access [Require compliant, hybrid joined devices, or MFA - Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device#create-a-conditional-access-policy)
## End-User Impact
{% hint style="info" %}
Level: High
{% endhint %}
Users will not be able to login to their account on devices not enrolled into Intune and in a “Compliant” state.
{% hint style="info" %}
Tips
Have a plan for guest users in the organization. Follow the steps as linked in the summary section or exclude guest users from the policy.
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Guest User Access Shall be restricted
## Description
Ensure that only users with specific privileges can invite guest users to the tenant and that invites can only be sent to specific external domains. Ensure that guest users have limited access to Azure AD directory objects and that they are required to use MFA.
## Policy
* Only users with the Guest Inviter role should be able to invite guest users.
* Guest invites should only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
* Guest users should have limited access to Azure AD directory objects
* Guest users shall use MFA
* Guest User Access is periodically reviewed
## Licensing Considerations
All License models support the guest settings. Azure AD P1 is required to enforce MFA for Guest users via Conditional Access Can be purchased standalone or part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
1. Configure guest settings in the portal: [Enable B2B external collaboration settings - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure#configure-settings-in-the-portal)
2. Under Guest user access, select Guest users **have limited access to properties and memberships of directory objects**
3. Under Guest invite settings, select **Only users assigned to specific admin roles can invite guest users**
4. Under Collaboration restrictions, select **Allow invitations only to the specified domains** (most restrictive). Select Target domains and enter the names of the external domains that have been authorized by the agency for guest user access.
5. Create a Conditional Access Policy with the [Templates available](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common#conditional-access-templates-preview)
6. Chose the “Require Multi-Factor authentication for guest access” setting
7. Leverage the sign-in logs to review guest user access
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Users will not be able to invite guest users to the organization without the Guest Inviter role. A formal process should be put into place to request guest access for certain organizations or users.
{% hint style="info" %}
Tips
Use the collaboration settings for external users who are not using Azure AD.
Use [cross-tenant access settings](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/cross-tenant-access-settings-b2b-direct-connect) for external users in another Azure AD environment.
{% endhint %}
## PowerShell Scripts
Assign User as Guest Inviter: [Enable B2B external collaboration settings - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure#assign-the-guest-inviter-role-to-a-user)
Allow or Block Domains: [Allow or block invites to specific organizations - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/allow-deny-list#set-the-allow-or-blocklist-policy-using-powershell)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# The number of users with highly privileged roles shall be limited
## Description
Global Administrator is the highest privileged role in Azure AD because it provides unfettered access to the tenant. Therefore, if a user’s credential with these permissions were to be compromised, it would present grave risks to the security of the tenant. Limit the number of users that are assigned the role of Global Administrator. Assign users to finer-grained administrative roles that they need to perform their duties instead of being assigned the Global Administrator role.
## Policy
* A minimum of two users and a maximum of four users SHALL be provisioned with the Global Administrator role.
## Licensing Considerations
All License models support configuration of roles.
## Set Up Instructions
1. In the Azure Portal, navigate to **Azure Active Directory.**
2. Select **Roles and administrators.**
3. Select the **Global administrator role.**
4. Under Manage, select **Assignments.**
5. Validate that between two to four users are listed.
1. For those who have Azure AD PIM, they will need to check both the Eligible assignments and Active assignments tabs. There should be a total of two to four users across both of these tabs (not individually).
2. If any groups are listed, need to check how many users are members of each group and include that in the total count.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Impact is limited to users who have the Global Administrator role. If they do have these roles and you need to reduce the number of admins, you can see what levels of access they require today and give them roles with less permissions.
{% hint style="info" %}
Tips
Leverage PIM (need Azure AD P2 licensing) to provide eligible assignments for privileged roles vs permanent assignments.
{% endhint %}
## PowerShell Scripts
PowerShell for PIM: [PowerShell for Azure AD roles in PIM - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles)
365 Admin Report: [Export Office 365 Admin Role Report using PowerShell (o365reports.com)](https://o365reports.com/2021/03/02/Export-Office-365-admin-role-report-powershell/)
## Videos
{% embed url="" %}
# Users assigned highly privileged roles shall not have permanent permissions
## Description
Do not assign users to highly privileged roles using permanent active role assignments. Instead, assign users to eligible role assignments in a PAM/PIM system and provide an expiration period for active assignments requiring privileged users to reactivate their highly privileged roles upon expiration..
## Policy
* Permanent active role assignments shall not be allowed for highly privileged roles. Active assignments shall have an expiration period.
* The only exception to the policy is the break-glass Global Administrator account.
## Licensing Considerations
Azure AD P2 if using Azure AD PIM. This can be purchased standalone or is part of the following bundles:
* EMS+E5
* Microsoft 365 E5
## Set Up Instructions
Deploy PIM: [Plan a Privileged Identity Management deployment - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Impact is limited to users who are eligible to privileged roles which should be a small amount in the organization. These users will have to enter the Azure AD Admin center to activate their roles when needed.
{% hint style="info" %}
Tips
The emergency break-glass account should be included in the permanent assignments for the Global Administrator role.
{% endhint %}
## PowerShell Scripts
PowerShell for PIM: [PowerShell for Azure AD roles in PIM - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles)
## Videos
{% embed url="" %}
# Activation of privileged roles should be monitored and require approval
## Description
Since many cyberattacks leverage privileged access, it is imperative to closely monitor the assignment and activation of the highest privileged roles for signs of compromise. Create alerts to trigger when a highly privileged role is assigned to a user and when a user activates a highly privileged role
Require approval for a user to activate a highly privileged role, such as Global Administrator. This makes it more challenging for an attacker to leverage the stolen credentials of highly privileged users and ensures that privileged access is monitored closely.
## Policy
* Eligible and Permanent privileged role assignments shall trigger an alert
* User activation of the Global Administrator role shall trigger an alert
* Activation of the Global Administrator role should require approval
## Licensing Considerations
Azure AD P2 if using Azure AD PIM. This can be purchased standalone or is part of the following bundles:
* EMS+E5
* Microsoft 365 E5
A 3rd party PAM tool could be used as a substitute.
## Set Up Instructions
{% tabs %}
{% tab title="Monitoring" %}
1. In the Azure Portal, navigate to **Azure AD Privileged Identity Management (PIM).**
2. Under Manage, select Azure AD roles.
3. Under Manage, select Roles. This should bring up a list of all the Azure AD roles managed by the PIM service.
4. Click the Global Administrator role.
5. Click Settings and then click Edit.
6. Click the Notification tab.
7. Under Send notifications when members are assigned as eligible to this role, in the Role assignment alert -> Additional recipients textbox, enter the email address of the mailbox configured to receive the alerts for this role.
8. Under Send notifications when members are assigned as active to this role, in the Role assignment alert -> Additional recipients textbox, enter the email address of the mailbox configured to receive the alerts for this role.
9. Under Send notifications when eligible members activate this role, in the Role activation alert -> Additional recipients textbox, enter the email address of the mailbox configured to receive the alerts for this role.
10. Click Update.
11. Repeat steps 4 through 10 for each of the other highly privileged roles referenced in the policy section above, with one modification:
1. When configuring the Send notifications when eligible members activate this role for these other roles, enter an email address of a mailbox that is different from the one used to monitor Global Administrator activations.
{% endtab %}
{% tab title="Approval" %}
1. In the Azure Portal, navigate to Azure AD and create a new group named “Privileged Escalation Approvers.” This group will contain users that will receive role activation approval requests and approve or deny them. Users in this group must, at least, have the permissions provided to the Privileged Role Administrators role to adjudicate requests.
2. In the Azure Portal, navigate to Azure AD Privileged Identity Management (PIM).
3. Under Manage, select Azure AD roles.
4. Under Manage, select Roles. This should bring up a list of all the Azure AD roles managed by the PIM service.
5. Repeat this step for the Privileged Role Administrator role, User Administrator role, and other roles that the agency has designated as highly privileged.
1. Click the Global Administrator role in the list.
2. Click Settings.
3. Click Edit.
4. Select the Require approval to activate option.
5. Click Select approvers, select the group Privileged Escalation Approvers, and then click Select.
6. Click Update.
{% endtab %}
{% endtabs %}
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Impact is limited to users who are eligible to privileged roles which should be a small amount in the organization. These users will have to have someone approve their activation.
{% hint style="info" %}
Tips
A group of users should be assigned for approval vs a single point of contact.
More granular settings can be applied to these roles such as requiring MFA upon activation and requiring a justification reason.
{% endhint %}
## PowerShell Scripts
PowerShell for PIM: [PowerShell for Azure AD roles in PIM - Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/powershell-for-azure-ad-roles)
## Videos
{% embed url="" %}
# Highly privileged accounts shall be cloud-only
## Description
Assign users that need to perform highly privileged tasks to cloud-only Azure AD accounts to minimize the collateral damage of an on-premises identity compromise.
## Policy
* Users that need to be assigned to highly privileged Azure AD roles SHALL be provisioned cloud-only accounts that are separate from the on-premises directory or other federated identity providers.
## Licensing Considerations
• All Microsoft Licensing Models support this configuration.
## Set Up Instructions
1. Follow [these steps](https://learn.microsoft.com/en-us/azure/active-directory/roles/view-assignments) to review the administrative roles like Global Administrator
2. Ensure that these accounts are cloud only
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no real end user impact here as you are establishing cloud only administrative accounts.
{% hint style="info" %}
Tips
Periodically review the privileged roles within the organization to ensure compliance with this policy.
{% endhint %}
## PowerShell Scripts
Getting Sync Status: [Listing Azure AD/Office 365 User Accounts with Directory Sync Status (practical365.com)](https://practical365.com/listing-azure-ad-office-365-user-accounts-directory-sync-status/)
[View Microsoft 365 user accounts with PowerShell - Microsoft 365 Enterprise | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-user-accounts-with-microsoft-365-powershell?view=o365-worldwide#view-account-synchronization-status)
## Videos
• None Currently
# Highly privileged role assignments shall be periodically reviewed
## Description
Access reviews should be periodically performed for users with permanent or eligible privileged roles. Users should evaluate whether they still need these permissions and update assignments accordingly. Access reviews can be performed manually or with a tool like [Microsoft Access Reviews](https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview) which is part of an Azure AD P2 subscription.
## Policy
* Access reviews shall be performed for users with permanent or eligible privileged roles.
## Licensing Considerations
To leverage the Access Reviews in Microsoft, an Azure AD P2 license is required. This can be purchased standalone or as part of the following bundles:
* EMS + E5
* Microsoft 365 E5
## Set Up Instructions
1. Follow [these steps](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review?toc=%2Fazure%2Factive-directory%2Fgovernance%2Ftoc.json) to create Access Reviews leveraging the native tooling in Microsoft.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Impact is limited to the users with privileged roles. When an access review is conducted, the user will be notified via email to review their existing roles. They will be able to provide feedback on if they need to continue to have that role with a justification reason.
{% hint style="info" %}
Tips
Try to perform access reviews on a semi-annual basis at the minimum.
{% endhint %}
## PowerShell Scripts
365 Admin Report: [Export Office 365 Admin Role Report using PowerShell (o365reports.com)](https://o365reports.com/2021/03/02/Export-Office-365-admin-role-report-powershell/)
Access Reviews PowerShell samples: [microsoft/access-reviews-samples: This repo contains sample code that demonstrates programmatic access to Azure AD Access Reviews. Sample code includes reading and managing Access Reviews, as well as working on decisions and results of Access Reviews. (github.com)](https://github.com/microsoft/access-reviews-samples)
## Videos
{% embed url="" %}
# Passwords shall not expire
## Description
Ensure that user passwords do not expire. Both the National Institute of Standards and Technology (NIST) and Microsoft emphasize MFA because they indicate that mandated password changes make user accounts less secure.
## Policy
* User passwords shall not expire
## Licensing Considerations
Configuring this setting is available in any Microsoft 365 offering.
## Set Up Instructions
1. Follow [these steps](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-worldwide#set-password-expiration-policy) to set passwords to never expire
2. Microsoft Password Guidance [Microsoft\_Password\_Guidance-1.pdf](https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Impact is medium as users do not have to reset their passwords on a periodic basis but will have to set up passwordless methods of authentication such as Microsoft Authentication.
{% hint style="info" %}
Tips
Ensure that weak passwords are not being used [Password protection in Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad)
If possible, think about going passwordless: [Passwordless authentication | Microsoft Security](https://www.microsoft.com/en-us/security/business/solutions/passwordless-authentication?rtc=1)
{% endhint %}
## PowerShell Scripts
[Automating with PowerShell: Deploying passwordless Authentication (cyberdrain.com)](https://www.cyberdrain.com/automating-with-powershell-deploying-passwordless-authentication/)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Azure AD Logs shall be collected
## Description
Azure AD logs should be a collected and periodically reviewed to detect any anomalies. Log information should be centralized in a SIEM tool, like Microsoft Sentinel, so that it can be audited and queried. Audit logs should be retained in a storage account for a minimum of 90 days.
Log events that can be collected are as follows: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, and ServicePrincipalRiskEvents.
## Policy
* Azure AD Log data is sent to a SIEM and/or external storage
* Log data is periodically reviewed.
* Log data is sent to an internal or external SOC for monitoring
## Licensing Considerations
To retain Azure AD log data more than 7 days, an Azure AD P1 License is required. This license retains data for 30 days and is available to purchase standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
Analyzing Sign-Ins [Analyze sign-ins with the Azure AD sign-ins log - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-analyze-sign-in)
Route logs to a storage account: [Tutorial - Archive directory logs to a storage account - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-azure-monitor-route-logs-to-storage-account)
Everything you want to know about Security and Audit logging in Office 365 [Everything you wanted to know about Security and Audit Logging in Office 365 | The Cloud Technologist](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/)
Sign In logs in Azure AD: [Sign-in logs (preview) in Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins)
Connect AD data to Microsoft Sentinel: [Connect Azure Active Directory data to Microsoft Sentinel | Microsoft Learn](https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory)
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no end user impact to review and collect Azure AD logs.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Documenting with PowerShell: Downloading and storing the Office 365 Audit logs (With search!) (cyberdrain.com)](https://www.cyberdrain.com/documenting-with-powershell-downloading-and-storing-the-office-365-audit-logs-with-search/)
[Automating with PowerShell: Storing Office 365 audit logs longer than 90 days (cyberdrain.com)](https://www.cyberdrain.com/automating-with-powershell-storing-office-365-audit-logs-longer-than-90-days/)
[Monitoring with PowerShell: Monitoring failed logins for Office365 (cyberdrain.com)](https://www.cyberdrain.com/monitoring-with-powershell-monitoring-failed-logins-for-office365/)
[Azure AD PowerShell cmdlets for reporting - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-powershell-reporting)
## Videos
{% embed url="" %}
# Only Admins shall be allowed to register 3rd party applications
## Description
Ensure that only administrators can register third-party applications that can access the tenant.
## Policy
* Only administrators SHALL be allowed to register third-party applications.
## Licensing Considerations
This setting can be configured with any Microsoft licensing.
## Set Up Instructions
1. In the Azure Portal, navigate to Azure Active Directory.
2. Under **Manage,** select **Users.**
3. Select **User settings.**
4. Under App Registrations -> Users can register applications, select **No.**
5. Click **Save.**
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
The number of times a user should be trying to register a 3rd part application should be low but when they do, they will be blocked. This setting is not generally something that requires any communication before turning on.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Automating with PowerShell: Setting up application consent (cyberdrain.com)](https://www.cyberdrain.com/automating-with-powershell-setting-up-application-consent/)
[Monitoring with PowerShell: Monitoring oAuth application changes (cyberdrain.com)](https://www.cyberdrain.com/monitoring-with-powershell-monitoring-oauth-application-changes/)
## Videos
{% embed url="" %}
# Non-admin users shall be prevented from providing consent to 3rd party applications
## Description
Ensure that only administrators can consent to third-party applications and only administrators can control which permissions are granted. An admin consent workflow can be configured in Azure AD; otherwise, users will be blocked when they try to access an application that requires permissions to access organizational data. Develop a process for approving and managing third-party applications.
## Policy
* Only administrators SHALL be allowed to consent to third-party applications.
* An admin consent workflow SHALL be configured.
* Group owners SHALL NOT be allowed to consent to third-party applications.
## Licensing Considerations
This setting can be configured with any Microsoft licensing.
## Set Up Instructions
1. In the Azure Portal, navigate to **Azure Active Directory**.
2. Create a **new Azure AD Group** that contains admin users responsible for reviewing and adjudicating app requests.
3. Under **Manage,** select **Enterprise Applications.**
4. Under Security, select **Consent and permissions**
5. Under User consent for applications, select **Do not allow user consent.**
6. Under Group owner consent for apps accessing data, select **Do not allow group owner**
**consent.**
7. In the menu, navigate back to **Enterprise Applications.**
8. Under Manage, select **User Settings.**
9. Under Admin consent requests -> Users can request admin consent to apps they are unable to consent to, **select Yes.**
10. Under Who can review admin consent requests, **select the group created in step two** that is responsible for reviewing and adjudicating app requests.
11. Click **Save.**
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
The number of times a user should be trying to consent a 3rd part application should be low but when they do, they will be blocked. If you have configured the admin consent flow, they will be notified accordingly. This setting is not generally something that requires any communication before turning on.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Automating with PowerShell: Setting up application consent (cyberdrain.com)](https://www.cyberdrain.com/automating-with-powershell-setting-up-application-consent/)
[Monitoring with PowerShell: Monitoring oAuth application changes (cyberdrain.com)](https://www.cyberdrain.com/monitoring-with-powershell-monitoring-oauth-application-changes/)
## Videos
{% embed url="" %}
# Authorized Applications shall be configured for Single Sign-On
## Description
If available, all authorized applications should be configured for single sign-on to extend authentication security to 3rd party applications.
## Policy
* Authorized applications shall be configured for single sign-on if available.
## Licensing Considerations
To configure Enterprise applications for SSO, an Azure AD P1 license is required. This can be purchased standalone or is available as part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
The configuration settings will be application specific but all applications will be configured in the Enterprise application section of Azure AD: [Enable single sign-on for an enterprise application - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-setup-sso)
Example SSO with Dropbox: [Tutorial: Azure Active Directory integration with Dropbox Business - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/dropboxforbusiness-tutorial)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
After applications are set up for single sign-on, users will be able to leverage their Azure Active Directory credentials to access the application. It is important to alert users before turning on SSO for an application so they are not caught off-guard from a redirection to Microsoft when trying to sign-in. Be careful with some applications as you can get locked out if settings are not configured properly.
{% hint style="info" %}
Tips
Establish a communication plan prior to setting up SSO for an application.
Leverage Azure AD groups to grant and revoke access to applications.
Leverage SCIM provisioning if it is available from the application provider.
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Inactive accounts shall be blocked or deleted
## Description
Deleting or blocking accounts that haven't been used for over 30 days helps prevent unauthorized use of inactive accounts. These accounts can be targets for attackers who are looking to find ways to access your data or move laterally throughout an organization without being noticed.
## Policy
* Inactive accounts shall be blocked or deleted.
* Users who leave the organization shall have their account switched to a blocked state immediately.
## Licensing Considerations
To gather the user’s last sign in from the Audit logs, you will need an Azure AD P1 subscription which can be purchased standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* EMS+ E3 or EMS + E5
* Microsoft 365 E3
* Microsoft 365 E5
You will want to search for users who haven't signed-in within 30+ days.
Any Microsoft Licensing supports blocking sign-in.
## Set Up Instructions
Manage inactive user accounts in Azure AD: [How to manage inactive user accounts in Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-manage-inactive-user-accounts)
**Blocking Sign-In**
1. Go to None
{% endhint %}
If accounts are truly dormant, there should be no impact to end-users. Proper validation is required before blocking or deleting accounts.
{% hint style="info" %}
Tips
Block user accounts after someone leaves the organization. Develop a retention policy that defines how long you will keep the account before removing completely.
{% endhint %}
## PowerShell Scripts
Leveraging Graph API: [How to manage inactive user accounts in Azure AD - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-manage-inactive-user-accounts).
[Find Azure AD Inactive Users using Powershell and Graph - Azure365Pro.com](https://www.azure365pro.com/find-azure-ad-inactive-users-using-powershell-and-graph/)
## Videos
None Currently
# Teams
**Section Purpose:** The security section shows recommend security controls for Teams based on the CIS Controls. Each control contains the following subsections:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
| Policy | End-User Impact | License |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | ---------------------------- |
| [Private Channels shall be utilized to restrict access to sensitive information](/security/teams/private-channels-shall-be-utilized-to-restrict-access-to-sensitive-information) | Medium | Standard |
| [External Participants SHOULD NOT Be Enabled to Request Control of Shared Desktops or Windows in Meet](/security/teams/external-participants-should-not-be-enabled-to-request-control-of-shared-desktops-or-windows-in-meet) | Low | Standard |
| [Anonymous Users SHALL NOT Be Enabled to Start Meetings](/security/teams/anonymous-users-shall-not-be-enabled-to-start-meetings) | Low | Standard |
| [External User Access SHALL Be Restricted](/security/teams/external-user-access-shall-be-restricted) | Medium | Standard |
| [Unmanaged User Access SHALL Be Restricted](/security/teams/unmanaged-user-access-shall-be-restricted) | Low | Standard |
| [Contact with Skype Users SHALL Be Blocked](/security/teams/contact-with-skype-users-shall-be-blocked) | Low | Standard |
| [Teams Email Integration SHALL Be Disabled](/security/teams/teams-email-integration-shall-be-disabled) | Low | Enterprise |
| [Only Approved Apps SHOULD Be Installed](/security/teams/only-approved-apps-should-be-installed) | Medium | Standard |
| [Data Loss Prevention Solutions SHALL Be Enabled](/security/teams/data-loss-prevention-solutions-shall-be-enabled) | Medium | Business Premium, Enterprise |
| [Only the Meeting Organizer SHOULD Be Able to Record Live Events](/security/teams/only-the-meeting-organizer-should-be-able-to-record-live-events) | Low | Enterprise |
| [Attachments SHOULD Be Scanned for Malware](/security/teams/attachments-should-be-scanned-for-malware) | Low | Defender for Office 365 |
| [Link Protection SHOULD Be Enabled](/security/teams/link-protection-should-be-enabled) | Low | Defender for Office 365 |
| [Restrict Users who can Create Teams Channels](/security/teams/restrict-users-who-can-create-teams-channels) | Medium | Azure AD P1 |
| [Teams Channels shall have an expiration policy](/security/teams/teams-channels-shall-have-an-expiration-policy) | Medium | Standard |
# Private Channels shall be utilized to restrict access to sensitive information
## Description
Access controls are a fundamental part of any compliance regulation. Giving access to certain Teams channels where users are collaborating on sensitive topics or sharing critical documents should follow a model of least privilege. Microsoft Teams allows you to create private channels where users can request access to the owners and all other users are prohibited from seeing the content
## Policy
* When creating new Teams channels, a proper evaluation should be done to determine if a private channel should be selected.
## Licensing Considerations
Creating Private channels does not require any premium licensing. Any base plan with Teams included will have access to create a Teams Private Channel.
## Set Up Instructions
Follow [these steps](https://support.microsoft.com/en-us/office/create-a-standard-or-private-channel-in-teams-fda0b75e-5b90-4fb8-8857-7e102b014525#:~:text=To%20create%20a%20private%20channel%20for%20a%20team%3A,to%20add%20the%20private%20channel%20to%20the%20team.) to create a private channel in Teams
Overview of Private Channels: [Private channels in Microsoft Teams - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/private-channels)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Content within a private channel is restricted to the owners and members of that channel. Users will not be able to share any documents part of the channel with any members of the org not part of the channel.
{% hint style="info" %}
Tips:
Best practices for organizing teams in Microsoft Teams: [Best practices for organizing teams - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/best-practices-organizing)
{% endhint %}
## PowerShell Scripts
* [Create Private channel in Microsoft Teams using PowerShell (morgantechspace.com)](https://morgantechspace.com/2022/06/create-private-channel-in-microsoft-teams-using-powershell.html#:~:text=Create%20a%20new%20Private%20channel%20in%20an%20existing,is%20already%20available%20in%20the%20existing%20team%E2%80%99s%20membership.)
* [New-TeamChannel (MicrosoftTeamsPowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/teams/new-teamchannel?view=teams-ps)
## Videos
{% embed url="" %}
{% embed url="" %}
# External Participants SHOULD NOT Be Enabled to Request Control of Shared Desktops or Windows in Meet
## Description
This setting controls whether external meeting participants can request control of the shared desktop or window during the meeting. In this instance, the term “external participants” includes external users, B2B guest users, unmanaged users, and anonymous users.
While there is some inherent risk in granting an external participant control of a shared screen, legitimate use cases for this exist. Furthermore, the risk is minimal as users cannot gain control of another user’s screen unless the user giving control explicitly accepts a control request. As such, while enabling external participants to request control is discouraged, it may be done, depending on organizational need.
## Policy
* External participants SHOULD NOT be enabled to request control of shared desktops or windows in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Follow [these steps](https://learn.microsoft.com/en-us/microsoftteams/configure-desktop-sharing) to configure desktop sharing settings in the Teams admin center.
To ensure external participants do not have the ability to request control of the shared desktop or window in the meeting
1. Sign in to the **Microsoft Teams admin center.**
2. Select **Meetings** -> **Meeting policies.**
3. Select the **Global (Org-wide default) policy.**
4. Under the Content sharing section, set **Allow an external participant to give or request control** to **Off.**
5. If custom policies have been created, repeat these steps for each policy, selecting the appropriate policy in step 3
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
The number of occurrences where an external participant should need to control the screen is limited. If this is something that is required for a long-term engagement, you could set up a policy to temporarily enable it for certain users within the organization.
{% hint style="info" %}
Tips
* None Currently
{% endhint %}
## PowerShell Scripts
Configure Meeting Policy [Set-CsTeamsMeetingPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps)
## Videos
{% embed url="" %}
# Anonymous Users SHALL NOT Be Enabled to Start Meetings
## Description
This setting controls which meeting participants can start a meeting. In this instance, the term “anonymous users” refers to any Teams users joining calls that are not authenticated through the company’s tenant.
## Policy
* Anonymous users SHALL NOT be enabled to start meetings in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Microsoft Resources: [Control who can bypass the meeting lobby in Microsoft Teams - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/who-can-bypass-meeting-lobby)
To configure settings for anonymous users:
1. Sign in to the **Microsoft Teams admin center**.
2. Select Meetings -> **Meeting policies.**
3. Select the **Global (Org-wide default) policy**.
4. Under the **Participants & guests** section, set L**et anonymous people start a meeting** to **Off.**
5. If custom policies have been created, repeat these steps for each policy, selecting the appropriate policy in step 3
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This is only affecting external users who enter a meeting as anonymous.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
Configure Meeting Policy [Set-CsTeamsMeetingPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps)
## Videos
None Currently
# Automatic Admittance to Meetings SHOULD Be Restricted
## Description
This setting controls which meeting participants wait in the lobby before they are admitted to the meeting
## Policy
* Anonymous users, including dial-in users, SHOULD NOT be admitted automatically.
* Internal users SHOULD be admitted automatically.
* B2B guest users MAY be admitted automatically.
* The above settings SHOULD be set in the Global (Org-wide default) meeting policy.
* Custom meeting policies MAY be created that allow more flexibility for specific users.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Microsoft Resources: [Manage meeting policies for participants and guests - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/meeting-policies-participants-and-guests)
To configure settings for automatic meeting admittance:
1. Sign in to the **Microsoft Teams admin center.**
2. Select **Meetings** -> **Meeting policies**.
3. Select the **Global (Org-wide default) policy.**
4. Under the **Participants & guests section**, ensure **Automatically admit people** is **not set to Everyone.**
5. In the same section, set **Dial-in users can bypass the lobby** to **Off.**
6. If custom policies have been created, repeat these steps for each policy, selecting the appropriate policy in step 3
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Internal Users will need to manually admit anonymous and/or external users to meetings when they enter the lobby.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
Configure Meeting Policy [Set-CsTeamsMeetingPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsmeetingpolicy?view=skype-ps)
## Videos
None Currently
# External User Access SHALL Be Restricted
## Description
External access allows external users to look up internal users by their email address to initiate chats and calls entirely within Teams. Blocking external access prevents external users from using Teams as an avenue for reconnaissance or phishing. Even with external access disabled, external users will still be able to join Teams calls, assuming anonymous join is enabled. Depending on organizational need, if both external access and anonymous join need to be blocked— neither required nor recommended by this baseline—external collaborators would only be able to attend meetings if added as a B2B guest user. External access may be granted on a per-domain basis. This may be desirable in some cases, e.g., for agency-to-agency collaboration.
## Policy
* External access SHALL only be enabled on a per-domain basis.
* Anonymous users SHOULD be enabled to join meetings.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
{% tabs %}
{% tab title="Microsoft Resources" %}
[Manage external meetings and chat - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access)
[Manage meeting settings - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/meeting-settings-in-teams#allow-anonymous-users-to-join-meetings)
[Use guest access and external access to collaborate with people outside your organization - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/communicate-with-users-from-other-organizations)
{% endtab %}
{% tab title="Enable External Access for Specific Domains" %}
1. Sign in to the Microsoft Teams admin center.
2. Select Users -> External access.
3. Under Choose which external domains your users have access to, select Allow only specific external domains.
4. Click Allow domains to add allowed external domains. All domains not added in this step will be blocked.
5. Click Save
{% endtab %}
{% tab title="Enable Anonymous users to Join Meetings" %}
1. Sign in to the Microsoft Teams admin center.
2. Select Meetings -> Meeting settings.
3. Under Participants, set Anonymous users can join a meeting to On.
4. Click Save
{% endtab %}
{% tab title="Per Policy" %}
Anonymous users can also be enabled/blocked on a per-policy basis.
1. Sign in to the Microsoft Teams admin center.
2. Select Meetings -> Meeting policies.
3. Select the Global (Org-wide default), or other policy as needed.
4. Under Participants & guests, set Let anonymous people join a meeting to On.
5. Click Save.
{% endtab %}
{% endtabs %}
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This will vary depending on the organization and need for external collaboration. A formal process for adding external domains for collaboration should be established so that end users have a place to request new external participants.
{% hint style="info" %}
Tips
Make sure its clear how end-users request external collaboration participants
{% endhint %}
## PowerShell Scripts
Set External Access Policy: [Set-CsExternalAccessPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csexternalaccesspolicy?view=skype-ps)
[Manage external meetings and chat - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access#limit-external-access-to-specific-people)
## Videos
None Currently
# Unmanaged User Access SHALL Be Restricted
## Description
Blocking contact with unmanaged Teams users prevents these users from looking up internal users by their email address and initiating chats and calls within Teams. These users would still be able to join calls, assuming anonymous join is enabled. Additionally, unmanaged users may be added to Teams chats if the internal user initiates the contact. Unmanaged accounts are ones not managed by an organization, typically Teams personal accounts.
## Policy
* Unmanaged users SHALL NOT be enabled to initiate contact with internal users.
* Internal users SHOULD NOT be enabled to initiate contact with unmanaged users.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Microsoft Resources:
[Manage external meetings and chat - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access#manage-contact-with-external-teams-users-not-managed-by-an-organization)
To block unmanaged users for initiating contact:
1. Sign in to the Microsoft Teams admin center.
2. Select Users -> External access.
3. To completely block contact with unmanaged users, under Teams accounts not managed by an organization, set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to Off.
4. To allow contact with unmanaged users only if the internal user initiates the contact:
1. Under Teams accounts not managed by an organization, set People in my organization can communicate with Teams users whose accounts aren't managed by an organization to On.
2. Clear the check next to External users with Teams accounts not managed by an organization can contact users in my organization.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This will vary depending on the organization and need for external collaboration with users not managed by an organization. A formal process for adding external domains for collaboration should be established so that end users have a place to request new external participants.
{% hint style="info" %}
Tips
Make sure its clear how end-users request external collaboration participants
{% endhint %}
## PowerShell Scripts
Set External Access Policy: [Set-CsExternalAccessPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csexternalaccesspolicy?view=skype-ps)
## Videos
None Currently
# Contact with Skype Users SHALL Be Blocked
## Description
Microsoft officially retired Skype for Business Online on July 31, 2021, and it is no longer supported.
## Policy
* Contact with Skype users SHALL be blocked.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Microsoft Resources:
[Manage external meetings and chat - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/manage-external-access#communicate-with-skype-users)
Instructions for enabling communications with Skype users are outlined in Communicate with Skype users.
1. Sign in to the Microsoft Teams admin center.
2. Select Users -> External access.
3. Under Skype users, set Allow users in my organization to communicate with Skype users to Off.
4. Click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
The frequency of which someone is asking to communicate via skype should be low.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
• Set External Access Policy: [Set-CsExternalAccessPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csexternalaccesspolicy?view=skype-ps)
## Videos
None Currently
# Teams Email Integration SHALL Be Disabled
## Description
Teams provides an optional feature that allows channels to have an email address and receive email. These channel email addresses are not under the tenant’s domain; rather, they are associated with a Microsoft-owned domain, teams.ms. As such, although some basic checks are performed, companies do not have control over the security settings associated with this email. For this reason, email channel integration should be disabled.
## Policy
* Teams email integration SHALL be disabled.
## Licensing Considerations
Teams email integration is only available with E3/E5 licenses. It is not available in GCC or DoD tenants.
## Set Up Instructions
Resources:
[How to Control Sending Email to Teams Channels | Practical365](https://practical365.com/how-to-control-sending-email-to-teams-channels/)
To ensure that teams email integration is disabled:
1. Sign in to the Microsoft Teams admin center.
2. Select Teams -> Teams Settings.
3. Under the Email integration section, set Allow users to send emails to a channel email address to Off.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Adoption of the Teams email integration should be low or nonexistent. Make sure to review and active Teams emails in use and notify users accordingly before disabling this feature.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Only Approved Apps SHOULD Be Installed
## Description
Teams can integrate with the following classes of apps:
* Microsoft apps: apps published by Microsoft.
* Third-party apps: apps not authored by Microsoft, published to the Teams store.
* Custom apps: apps not published to the Teams store, such as apps under development, that users “sideload” into Teams
Only authorized and approved applications should be available to end-users to manage exfiltration of corporate data. Additionally, unmanaged applications may have certain vulnerabilities that exploit users, devices, or data.
## Policy
* Organizations SHOULD allow all apps published by Microsoft, but MAY block specific Microsoft apps as needed.
* Organizations SHOULD NOT allow installation of all third-party apps or custom apps, but MAY allow specific apps as needed.
* Organizations shall establish policy dictating the app review and approval process to be used by the company.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Resources:
[Manage app permission policies in Microsoft Teams - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/teams-app-permission-policies)
To restrict which Team apps can be installed:
1. Sign in to the Microsoft Teams admin center.
2. Select Teams apps -> Permission policies.
3. Select Global (Org-wide default).
4. Under Microsoft apps, select Allow all apps, unless specific apps need to be disallowed, in which case select Block specific apps and allow all others.
5. Set Third-party apps to Block all apps, unless specific apps have been approved by the agency, in which case select Allow specific apps and block all others.
6. Set Custom apps to Block all apps, unless specific apps have been approved by the agency, in which case select Allow specific apps and block all others.
7. Click Save.
8. If custom policies have been created, repeat these steps for each policy, selecting the appropriate policy in step 3.
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
This will vary depending on the organization but users will not be able to add applications from the Apps section of team unless preapproved in the Teams admin center. A formal process for requesting new Teams apps should be properly documented and communicated.
{% hint style="info" %}
Tips
• Make sure users understand how to request a new applications for Microsoft Teams.
{% endhint %}
## PowerShell Scripts
[How to manage Microsoft Teams app permission policy – PARAS DODHIA BLOG](https://blog.dodhia.co/how-to-manage-microsoft-teams-app-permission-policy/#:~:text=How%20to%20Add%20Custom%20App%20Permission%20Policy%20To,in%20the%20left-hand%20navigation.%20Select%20Permission%20policies%20menu)
[New-CsTeamsAppPermissionPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/new-csteamsapppermissionpolicy?view=skype-ps)
[Set-CsTeamsAppPermissionPolicy (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsapppermissionpolicy?view=skype-ps)
## Videos
None Currently
# File Sharing and File Storage Options shall be blocked
## Description
By default, users can add external third-party storage providers like Google and Drobox to their Teams channels for file storage. Only managed, trusted providers should be allowed for data loss prevention purposes.
## Policy
* File Sharing and File Storage Options are disabled.
## Licensing Considerations
Any Teams licensing supports this configuration.
## Set Up Instructions
Resources:
[Controlling Third Party Cloud Storage Access for Microsoft Teams | Practical365](https://practical365.com/third-party-cloud-storage/)
To restrict file sharing and file storage options:
1. Go to the Microsoft Teams Admin Center
2. Choose Teams -> Teams Settings.
3. Under Files turn off all 3rd part file storage applications
4. Click Save
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This will very depending on the organization but in most cases, end-users should be leveraging native file storage options such as SharePoint or OneDrive. Ensure that end-users are not uploading files to 3rd parties before configuring this setting.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Get-CsTeamsClientConfiguration (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/get-csteamsclientconfiguration?view=skype-ps)
[Set-CsTeamsClientConfiguration (SkypeForBusiness) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/skype/set-csteamsclientconfiguration?view=skype-ps)
## Videos
{% embed url="" %}
{% embed url="" %}
# Only the Meeting Organizer SHOULD Be Able to Record Live Events
## Description
Live events are recorded by default. Organizations should increase their privacy by changing the policy so that events are only recorded at the organizer’s discretion.
## Policy
* Record an event SHOULD be set to Organizer can record.
## Licensing Considerations
Enterprise licensing is required to host live events.
## Set Up Instructions
Resources:
[Live events recording policies - Microsoft Teams | Microsoft Learn](https://learn.microsoft.com/en-us/microsoftteams/teams-live-events/live-events-recording-policies)
1. Sign in to the Microsoft Teams admin center.
2. Select Meetings -> Live events policies.
3. Select Global (Org-wide default).
4. Set Record an event to Organizer can record.
5. Click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Ensure users are aware that only the meeting organizer can record the live event.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None currently
## Videos
None Currently
# Attachments SHOULD Be Scanned for Malware
## Description
Safe attachment protection policies from Defender for Office 365 should be enabled and configured for Teams. Attachments should be scanned in a sandbox for malware upon opening or downloading.
## Policy
* Attachments included with Teams messages SHOULD be scanned for malware. Users SHOULD be prevented from opening or downloading files detected as malware.
## Licensing Considerations
Safe Attachments can be configured with the Following plans
* Defender for Office 365 Plan 1/2
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
Resources:
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide#use-exchange-online-powershell-to-turn-on-safe-attachments-for-sharepoint-onedrive-and-microsoft-teams)
To enable Safe Attachments for Teams follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide#step-1-use-the-microsoft-365-defender-portal-to-turn-on-safe-attachments-for-sharepoint-onedrive-and-microsoft-teams)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
When safe attachments are enabled in Teams users will experience more latency for files to open as they are scanned. Users will get a prompt in Teams that lets them know the file is being scanned for malicious content.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure?view=o365-worldwide#use-exchange-online-powershell-to-turn-on-safe-attachments-for-sharepoint-onedrive-and-microsoft-teams)
## Videos
{% embed url="" %}
{% embed url="" %}
# Link Protection SHOULD Be Enabled
## Description
Microsoft Defender protects users from malicious links included in Teams messages by prependinghttps\://\*.safelinks.protection.outlook.com/?url= to URLs included in the messages.
By prepending the safe links URL, Microsoft can proxy the initial URL through their scanning service. Their proxy performs the following checks:
* Compares the URL with a block list
* Compares the URL with a list of know malicious sites
* If the URL points to a downloadable file, applies real-time file scanning
## Policy
* URL comparison with a block-list SHOULD be enabled.
* Direct download links SHOULD be scanned for malware.
* User click tracking SHOULD be enabled.
## Licensing Considerations
Safe Links can be configured with the Following plans
* Defender for Office 365 Plan 1/2
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
Resources:
[Set up Safe Links policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide#step-1-use-powershell-to-create-a-safe-links-policy)
To enable Safe Links for Teams follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-create-safe-links-policies)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
When safe links is enabled in Teams users will experience more latency for webpages to open while the URL is being scanned. If a link is detected as malicious the user will see a warning message. Depending on how the policy is configured, the user will/will not be able to proceed to the webpage.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set up Safe Links policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide#step-1-use-powershell-to-create-a-safe-links-policy)
## Videos
{% embed url="" %}
# Restrict Users who can Create Teams Channels
## Description
Users within a tenant have the ability to create a public or private Teams channel by default. Behind the scenes, creating a Teams channel also creates a Microsoft 365 or Office 365 Group and a SharePoint site with a document library that stores all documents shared within the Teams channel. Over time, if this is not managed, the environment could quickly get out of hand with the number of Teams channels being created. This could lead to data loss, insecure sharing of documentation, and overall confusion across the organization. We recommend limiting the creation of Teams channels to certain members within the organization and creating a formal request process for new channels. To configure this setting, you will be restricting access for who can create a group as that is the backend to a Teams channel.
## Policy
* Creating Teams Channels should be restricted to a limited group of users
## Licensing Considerations
To manage who creates groups, an Azure AD Premium license is required
[Manage who can create Microsoft 365 Groups | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide#licensing-requirements)
This license can be purchased standalone or as part of the following bundles:
* EMS + E3/E5
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
Resources:
To restrict who can create Teams channels (groups) follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide#step-1-create-a-group-for-users-who-need-to-create-microsoft-365-groups)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
It is very important that you properly plan and communicate any changes here before rolling them out. The goal is not to inhibit productivity and force users to go to outside channels to collaborate, causing shadow IT. It is imperative that you make the request for creating a new Teams channel as seamless as possible. Restricting the creation of Teams channels also restricts who can create Groups. The setting is all or nothing in this regard.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Manage who can create Microsoft 365 Groups | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/manage-creation-of-groups?view=o365-worldwide#step-2-run-powershell-commands)
## Videos
{% embed url="" %}
# Teams Channels shall have an expiration policy
## Description
Organizations with a large number of Teams often have Teams channels that are never actually used. This can happen because of several reasons including product experimentation, short-term team collaboration, or team owners leaving the organization. Over time, such teams can accumulate and create a burden on tenant resources. To curb the number of unused teams, as an admin, you can use group expiration policy to automatically clean up unused teams. Because teams are backed by groups, group expiration policies automatically apply to teams as well.
## Policy
* Teams channels shall have an expiration policy for inactivity
## Licensing Considerations
There are no licensing considerations for modifying the group expiration policy.
## Set Up Instructions
Resources:
[Microsoft 365 group expiration policy | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-groups-expiration-policy?view=o365-worldwide#how-to-set-the-expiration-policy)
To define group expiration policies, follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-groups-expiration-policy?view=o365-worldwide#how-to-set-the-expiration-policy)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
When you apply an expiration policy to a team, a team owner receives a notification for team renewal 30 days, 15 days and 1 day before the team's expiration date. When the team owner receives the notification, they can click Renew now in team settings to renew the team. To prevent accidental deletion, auto-renewal is automatically enabled for a Team in the group expiration policy. When the group expiration policy is set up, any team that has at least one channel visit from any team member before its expiration date is automatically renewed without any manual intervention from the team owner.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[New-AzureADMSGroupLifecyclePolicy (AzureAD) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/azuread/new-azureadmsgrouplifecyclepolicy?view=azureadps-2.0)
[Set-AzureADMSGroup (AzureAD) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/azuread/set-azureadmsgroup?view=azureadps-2.0)
## Videos
{% embed url="" %}
# Data Loss Prevention Solutions SHALL Be Enabled
## Description
Data loss prevention (DLP) helps prevent both accidental leakage of sensitive information as well as intentional exfiltration of data. DLP forms an integral part of securing Microsoft Teams. There a several commercial DLP solutions available that document support for Microsoft Teams. Agencies may select any service that fits their needs and meets the requirements outlined in this baseline control.
## Policy
* A DLP solution SHALL be enabled.
* Organizations SHOULD use either the native DLP solution offered by Microsoft or a DLP solution that offers comparable services.
* The DLP solution SHALL protect Personally Identifiable Information (PII) and sensitive information, as defined by the agency. At a minimum, the sharing of credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) via email SHALL be restricted.
## Licensing Considerations
Data loss prevention policies can be configured with the following plans:
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
Resources:
[Data loss prevention and Microsoft Teams - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide)
To create a DLP policy for Teams follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide#define-a-new-dlp-policy-for-microsoft-teams)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
When DLP policies are in place any user trying to share sensitive information as defined by the policy will be blocked.
[Teams messages about data loss prevention (DLP) and communication compliance policies - Microsoft Support](https://support.microsoft.com/en-us/office/teams-messages-about-data-loss-prevention-dlp-and-communication-compliance-policies-c5631c3f-f61b-4306-a6ac-6603d9fc5ff0)
{% hint style="info" %}
Tips
To ensure organizational compliance, its recommended send end-user communications before turning the policy on. Educate users on how to properly share sensitive information.
{% endhint %}
## PowerShell Scripts
[How to Create and Manage DLP policies using PowerShell » Jorge Bernhardt](https://www.jorgebernhardt.com/create-manage-dlp-policies/#:~:text=How%20to%20Create%20and%20Manage%20DLP%20policies%20using,parameter%20of%20the%20DLP%20policy%20...%20More%20items)
[New-DlpCompliancePolicy (ExchangePowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchange/new-dlpcompliancepolicy?view=exchange-ps)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Exchange
**Section Purpose:** The security section shows recommend security controls for Teams based on the CIS Controls. Each control contains the following subsections:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
| Policy | End-User Impact | License |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | --------------------------------------------------------------- |
| [Automatic Forwarding to External Domains SHALL Be Disabled](/security/exchange/automatic-forwarding-to-external-domains-shall-be-disabled) | Low | Standard |
| [Sender Policy Framework SHALL Be Enabled](/security/exchange/sender-policy-framework-shall-be-enabled) | Low | Standard |
| [DomainKeys Identified Mail SHOULD Be Enabled](/security/exchange/domainkeys-identified-mail-should-be-enabled) | Low | Standard |
| [Domain-Based Message Authentication, Reporting, and Conformance SHALL Be Enabled](/security/exchange/domain-based-message-authentication-reporting-and-conformance-shall-be-enabled) | Low | Standard |
| | | |
| [Enable Email Encryption](/security/exchange/enable-email-encryption) | Low | Azure Information Protection Plan 1/Business Premium/Enterprise |
| [Simple Mail Transfer Protocol Authentication SHALL Be Disabled](/security/exchange/simple-mail-transfer-protocol-authentication-shall-be-disabled) | Low | Standard |
| [Calendar and Contact Sharing SHALL Be Restricted](/security/exchange/calendar-and-contact-sharing-shall-be-restricted) | Low | Standard |
| [External Sender Warnings SHALL Be Implemented](/security/exchange/external-sender-warnings-shall-be-implemented) | Low | Standard |
| [Data Loss Prevention Solutions SHALL Be Enabled](/security/exchange/data-loss-prevention-solutions-shall-be-enabled) | Medium | Business Premium/Enterprise |
| [Emails SHALL Be Filtered by Attachment File Type](/security/exchange/emails-shall-be-filtered-by-attachment-file-type) | Low | Defender for Office 365 |
| [Zero-Hour Auto Purge for Malware SHOULD Be Enabled](/security/exchange/zero-hour-auto-purge-for-malware-should-be-enabled) | Low | Standard |
| [Phishing Protections SHOULD Be Enabled](/security/exchange/phishing-protections-should-be-enabled) | Medium | Defender for Office 365 |
| [Inbound Anti-Spam Protections SHALL Be Enabled](/security/exchange/inbound-anti-spam-protections-shall-be-enabled) | Medium | Standard |
| [Safe Link Policies SHOULD Be Enabled](/security/exchange/safe-link-policies-should-be-enabled) | Medium | Defender for Office 365 |
| [Safe Attachments SHALL Be Enabled](/security/exchange/safe-attachments-shall-be-enabled) | Medium | Defender for Office 365 |
| [IP Allow Lists SHOULD NOT be Implemented](/security/exchange/ip-allow-lists-should-not-be-implemented) | Low | Standard |
| [Mailbox Auditing SHALL Be Enabled](/security/exchange/mailbox-auditing-shall-be-enabled) | None | Standard |
| [Alerts SHALL Be Enabled](/security/exchange/alerts-shall-be-enabled) | None | Defender for Office 365 |
| [Audit Logging SHALL Be Enabled](/security/exchange/audit-logging-shall-be-enabled) | None | Standard |
| [Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used](/security/exchange/enhanced-filtering-shall-be-configured-if-a-3rd-party-email-filtering-tool-is-being-used) | Low | Standard |
# Automatic Forwarding to External Domains SHALL Be Disabled
## Description
This control is intended to prevent bad actors from using client-side forwarding rules to exfiltrate data to external recipients.
## Policy
* Automatic forwarding to external domains SHALL be disabled
## Licensing Considerations
Any tenant with an Exchange Online license can configure this setting.
## Set Up Instructions
To disallow automatic forwarding to external domains:
1. Sign in to the Exchange admin center.
2. Select Mail flow, then Remote domains.
3. Select Default.
4. Under Email reply types, select Edit reply types.
5. Clear the checkbox next to Allow automatic forwarding, then click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting enabled, users will be prevented from setting up any auto-forwarding rules to external domains.
{% hint style="info" %}
Tips:
None Curently
{% endhint %}
## PowerShell Scripts
* Block Auto FW:
* Block Auto FW Multi-Tenant:
## Videos
{% embed url="" %}
# Sender Policy Framework SHALL Be Enabled
## Description
The Sender Policy Framework (SPF) is a mechanism that allows domain administrators to specify which Internet Protocol (IP) addresses are explicitly approved to send email on behalf of the domain, facilitating detection of spoofed emails. SPF is not configured through the Exchange admin center, but rather via the Domain Name Service (DNS) records hosted by the organization’s domain.
## Policy
* A list of approved IP addresses for sending mail SHALL be maintained
* An SPF policy(s) that designates only these addresses as approved senders SHALL be published.
## Licensing Considerations
Any tenant can configure this setting.
## Set Up Instructions
[Set up SPF to help prevent spoofing - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf-configure?view=o365-worldwide)
[How Sender Policy Framework (SPF) prevents spoofing - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-anti-spoofing?view=o365-worldwide)
Adding SPF records to a domain will vary depending on where the domain is hosted. Follow [these steps](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-spf-configure?view=o365-worldwide#create-or-update-your-spf-txt-record) for configuring an SPF record for Exchange Online.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Without proper SPF configuration, is possible that users will have their email rejected or marked as spam when sending outbound messages.
{% hint style="info" %}
Tips
* Optimize SPF Record: [How To Optimize SPF Record? v spf1 a mx (easydmarc.com)](https://easydmarc.com/blog/how-to-optimize-spf-record/#:~:text=Optimizing%20SPF%20record%201%201.%20Change%20sources%20order,of%20sources%20to%20the%20subdomain%20...%20More%20items)
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# DomainKeys Identified Mail SHOULD Be Enabled
## Description
DomainKeys Identified Mail (DKIM) allows digital signatures to be added to email messages in the message header, providing a layer of both authenticity and integrity to emails. As with SPF, DKIM relies on DNS records; thus, its deployment depends on how an organization manages its DNS. DKIM is enabled for the tenant’s default domain (e.g., on microsoft.com domains), but it must be manually enabled for custom domains.
## Policy
* DKIM SHOULD be enabled for any custom domain.
## Licensing Considerations
DKIM signing is included with Exchange Online Protection (EOP), which is included in all Microsoft 365 subscriptions that contain Exchange Online mailboxes.
## Set Up Instructions
[How to use DKIM for email in your custom domain - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide)
[How Sender Policy Framework (SPF) prevents spoofing - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-anti-spoofing?view=o365-worldwide)
[Support for validation of Domain Keys Identified Mail (DKIM) signed messages - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-support-about?view=o365-worldwide)
To enable DKIM, follow the instructions listed on [Steps to Create, enable and disable DKIM](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dkim-configure?view=o365-worldwide#steps-to-create-enable-and-disable-dkim-from-microsoft-365-defender-portal) from Microsoft 365 Defender portal | Microsoft Docs.
1. Navigate to the Microsoft 365 Defender admin center.
2. Go to Policies & Rules.
3. Go to Threat Policies.
4. Select DKIM.
5. Select your domain.
6. Switch Sign messages for this domain with DKIM signatures to Enabled.
If you are enabling DKIM for the first time, a pop-up window listing Canonical Name (CNAME) records displays. Publish these records to your DNS service provider.
Return to the DKIM page on the Defender admin center to finish enabling DKIM.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
While there is no direct impact to end-users, they should experience better outbound mail flow delivery with DKIM in place.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Domain-Based Message Authentication, Reporting, and Conformance SHALL Be Enabled
## Description
Domain-based Message Authentication, Reporting, and Conformance (DMARC) works with SPF and DKIM to authenticate mail senders and ensure that destination email systems can validate messages sent from your domain. DMARC helps receiving mail systems determine what to do with messages sent from your domain that fail SPF or DKIM checks
## Policy
* A DMARC policy SHALL be published for every custom domain.
* The DMARC message rejection option SHALL be “p=reject.”
## Licensing Considerations
Any tenant can perform this configuration
## Set Up Instructions
[Use DMARC to validate email, setup steps - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dmarc-configure?view=o365-worldwide#best-practices-for-implementing-dmarc-in-microsoft-365)
[Use DMARC to validate email, setup steps - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/email-authentication-dmarc-configure?view=o365-worldwide#how-microsoft-365-handles-inbound-email-that-fails-dmarc)
DMARC implementation varies depending on how an agency manages its DNS records. See [Form the DMARC TXT record for your domain | Microsoft Docs](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/use-dmarc-to-validate-email?view=o365-worldwide#step-4-form-the-dmarc-txt-record-for-your-domain) for Microsoft guidance. DMARC records can be requested using the PowerShell tool Resolve-DnsName. For example:
Resolve-DnsName \_dmarc.example.com txt
Replace “example.com” in the example with the domain(s) used for your agency’s emails. Ensure that (1) the DNS record exists, (2) “p=reject;” is included in the policy returned from the query
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
While there is no direct impact to end-users, they should experience better outbound mail flow delivery with DMARC in place,
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Enable Email Encryption
## Description
Email encryption rules can be added to encrypt a message with defined rules such as having a particular keyword in the subject line or body. Most common is to add “Secure” as the key word in the subject to encrypt the message. M365/O365 Message Encryption works with Outlook.com, Yahoo!, Gmail, and other email services. Email message encryption helps ensure that only intended recipients can view message content.
## Policy
* An email encryption policy Shall be configured
## Licensing Considerations
To enable this feature, an Azure Information Protection Plan 1 subscription is required which can either be purchased standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
[Azure Information Protection service description - Service Descriptions | Microsoft Learn](https://learn.microsoft.com/en-us/office365/servicedescriptions/azure-information-protection)
## Set Up Instructions
[Set up Microsoft Purview Message Encryption - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/set-up-new-message-encryption-capabilities?view=o365-worldwide)
[Add your brand to encrypted messages - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/add-your-organization-brand-to-encrypted-messages?view=o365-worldwide)
Follow [these steps](https://learn.microsoft.com/en-us/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email?view=o365-worldwide#create-mail-flow-rules-to-encrypt-email-messages-with-microsoft-purview-message-encryption) to configure a transport rule for email encryption.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
End-Users will likely need some instructions on how to use email encryption within the organization. Depending on how you role it out, they may have to type a specific subject line or leverage a built in plug-in that allows them to encrypt the message on demand. Users will need to open encrypted messages in Outlook on the web vs the email client on the desktop.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
Set up an email encryption rule:
Set up an email encryption rule (Multi-Tenant):
Verify Message Encryption:
## Videos
{% embed url="" %}
{% embed url="" %}
# Simple Mail Transfer Protocol Authentication SHALL Be Disabled
## Description
Modern email clients that connect to Exchange Online mailboxes—including Outlook, Outlook on the web, iOS Mail, and Outlook for iOS and Android—do not use Simple Mail Transfer Protocol Authentication (SMTP AUTH) to send email messages. SMTP AUTH is only needed for applications outside of Outlook that send email message.
## Policy
* SMTP AUTH SHALL be disabled in Exchange Online
* SMTP AUTH MAY be enabled on a per-mailbox basis
## Licensing Considerations
This setting can be configured in any Microsoft tenant.
## Set Up Instructions
SMTP AUTH can only be disabled tenant-wide using Exchange Online PowerShell. To do so, follow the instructions listed at [Disable SMTP AUTH in your organization | Microsoft Docs.](https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission#disable-smtp-auth-in-your-organization)
To enable SMTP AUTH on a per-mailbox basis, follow the instructions listed at [Use the Microsoft 365 admin center to enable or disable SMTP AUTH on specific mailboxes | Microsoft Docs.](https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission#use-the-microsoft-365-admin-center-to-enable-or-disable-smtp-auth-on-specific-mailboxes)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This will vary depending on the organization and what existing mail infrastructure looks like. This can be impactful if you have scanners, printers, or Line-of-business (LOB) applications leveraging SMTP auth for message relay. To avoid any issues here, [follow these steps.](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
{% hint style="info" %}
Tips
Use the following for configuring SMTP relay for printers, scanners, etc: [How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
{% endhint %}
## PowerShell Scripts
Changing Modern Auth Settings:
## Videos
{% embed url="" %}
# Calendar and Contact Sharing SHALL Be Restricted
## Description
Exchange Online allows the creation of sharing polices that ease default restrictions on contact and calendar details sharing. These policies should only be enabled with caution and must comply with the following policies.
## Policy
* Contact folders SHALL NOT be shared with all domains, although they MAY be shared with specific domains.
* Calendar details SHALL NOT be shared with all domains, although they MAY be shared with specific domains
## Licensing Considerations
This setting can be configured in any Microsoft tenant.
## Set Up Instructions
[Sharing policies in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/sharing/sharing-policies/sharing-policies)
[Sharing in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/sharing/sharing)
To restrict sharing with all domains:
1. Sign in to the Exchange admin center.
2. Under Organization, select Sharing.
3. Under Individual Sharing, for all existing policies, ensure that for all sharing rules, Sharing with all domains is not selected.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting in place, users will not be able to share calendar or contacts to any external domains unless they are whitelisted. A formal request process should be put into place and evaluated when a user needs to share their calendar details.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
Free/Busy Sharing Settings:
Free/Busy Sharing Settings (Multi-Tenant):
## Videos
None Currently
# External Sender Warnings SHALL Be Implemented
## Description
Mail flow rules allow the modification of incoming mail such that mail from external users can be easily identified, for example, by prepending the subject line with “\[External].” Seeing this message can help users identify email messages that might be spoofed and mark them as malicious.
## Policy
* External sender warnings SHALL be implemented.
## Licensing Considerations
This setting can be configured in any Microsoft tenant with Exchange Online.
## Set Up Instructions
[Mail flow rules (transport rules) in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
To enable external sender warnings:
1. Sign in to the Exchange admin center.
2. Under Mail flow, select Rules.
3. Click the plus (+) button to create a new rule.
4. Select Modify messages….
5. Give the rule an appropriate name.
6. Under Apply this rule if…, select The sender is located….
7. Under select sender location, select Outside the organization, then click OK.
8. Under Do the following…, select Prepend the subject of the message with….
9. Under specify subject prefix, enter a message such as “\[External]” (without the quotation marks), then click OK.
10. Under Choose a mode for this rule, select Enforce.
11. Click Save
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting in place, users will see a prepended message with each email they get originating outside the organization. Users should be trained to spot these messages in a combination of the from address to identify if the from address is being spoofed.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
{% embed url="" %}
# Data Loss Prevention Solutions SHALL Be Enabled
## Description
Data loss prevention (DLP) helps prevent both accidental leakage of sensitive information, as well as intentional exfiltration of data. DLP forms an integral part of securing Microsoft Exchange Online. Microsoft offers DLP services, controlled within the Microsoft 365 compliance admin center.
## Policy
* A data loss prevention policy shall be configured that applies to Exchange Online.
## Licensing Considerations
To configure data loss prevention policies, one of the following licenses is needed:
* Microsoft 365 Business Premium
* Microsoft 365 E3/E5
* Office 365 E3/E5
## Set Up Instructions
[Data loss prevention in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/data-loss-prevention/data-loss-prevention)
To create a DLP policy for Exchange follow the steps listed [here](https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide#define-a-new-dlp-policy-for-microsoft-teams)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting in place, users could have their email rejected depending on the policy definition. For example, if a user is trying to send sensitive information such as credit card info to an external domain, a DLP policy could kick in and block the message from being sent. The user would get a rejection email telling them why the message was blocked. They can also get messaging with policy tips before sending the email if that is configured.
{% hint style="info" %}
Tips
• None Currenty
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
{% embed url="" %}
# Emails SHALL Be Filtered by Attachment File Type
## Description
For some types of files (e.g., executable files), the dangers of allowing them to be sent over email outweigh any potential benefits. Some services, such as the Common Attachment Filter of Microsoft Defender, filter emails based on the attachment file types. Use of Microsoft Defender for this purpose is not strictly required; instead, equivalent products that fulfill the requirements outlined in this baseline setting may be used
## Policy
* Emails SHALL be filtered by the file types of included attachments
* Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
[Configure anti-malware policies - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide)
[Anti-malware protection - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection-about?view=o365-worldwide#anti-malware-policies)
To enable common attachments filter in the default policy:
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Anti-malware.
5. Select the Default (Default) policy.
6. Click Edit protection settings.
7. Check Enable the common attachments filter.
8. Click Customize file types as needed.
9. Click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting in place, users will not be able to receive attachments specified in the policy.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
# Zero-Hour Auto Purge for Malware SHOULD Be Enabled
## Description
This setting determines whether emails can be quarantined automatically after delivery to a user’s mailbox (e.g., in the case of a match with an updated malware classification rule).
## Policy
* Zero-hour auto purge (ZAP) for malware SHOULD be enabled in the default antimalware policy and in all existing custom policies.
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
[Configure anti-malware policies - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-policies-configure?view=o365-worldwide)
To enable ZAP:
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Anti-malware.
5. Select the Default (Default) policy.
6. Click Edit protection settings.
7. Check Enable zero-hour auto purge for malware (Recommended).
8. Click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting in place, users will have certain email messages removed from their mailbox if they are detected as malware.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
# Phishing Protections SHOULD Be Enabled
## Description
There are multiple ways to protect against phishing, including impersonation protection, mailbox intelligence and safety tips. Impersonation protection checks incoming emails to see if the sender address is similar to the users or domains on an agency-defined list. If the sender address is significantly similar, as to indicate an impersonation attempt, the email is quarantined. Mailbox intelligence is an artificial intelligence (AI)-based tool for identifying potential impersonation attempts
## Policy
* User impersonation protection SHOULD be enabled for key agency leaders.
* Domain impersonation protection SHOULD be enabled for domains owned by the agency.
* Domain impersonation protection SHOULD be added for frequent partners.
* Trusted senders and domains MAY be added in the event of false positives.
* Intelligence for impersonation protection SHALL be enabled.
* Message action SHALL be set to quarantine if the message is detected as impersonated.
* Mail classified as spoofed SHALL be quarantined.
* All safety tips SHALL be enabled, including:
‒ first contact.
‒ user impersonation.
‒ domain impersonation.
‒ user impersonation unusual characters.
‒ “?” for unauthenticated senders for spoof.
‒ “via” tag.
* The above configurations SHALL be set in the default policy and SHOULD be set in all existing custom policies.
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set Up Instructions
[Configure anti-phishing policies in EOP - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-eop-configure?view=o365-worldwide)
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Anti-phishing.
5. Select the Office365 AntiPhish Default (Default) policy.
6. Click Edit protection settings.
7. Check Enable users to protect.
8. Click Manage sender(s), then add users that merit impersonation protection.
9. Check Enable domains to protect.
10. Check Include domains I own.
11. Check Include custom domains.
12. Click Manage custom domains(s) to add the domains of frequent partners.
13. Check Enable mailbox intelligence (Recommended).
14. Check Enable Intelligence for impersonation protection (Recommended).
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting in place, users will better protection against spoofing attempts against their email. With additional protections, there is a higher chance of false positives that could negatively impact the user in which they do not receive legitimate mail.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
# Inbound Anti-Spam Protections SHALL Be Enabled
## Description
There are several features that protect against inbound spam: bulk compliant level, quarantines, safety tips, and zero hour auto purge.
## Policy
* The bulk complaint level (BCL) threshold SHOULD be set to six or lower.
* Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
* Phishing and high confidence phishing SHALL be quarantined.
* Bulk email SHOULD be moved to either the junk email folder or the quarantine folder.
* Spam in quarantine SHOULD be retained for at least 30 days.
* Spam safety tips SHOULD be turned on.
* Zero-hour auto purge (ZAP) SHALL be enabled for both phishing and spam messages.
* Allowed senders MAY be added, but allowed domains SHALL NOT be added.
* The previously listed configurations SHALL be set in the default policy and SHOULD be set in all existing custom policies.
## Licensing Considerations
• This setting can be configured with any tenant that has Exchange Online.
## Set Up Instructions
[Configure spam filter policies - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-policies-configure?view=o365-worldwide)
[Microsoft recommendations for EOP and Defender for Office 365 security settings - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365?view=o365-worldwide#eop-anti-spam-policy-settings)
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Anti-spam.
5. Select Anti-spam inbound policy (Default).
6. Under Bulk email threshold & spam properties, click Edit spam threshold and properties.
7. Set Bulk email threshold to six or lower.
8. Click Save.
9. Under Actions, click Edit actions.
10. In the Message actions section:
1. For Spam, High confidence spam, and Bulk, set the action to either Move message to Junk Email folder or Quarantine message.
2. Set the action for both Phishing and High confidence phishing to Quarantine message.
3. Set Retain spam in quarantine for this many days to “30.”
4. Check Enable spam safety tips.
5. Check Enable zero-hour auto purge (ZAP), Enable for phishing messages, and Enable for spam messages.
11. Click Save
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting in place, its possible that false positives will be generated and users will need to look either in their junk folder or have an admin release a message from quarantine that is legitimate.
{% hint style="info" %}
Tips
• Educate users on how to make request for quarantined messages to be released
{% endhint %}
## PowerShell Scripts
[Configure spam filter policies - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-policies-configure?view=o365-worldwide#use-powershell-to-create-anti-spam-policies)
## Videos
{% embed url="" %}
# Safe Link Policies SHOULD Be Enabled
## Description
When enabled, URLs in emails are rewritten by prepending:
https\://\*.safelinks.protection.outlook.com/?url=
to the original URL. This change can only be seen by either clicking the URL or copying and pasting it; the end-user, even when hovering over the URL in their email, will still only see the original URL. By prepending the safe links URL, Microsoft can proxy the initial URL through their scanning service. Their proxy can perform the following:
* Compares the URL with a block list
* Compares the URL with a list of know malicious sites
* If the URL points to a downloadable file, applies real-time file scanning
If all checks pass, the user is redirected to the original URL
## Policy
* The Safe Links Policy SHALL include all agency domains—and by extension—all users.
* URL rewriting and malicious link click checking SHALL be enabled.
* Malicious link click checking SHALL be enabled with Microsoft Teams.
* Real-time suspicious URL and file-link scanning SHALL be enabled.
* URLs SHALL be scanned completely before message delivery.
* Internal agency email messages SHALL have safe links enabled.
* User click tracking SHALL be enabled.
* Safe Links in Office 365 apps SHALL be turned on.
* Users SHALL NOT be enabled to click through to the original URL.
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Defender for Office 365 Plan 1/2
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
Resources:
[Complete Safe Links overview for Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-about?view=o365-worldwide)
[Set up Safe Links policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide)
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Safe Links.
1. Create a Safe Links Policy.
1. Assign the new policy an appropriate name and description.
1. Include all tenant domains. All users under those domains will be added.
1. On the URL & click protection settings page:
1. Select On: Safe Links checks a list of known, malicious links when users click links in email. URLs are rewritten by default.
2. Select Apply Safe Links to email messages sent within the organization.
3. Select Apply real-time URL scanning for suspicious links and links that point to files.
4. Select Wait for URL scanning to complete before delivering the message.
2. On the URL & click protection settings page, under Teams, select On: Safe Links checks a list of known, malicious links when users click links in Microsoft Teams. URLs are not rewritten.
3. On the URL & click protection settings page, under Office 365 Apps, select On: Safe Links checks a list of known, malicious links when users click links in Microsoft Office Apps. URLs are not rewritten.
4. On the URL & click protection settings page, under Click protection settings:
1. Select Track User Clicks.
2. Do not select Let users click through to the original URL.
5. Review the new policy, then click Submit.
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting in place, there may be some latency in email flow while the URL is being scanned before delivery. When users click on a link and the link is found to be malicious, users will get a page describing the malicious link and will not be able to proceed to the webpage.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set up Safe Links policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-links-policies-configure?view=o365-worldwide#use-powershell-to-create-safe-links-policies)
[Security/ATP Implementation.ps1 at master · msp4msps/Security (github.com)](https://github.com/msp4msps/Security/blob/master/ATP%20Implementation.ps1)
## Videos
{% embed url="" %}
{% embed url="" %}
# Safe Attachments SHALL Be Enabled
## Description
The Safe Attachments will scan messages for attachments with malicious content. It routes all messages and attachments that do not have a virus/malware signature to a special environment. The process then uses machine learning and analysis techniques to detect malicious intent. Enabling this feature may slow down message delivery to the user due to the scanning.
## Policy
* At least one Safe Attachments Policy SHALL include all agency domains—and by extension—all users.
* The action for malware in email attachments SHALL be set to block.
* Redirect emails with detected attachments to an agency-specified email SHOULD be enabled.
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Defender for Office 365 Plan 1/2
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
[Safe Attachments - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-about?view=o365-worldwide#safe-attachments-policy-settings)
[Set up Safe Attachments policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-policies-configure?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-create-safe-attachments-policies)
To configure safe attachments for Exchange Online, follow the instructions listed on [Use the Microsoft 365 Defender portal to create Safe Attachments policies.](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-safe-attachments-policies?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-create-safe-attachments-policies)
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Threat policies.
4. Under Policies, select Safe Attachments.
5. Click Create to start a new policy.
6. Give the new policy an appropriate name and description.
7. Under domains, enter all organization tenant domains. All users under these domains will be added to the policy.
8. Under Safe Attachments unknown malware response, select Block.
Set the Quarantine policy to AdminOnlyAccessPolicy.
9. Click Next, then Submit.
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting in place, there may be some latency in email flow while the attachment is being scanned before delivery. If the attachment is found to be malicious, the email will be blocked from sending.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set up Safe Attachments policies in Microsoft Defender for Office 365 - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-policies-configure?view=o365-worldwide#use-exchange-online-powershell-or-standalone-eop-powershell-to-configure-safe-attachments-policies)
[Security/ATP Implementation.ps1 at master · msp4msps/Security (github.com)](https://github.com/msp4msps/Security/blob/master/ATP%20Implementation.ps1)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# IP Allow Lists SHOULD NOT be Implemented
## Description
Microsoft Defender supports the creations of IP “allow lists,” which are intended to ensure that emails from specific senders are not blocked. However, as a result, emails from these senders bypass important security mechanisms, such as spam filtering, SPF, DKIM, DMARC, and FROM address enforcement.
IP “block lists” ensure that mail from these IP addresses is always blocked. Although we have no specific guidance on which IP addresses to add, block lists can be used to block mail from known spammers. The IP “safe lists” group is a dynamic list of “known, good senders,” which Microsoft sources from various third-party subscriptions. As with senders in the allow list, emails from these senders bypass important security mechanisms.
## Policy
* IP allow lists SHOULD NOT be created.
* Safe lists SHOULD NOT be enabled.
* A connection filter MAY be implemented to create an IP “block list.”
## Licensing Considerations
• Exchange Online Protection
## Set Up Instructions
[Create safe sender lists - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365?view=o365-worldwide#use-the-ip-allow-list)
[Configure the default connection filter policy - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/connection-filter-policies-configure?view=o365-worldwide)
To modify the connection filters, follow the instructions found on Use the Microsoft 365 Defender portal to modify the default connection filter policy.
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Under Policies, select Anti-spam.
4. Select Connection filter policy (Default).
5. Click Edit connection filter policy.
6. Ensure no addresses are specified under Always allow messages from the following IP addresses or address range.
7. Enter addresses under Always block messages from the following IP addresses or address range as needed.
8. Ensure Turn on safe list is not selected.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting in place, there may be some false positives from IP addresses that are seen as malicious.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Configure the default connection filter policy - Office 365 | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/connection-filter-policies-configure?view=o365-worldwide#use-exchange-online-powershell-or-standalone-eop-powershell-to-modify-the-default-connection-filter-policy)
## Videos
{% embed url="" %}
# Mailbox Auditing SHALL Be Enabled
## Description
Mailbox auditing helps users investigate compromised accounts or discover illicit access to Exchange Online. Some actions performed by administrators, delegates, and owners are logged automatically. While mailbox auditing is enabled by default, organizations should ensure that it has not been inadvertently disabled.
## Policy
* Mailbox auditing SHALL be enabled
## Licensing Considerations
• Exchange Online Protection
## Set Up Instructions
Mailbox auditing can be enabled from the Exchange Online PowerShell. Follow the
instructions listed on [Manage mailbox auditing in Office 365](https://docs.microsoft.com/en-us/microsoft-365/compliance/enable-mailbox-auditing?view=o365-worldwide).
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no end-user impact for this setting
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
To check the current mailbox auditing status via PowerShell:
1. Connect to the Exchange Online PowerShell.
2. Run the following command:
```powershell
Get-OrganizationConfig | Format-List AuditDisabled.
```
To enable mailbox auditing
```powershell
Set-OrganizationConfig –AuditDisabled $false.
```
## Videos
{% embed url="" %}
# Alerts SHALL Be Enabled
## Description
Microsoft Defender includes several prebuilt alert policies, many of which pertain to Exchange Online. These alerts give admins better real-time insight into possible security incidents.
## Policy
At a minimum, the following alerts SHALL be enabled:
* Suspicious email sending patterns detected.
* Suspicious connector activity
* Suspicious email forwarding activity.
* Unusual increase in email reported as phish.
* Messages have been delayed.
* Tenant restricted from sending unprovisioned email.
* Tenant restricted from sending email.
* Malware campaign detected after delivery.
* A potentially malicious URL click was detected.
The alerts SHOULD be sent to a monitored address or incorporated into a security incident and event management (SIEM) tool.
## Licensing Considerations
This setting requires Defender for Office 365 Plan 1 or Plan 2 which can be purchased standalone or as part of the following bundles:
* Defender for Office 365 Plan 1/2
* Microsoft 365 Business Premium
* Office 365 E5/A5/G5
* Microsoft 365 E5/A5/G5
* Microsoft 365 E5/A5/G5 Information Protection and Governance
* Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
## Set Up Instructions
[Microsoft 365 alert policies - Microsoft Purview (compliance) | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide)
1. Sign in to Microsoft 365 Defender.
2. Under Email & collaboration, select Policies & rules.
3. Select Alert Policy.
4. Click the policy name.
5. Ensure Status is set to On.
6. Ensure Email recipients includes at least one monitored address
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no end-user impact for this setting
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[New-ProtectionAlert (ExchangePowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchange/new-protectionalert?view=exchange-ps)
## Videos
{% embed url="" %}
# Audit Logging SHALL Be Enabled
## Description
To view data in threat protection reports, email security reports, and Explorer, audit logging must be turned on. By default, Microsoft retains the audit logs for only 90 days.
## Policy
Audit logging SHALL be enabled.
## Licensing Considerations
By default, Microsoft retains the audit logs for only 90 days for every Microsoft Tenant
Advanced audit capabilities, including the creation of a custom audit log retention policy, requires E5/G5 licenses or E3/G3 licenses with add-on compliance licenses. Additionally, maintaining logs in the Microsoft 365 environment for longer than one year requires an add-on license. For more information, see [Licensing requirements | Microsoft Docs.](https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-solutions-overview?view=o365-worldwide#licensing-requirements)
## Set Up Instructions
Auditing can be enabled from the Microsoft 365 compliance admin center and the Exchange Online PowerShell. Follow the instructions listed on [Turn on auditing.](https://docs.microsoft.com/en-us/microsoft-365/compliance/turn-audit-log-search-on-or-off?view=o365-worldwide#turn-on-auditing)
1. Sign in to the Microsoft 365 compliance admin center.
2. Under Solutions, select Audit.
3. If auditing is not enabled, a banner displays and prompts that the user and admin activity start being recorded.
4. Click the Start recording user and admin activity banner.
To set up advanced audit, see [Set up Advanced Audit in Microsoft 365 | Microsoft](https://docs.microsoft.com/en-us/microsoft-365/compliance/set-up-advanced-audit?view=o365-worldwide) Docs.
To create an audit retention policy, follow the instructions listed on [Create an audit log retention policy.](https://docs.microsoft.com/en-us/microsoft-365/compliance/audit-log-retention-policies?view=o365-worldwide#create-an-audit-log-retention-policy)
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There is no end-user impact for this setting
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
To check the current logging status via PowerShell:
1. Connect to Exchange Online
2. Run the following command
```powershell
Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled.
```
To enable logging via PowerShell
```powershell
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true.
```
## Videos
{% embed url="" %}
{% embed url="" %}
# Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used
## Description
Enhanced email filtering can be set up if you have a connector in 365 (3rd party email filtering service or hybrid configuration) and your MX record does not point to Microsoft 365 or Office 365. This new feature allows you to filter email based on the actual source of messages that arrive over the connector. This is also known as skip listing and this feature will allow you to overlook, or skip, any IP addresses that are considered internal to you in order to get the last known external IP address, which should be the actual source IP address.
If you are using Defender for Office 365, this will enhance its machine learning capabilities and security around safe links/safe attachments/anti-spoofing from Microsoft’s known malicious list based off IP. In a way, you are getting a secondary layer of protection by allowing Microsoft to view the IPs of the original email and check against their database.
## Policy
Enhanced Filtering Shall be configured if a 3rd party email filtering tool is being used
## Licensing Considerations
Exchange Online Protection
## Set Up Instructions
[Enhanced filtering for connectors in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors#use-the-microsoft-365-defender-portal-to-configure-enhanced-filtering-for-connectors-on-an-inbound-connector)
Follow [these steps](https://learn.microsoft.com/en-us/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors#use-the-microsoft-365-defender-portal-to-configure-enhanced-filtering-for-connectors-on-an-inbound-connector) to configure Enhanced Filtering for Connectors on an inbound connector.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
There is no end-user impact for this setting. Depending on the providers, there may be some false positives that restrict legitimate mail to end-users.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Enhanced filtering for connectors in Exchange Online | Microsoft Learn](https://learn.microsoft.com/en-us/Exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors#use-exchange-online-powershell-or-exchange-online-protection-powershell-to-configure-enhanced-filtering-for-connectors-on-an-inbound-connector)
## Videos
None Currently
# SharePoint
**Section Purpose:** The security section shows recommend security controls for Teams based on the CIS Controls. Each control contains the following subsections:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
| Policy | End-User Impact | License |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | -------- |
| [File and Folder Links Default Sharing Settings SHALL Be Set to Specific People](/security/sharepoint/file-and-folder-links-default-sharing-settings-shall-be-set-to-specific-people) | Low | Standard |
| [External Sharing SHOULD be Set to “New and Existing Guests”](/security/sharepoint/external-sharing-should-be-set-to-new-and-existing-guests) | High | Standard |
| [Sensitive SharePoint Sites SHOULD Adjust Their Default Sharing Settings](/security/sharepoint/sensitive-sharepoint-sites-should-adjust-their-default-sharing-settings) | Medium | Standard |
| [Expiration Times for Guest Access to a Site SHOULD Be Determined by specific needs](/security/sharepoint/expiration-times-for-guest-access-to-a-site-should-be-determined-by-specific-needs) | Low | Standard |
| [Users SHALL Be Prevented from Running Custom Scripts](/security/sharepoint/users-shall-be-prevented-from-running-custom-scripts) | Low | Standard |
# File and Folder Links Default Sharing Settings SHALL Be Set to Specific People
## Description
This policy ensures that when sharing files in SharePoint, there are several possible scopes, including agency-wide or “anyone with the link.”
## Policy
File and folder links default sharing setting SHALL be set to “Specific People (Only the People the User Specifies).”
## Licensing Considerations
Any tenant with SharePoint online licensing can access this setting.
## Set-Up Instructions
[Manage sharing settings - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#file-and-folder-links)
In the SharePoint admin center:
1. In the left-hand navigation bar, click Policies -> Sharing to display sharing settings.
2. Under File and folder links, ensure that the default link type is set to Specific people (only the people the user specifies).
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
With this setting enabled, users will have to specify users that can access the link. If the link is forwarded to other users internally or externally, those users will not be able to access the link.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/Set-SPOTenant?view=sharepoint-ps)
## Videos
{% embed url="" %}
# External Sharing SHOULD be Set to “New and Existing Guests”
## Description
SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security risk. This working group recommends allowlisting by domains and security groups per interagency collaboration needs. Note: Adjusting this setting will adjust external sharing for OneDrive and Teams to the same, selected level. OneDrive and Teams can be less permissive (not more permissive) than SharePoint Online. Adding approved domains and/or security groups will also be reflected in One Drive external sharing settings.
## Policy
External sharing SHOULD be limited to approved domains and security groups per interagency collaboration needs.
## Licensing Considerations
Any tenant with SharePoint online licensing can access this setting.
## Set-Up Instructions
[Manage sharing settings - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off)
To adjust sharing settings, in the SharePoint admin center:
1. Select Policies -> Sharing.
2. Adjust external sharing slider to New and Existing Guests.
3. Expand More external sharing settings.
4. Select Limit external sharing by domain.
5. Select Add domains.
6. Add domains.
7. Select Save.
8. Select Allow only users in specific security groups to share externally.
9. Select Manage security groups.
10. Add security groups.
11. Select Save.
## End-User Impact
{% hint style="info" %}
Level: High
{% endhint %}
With this setting enabled, users will not be able to share external links unless:
* External users are added as guest to the organization
* External user domains are added to the SharePoint setting
* Users are added to the specified security groups so they can send to external users
{% hint style="info" %}
Tips
• There should be a formal request process for adding domains and being added to a security group.
{% endhint %}
## PowerShell Scripts
[Set-SPOTenant (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/Set-SPOTenant?view=sharepoint-ps)
## Videos
{% embed url="" %}
# Sensitive SharePoint Sites SHOULD Adjust Their Default Sharing Settings
## Description
SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security risk. This working group recommends outside of the default organizational settings agencies should evaluate each created site and adjust sharing settings best aligned to their respective sensitivity level.
## Policy
Sharing settings for specific SharePoint sites SHOULD align to their sensitivity level
## Licensing Considerations
Any tenant with SharePoint online licensing can access this setting.
## Set-Up Instructions
[Managing SharePoint Online Security: A Team Effort | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort)
To limit external sharing by domain, in the SharePoint admin center:
1. Select Sites.
2. Select Active sites.
3. Select Site name.
4. Select Add domains.
5. Select Policies.
6. Under external sharing, select Edit.
7. Select permissions aligning to the risk posture associated with the sensitivity of the SharePoint site.
8. Select Save.
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Depending on the selection here, users will be restricted in sharing links of documents within the SharePoint Site.
{% hint style="info" %}
Tips
There should be guidance provided on document repository structure.
Leverage some type of form for when users want to create a new SharePoint site to see if it will contain sensitive information.
{% endhint %}
## PowerShell Scripts
[Set-SPOSite (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-sposite?view=sharepoint-ps)
## Videos
{% embed url="" %}
# Expiration Times for Guest Access to a Site SHOULD Be Determined by specific needs
## Description
SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security risk. This working group recommends setting an expiration time for guest access to the site or OneDrive
## Policy
* Expiration timers for ‘guest access to a site or OneDrive’ and ‘people who use a verification code’ SHOULD be set.
* Expiration timers SHOULD be set to 30 days.
## Licensing Considerations
Any tenant with SharePoint online licensing can access this setting.
## Set-Up Instructions
[Managing SharePoint Online Security: A Team Effort | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort)
To limit external sharing by domain, in the SharePoint admin center:
1. Select Policies -> Sharing.
2. Expand More external sharing settings.
3. Select Guest access to a site or OneDrive will expire automatically after this many days.
4. Enter “30” days.
5. Select People who use a verification code must reauthenticate after this many days.
6. Enter “30” days.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
• Users may have to reshare new links if the existing ones expire before the interaction with external users is complete.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set-SPOSite (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-sposite?view=sharepoint-ps)
[Best practices for unauthenticated sharing | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/best-practices-anonymous-sharing?view=o365-worldwide#set-an-expiration-date-for-anyone-links)
## Videos
None Currently
# Users SHALL Be Prevented from Running Custom Scripts
## Description
Allowing users to run custom scripts can potentially allow malicious scripts to run in a trusted environment. For this reason, running custom scripts should not be allowed
## Policy
* Users SHALL be prevented from running custom scripts
## Licensing Considerations
Any tenant with SharePoint online licensing can access this setting.
## Set-Up Instructions
[Managing SharePoint Online Security: A Team Effort | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort)[Allow or prevent custom script - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/allow-or-prevent-custom-script)
In the SharePoint Classic admin center:
1. Scroll to the Custom Script setting and select both of the following:
1. Prevent users from running custom script on personal sites.
2. Prevent users from running custom script on self-service created sites.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
There shouldn’t be many users looking to run custom scripts in SharePoint
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Allow or prevent custom script - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/allow-or-prevent-custom-script#to-allow-custom-script-on-other-sharepoint-sites)
## Videos
None Currently
# OneDrive
**Section Purpose:** The security section shows recommend security controls for Teams based on the CIS Controls. Each control contains the following subsections:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
| Policy | End-User Impact | License |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | -------- |
| [Anyone Links SHOULD Be Turned Off](/security/onedrive/anyone-links-should-be-turned-off) | Medium | Standard |
| [Expiration Date SHOULD Be Set for Anyone Links](/security/onedrive/expiration-date-should-be-set-for-anyone-links) | Low | Standard |
| [Link Permissions SHOULD Be Set to Enabled Anyone Links to View](/security/onedrive/link-permissions-should-be-set-to-enabled-anyone-links-to-view) | Medium | Standard |
| [Windows and MacOS devices should be prevented from syncing the OneDrive Client on personal devices](/security/onedrive/windows-and-macos-devices-should-be-prevented-from-syncing-the-onedrive-client-on-personal-devices) | Low | Standard |
| [Legacy Authentication SHALL Be Blocked](/security/onedrive/legacy-authentication-shall-be-blocked) | Low | Standard |
# Anyone Links SHOULD Be Turned Off
## Description
Unauthenticated sharing (Anyone links) is used to share data without authentication and users are free to pass it on to others outside the agency. To prevent users from unauthenticated sharing of content, turn off Anyone sharing for users outside the tenant when accessing content in SharePoint, Groups, or Teams.
## Policy
* Anyone links SHOULD be disabled.
## Licensing Considerations
Any tenant with OneDrive for Business licensing can access this setting.
## Set-Up Instructions
[Limit accidental exposure | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/share-limit-accidental-exposure?view=o365-worldwide)
Note: OneDrive settings can be more restrictive than the SharePoint setting, but not more permissive.
To turn off Anyone links for the agency:
1. Open the SharePoint admin center.
2. In the left-hand navigation pane, expand Policies, then select Sharing.
3. Set the SharePoint external sharing settings to New and existing guests, then set OneDrive to New and existing guests.
4. Click Save.
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
With this setting enabled, users will have to specify users that can access the link. If the link is forwarded to other users internally or externally, those users will not be able to access the link.
{% hint style="info" %}
Tips
• A formal process should be put into place for requesting guest users and sharing company data.
{% endhint %}
## PowerShell Scripts
[Set-SPOSite (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-sposite?view=sharepoint-ps)
## Videos
None Currently
# Expiration Date SHOULD Be Set for Anyone Links
## Description
Files that are stored in SharePoint sites, Groups, and Teams for months and years could lead to unexpected modifications to files if shared with unauthenticated people. Configuring expiration times for Anyone links can help avoid unwanted changes. If Anyone links are enabled, the expiration date SHOULD be set to thirty days or as determined by mission needs or agency policy.
## Policy
* An expiration date SHOULD be set for Anyone links.
* Expiration date SHOULD be set to thirty days.
## Licensing Considerations
Any tenant with OneDrive for Business licensing can access this setting.
## Set-Up Instructions
[Best practices for unauthenticated sharing | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/best-practices-anonymous-sharing?view=o365-worldwide)
To set an expiration date for Anyone links across the agency (Note: Anyone links must be enabled).
1. Open the SharePoint admin center.
2. In the left-hand navigation pane, expand Policies, and then select Sharing.
3. Under Choose expiration and permissions options for Anyone links, select the These links must expire within this many days check box.
4. Enter the number of days in the box, and then click Save.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Users may have to reshare new links if the existing ones expire before the interaction with external users is complete.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set-SPOSite (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-sposite?view=sharepoint-ps)
## Videos
None Currently
# Link Permissions SHOULD Be Set to Enabled Anyone Links to View
## Description
The Anyone links default to allow people to edit files, as well as edit and view files and upload new files to folders. To allow unauthenticated sharing but keep unauthenticated people from modifying the agency's content, consider setting the file and folder permissions to View.
## Policy
* Anyone link permissions SHOULD be limited to View.
## Licensing Considerations
Any tenant with OneDrive for Business licensing can access this setting.
## Set-Up Instructions
[Best practices for unauthenticated sharing | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/solutions/best-practices-anonymous-sharing?view=o365-worldwide)
To set an expiration date for Anyone links across the agency (Note: Anyone links must be enabled).
1. Open the SharePoint admin center.'
2. In the left-hand navigation pane, expand Policies, then select Sharing.
3. Under Advanced settings for Anyone links, set the file and folder permissions to View.
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Users may have to reshare new links if the existing ones expire before the interaction with external users is complete.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set-SPOSite (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-sposite?view=sharepoint-ps)
## Videos
None Currently
# Windows and MacOS devices should be prevented from syncing the OneDrive Client on personal devices
## Description
Windows and MacOS devices should be prevented from syncing the OneDrive Client on devices that are personally owned. These devices may not be joined to the corporate domain and have a highly likelihood of being compromised without the corporations security implemented.
## Policy
* OneDrive Client Sync for Windows and MacOS SHALL be restricted to corporate owned devices.
## Licensing Considerations
Any tenant with OneDrive for Business licensing can access this setting.
## Set-Up Instructions
[Allow syncing only on computers joined to specific domains - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/allow-syncing-only-on-specific-domains)
[SharePoint and OneDrive unmanaged device access controls for administrators - SharePoint in Microsoft 365 | Microsoft Learn](https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices)
1. Open the SharePoint admin center.
2. In the left-hand navigation pane, select Settings and sign in with an account that has admin permissions for the agency.
3. Select Sync.
4. Select the Allow syncing only on computers joined to specific domains check box.
5. Add the Globally Unique Identifier (GUID) of each domain for the member computers that the agency wants to be able to sync.
1. Note: Add the domain GUID of the computer domain membership. If users are in a separate domain, only the domain GUID that the computer account is joined to is required.
2. Important: This setting is only applicable to Active Directory domains. It does not apply to Azure Active Directory (AAD) domains. If agency devices are only Azure AD joined, consider using a Conditional Access Policy instead.
6. Click Save
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Users will be prevented from syncing OneDrive or a SharePoint site to their local device if that device is not corporate owned.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[Set-SPOTenantSyncClientRestriction (Microsoft.Online.SharePoint.PowerShell) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction?view=sharepoint-ps#:%7E:text=In%20order%20to%20explicitly%20block%20Microsoft%20OneDrive%20client,cmdlet%20with%20the%20BlockMacSync%20parameter%20set%20to%20true.?msclkid=f80f95c5c4c611ecac7de0980370f33c)
## Videos
{% embed url="" %}
# Legacy Authentication SHALL Be Blocked
## Description
Modern authentication, based on Active Directory Authentication Library (ADAL) and Open Authorization 2 (OAuth2), is a critical component of security in Office 365. It provides the device authentication and authorization capability of Office 365, which is a foundational security component. If modern authentication is not required, this creates a loophole that could allow unauthorized devices to connect to OneDrive and download/exfiltrate enterprise data. For this reason, it is important to make sure that only apps that support modern authentication are allowed to connect, assuring that only authorized devices are allowed to access enterprise data.
## Policy
* Legacy Authentication SHALL be blocked for OneDrive and SharePoint
## Licensing Considerations
Any tenant with OneDrive for Business licensing can access this setting.
## Set-Up Instructions
1. Open the SharePoint admin center.
2. In the left-hand navigation pane, click Policies > Access Control > Device access.
3. Click Apps that don’t use modern authentication to display the device access settings.
4. On the Apps that don’t use modern authentication page, select the Block access option
**Note to this can be accomplished through a Conditional Access Policy as well**
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
There should not be many users trying to access OneDrive or SharePoint documents with apps that do not use modern authentication.
{% hint style="info" %}
Tips
• If you have a Conditional Access Policy set up to block legacy authentication, this setting is not necessary
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
# Intune
**Section Purpose:** The security section shows recommend security controls for Teams based on the CIS Controls. Each control contains the following subsections:
* Description
* Policy Definition
* Licensing Considerations
* Set Up Instructions
* End-User Impact
* PowerShell Scripts
* Video Tutorials
| Policy | End-User Impact | License |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | ----------- |
| [Personal Devices should be restricted from enrolling into the MDM solution](/security/intune/personal-devices-should-be-restricted-from-enrolling-into-the-mdm-solution) | Medium | Standard |
| [Devices shall be deleted that haven’t checked in for over 30 days](/security/intune/devices-shall-be-deleted-that-havent-checked-in-for-over-30-days) | Low | Standard |
| [Devices compliance policies shall be configured for every supported device platform](/security/intune/devices-compliance-policies-shall-be-configured-for-every-supported-device-platform) | Medium | Standard |
| [Noncompliant devices shall be blocked from accessing corporate resources](/security/intune/noncompliant-devices-shall-be-blocked-from-accessing-corporate-resources) | High | Azure AD P1 |
| [MFA Shall be required for Intune Enrollment](/security/intune/mfa-shall-be-required-for-intune-enrollment) | Medium | Azure AD P1 |
| [Security Baselines should be configured for Windows Devices](/security/intune/security-baselines-should-be-configured-for-windows-devices) | Medium | Standard |
| [Windows Update Rings shall be configured for Windows Devices](/security/intune/windows-update-rings-shall-be-configured-for-windows-devices) | Medium | Standard |
| [Update Policies shall be configured for Apple Devices](/security/intune/update-policies-shall-be-configured-for-apple-devices) | Medium | Standard |
| [App Protection policies should be created for mobile devices](/security/intune/app-protection-policies-should-be-created-for-mobile-devices) | Medium | Standard |
| [Mobile devices shall only be able to access corporate data through approved client apps](/security/intune/mobile-devices-shall-only-be-able-to-access-corporate-data-through-approved-client-apps) | Medium | Azure AD P1 |
| [Lockout screen and password settings shall be configured for each device](/security/intune/lockout-screen-and-password-settings-shall-be-configured-for-each-device) | Medium | Standard |
| [Encryption shall be required on all devices](/security/intune/encryption-shall-be-required-on-all-devices) | Low | Standard |
| [Windows Hello for Business should be configured where applicable](/security/intune/windows-hello-for-business-should-be-configured-where-applicable) | Low | Standard |
| [Authorized Applications shall be configured for Single Sign-On](/security/azure-ad-entra/authorized-applications-shall-be-configured-for-single-sign-on) | Low | Standard |
| [Device Use Shall be restricted until required applications are installed](/security/intune/device-use-shall-be-restricted-until-required-applications-are-installed) | Medium | Standard |
| [Devices and Applications shall be wiped when a user leaves the organization or reports a lost/stolen](/security/intune/devices-and-applications-shall-be-wiped-when-a-user-leaves-the-organization-or-reports-a-lost-stolen) | None | Standard |
# Personal Devices should be restricted from enrolling into the MDM solution
## Description
By default, any device can enroll into Intune whether or not it is classified as corporate or personal. To prevent device users from accidently enrolling their personal device, device restrictions should be configured. Users should only be enrolling corporate owned devices that have specifications that meet corporate standards.
## Policy
* Device restrictions should be configured to restrict personal devices from enrolling in the MDM solution
* Only device types (i.e. Windows, Linux, macOS, etc.) defined by the corporation shall be supported for Intune enrollment
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Overview of enrollment restrictions - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set)
[Create device platform restrictions - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/enrollment/create-device-platform-restrictions)
To block personally owned devices from enrolling into Intune:
1. Follow the steps outlined [here](https://learn.microsoft.com/en-us/mem/intune/enrollment/create-device-platform-restrictions)
2. Under Personally-Owned, select Block for each device type
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Users will not be able to enroll any device that is classified as personal. If you have Windows autoenrollment enabled, users will be prompted to enroll their devices when access common office applications like Teams. If they select Yes to enroll the device and the device is personally owned, they will be prevented from enrolling that device.
{% hint style="info" %}
Tips
• If you have a Conditional Access Policy set up to block legacy authentication, this setting is not necessary
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/EnrollmentRestrictions at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/EnrollmentRestrictions)
## Videos
{% embed url="" %}
# Devices shall be deleted that haven’t checked in for over 30 days
## Description
By default, no devices are removed from Intune no matter the level of inactivity. In order to ensure an inventory of active authorized devices, device clean-up rules should be configured to automatically delete devices that have not checked in for over 30 days.
## Policy
* Devices are deleted from Intune if they have not checked in for over 30 days
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Overview of enrollment restrictions - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/enrollment/enrollment-restrictions-set)
[Create device platform restrictions - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/enrollment/create-device-platform-restrictions)
To set the device clean-up rule:
1. Go to the Intune Admin Center
2. Click on Devices
3. Scroll down to Other and select Device Clean-up rules
4. Select Yes for the first option
5. Set the time period to 30 days
6. Click Save
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
If users have a device that does no check in for over 30 days it would be removed from Intune. Devices can be recovered if someone were to take an extended leave for up to 180 days.
{% hint style="info" %}
Tips
• If you are leveraging Intune as a source of truth for your asset inventory, you may want to change this setting to 60 or 90 days so that devices are not removed as quickly. This would give you more time to identify stale devices and take the proper action to reissue or retire the device.
{% endhint %}
## PowerShell Scripts
## Videos
{% embed url="" %}
# Devices compliance policies shall be configured for every supported device platform
## Description
Device compliance policies allow us to define the necessary settings on a particular platform that meets corporate requirements. Device compliance policies paired with conditional access policies allow us to prevent access to corporate resources on noncompliant devices. Devices should be constantly monitored to ensure compliance with corporate policies.
## Policy
* A device compliance policy is configured for each device platform that is supported by the corporation.
* Devices that do not meet the compliance standards shall be marked as noncompliant immediately
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Device compliance policies in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started)
To configure device compliance policies by platform:
[Windows](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows)
[macOS](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os)
[iOS/iPadOS](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios)
[Android device administrator](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android)
[Android (AOSP)](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android-aosp)
[Android Enterprise](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android-for-work)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Device compliance policies will have no impact to end-users unless they are paired with conditional access policies to block access on noncompliant devices. Devices not in compliance will show up in the Intune admin center from a reporting standpoint. There are certain device compliance policy settings that will prompt the end-user for certain action. For instance, configuring Encryption of data storage on the device will prompt the user to configure Bitlocker encryption if it is not already enabled. It is recommended to push out a configuration profile to automatically configure encryption in this use case to avoid help desk calls.
{% hint style="info" %}
Tips
•Device compliance policy settings might vary depending on the organization but should be standardized where possible.
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/CompliancePolicy at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/CompliancePolicy)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Noncompliant devices shall be blocked from accessing corporate resources
## Description
Device compliance policies allow us to define the necessary settings on a particular platform that meets corporate requirements. Device compliance policies paired with conditional access policies allow us to prevent access to corporate resources on noncompliant devices. Devices that are not in compliance should not have access to corporate resources.
## Policy
* Noncompliant devices shall not be able to access corporate resources
## Licensing Considerations
This setting requires at least an Azure AD P1 license which comes standalone or as part of the following bundles:
* EMS+E3/E5
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set-Up Instructions
[Device compliance policies in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started)
To configure a conditional access policy for compliant devices:
1. Follow the steps [outlined here](https://learn.microsoft.com/en-us/mem/intune/protect/create-conditional-access-intune) to create a conditional access policy
2. Under the assignments section, Include all users. Be sure to Exclude a break-glass account to ensure you never lock yourself out.
3. Under the Cloud Apps section, include all cloud apps
4. Do not configure anything in the conditions section
5. Under the Grant section, choose Require device to be marked as compliant
## End-User Impact
{% hint style="info" %}
Level: High
{% endhint %}
Any user that is trying to access corporate data on a device not marked as compliant shall receive a message letting them know they are blocked and will be told to contact IT. This includes both devices enrolled into Intune and marked as noncompliant as well as devices that are not enrolled at all into the solution.
{% hint style="info" %}
Tips
A formal process definition should be in place for investigating noncompliant devices. Common use cases for noncompliant triggers should be documented to expedite resolution
Automation should be put in place where possible to alert on noncompliant devices in order to be more proactive.
Users should have way to readily contact support that is not through email as they will not have access to enter outlook
{% endhint %}
## PowerShell Scripts
[azure-ad-conditional-access-apis/readme.md at main · Azure-Samples/azure-ad-conditional-access-apis (github.com)](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/blob/main/01-configure/powershell/readme.md)
## Videos
{% embed url="" %}
# MFA Shall be required for Intune Enrollment
## Description
You can use Intune together with Azure Active Directory (Azure AD) conditional access policies to require multifactor authentication (MFA) during device enrollment. If you require MFA, employees and students wanting to enroll devices must first authenticate with a second device and two forms of credentials. We do not want unauthorized users joining devices to our network.
## Policy
* • MFA Shall be required to enroll devices into Intune
## Licensing Considerations
This setting requires at least an Azure AD P1 license which comes standalone or as part of the following bundles:
* EMS+E3/E5
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set-Up Instructions
[Require multifactor authentication for Intune device enrollment - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/MEM/intune/enrollment/multi-factor-authentication#configure-intune-to-require-multifactor-authentication-at-device-enrollment)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Users must satisfy the MFA prompt in order to be able to successfully enroll a device. For users signing in for the very first time who have not configured MFA methods, a temporary access pass can be used: [Configure a Temporary Access Pass in Azure AD to register Passwordless authentication methods - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-temporary-access-pass)
{% hint style="info" %}
Tips
For users signing in for the very first time who have not configured MFA methods, a temporary access pass can be used: [Configure a Temporary Access Pass in Azure AD to register Passwordless authentication methods - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-temporary-access-pass)
{% endhint %}
## PowerShell Scripts
[azure-ad-conditional-access-apis/readme.md at main · Azure-Samples/azure-ad-conditional-access-apis (github.com)](https://github.com/Azure-Samples/azure-ad-conditional-access-apis/blob/main/01-configure/powershell/readme.md)
## Videos
{% embed url="" %}
# Security Baselines should be configured for Windows Devices
## Description
Security baselines in Intune are pre-configured groups of settings that are best practice recommendations from the relevant Microsoft security teams for the product. Intune supports security baselines for Windows 10/11 device settings, Microsoft Edge, Microsoft Defender for Endpoint Protection, and more.
You can use security baselines to rapidly deploy a *best practice* configuration of device and application settings to protect your users and devices. Security baselines are supported for devices that run Windows 10 version 1809 and later, and Windows 11. These baselines allow you to configure common security settings such as:
* Password Requirements
* Lock screen settings
* App Installation
## Policy
* Security Baselines should be configured for Windows Devices
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
Its possible that some of the settings pre-configured as part of the security baseline profile will be disruptive to end-users. As a best practice, proper testing should be done leveraging a device on the corporate network and testing this out with a pilot group of users before broad deployment.
{% hint style="info" %}
Tips
Security baselines are one of several methods in Intune to configure settings on devices. When managing settings, it's important to understand what other methods are in use in your environment that can configure your devices so you can avoid conflicts. See [Avoid policy conflicts](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security#avoid-policy-conflicts) later in this article.
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/EndpointSecurity at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/EndpointSecurity)
[Creating Endpoint Security Policies with PowerShell | Powers Hell (powers-hell.com)](https://powers-hell.com/2020/04/21/creating-endpoint-security-policies-with-powershell/)
## Videos
{% embed url="" %}
{% embed url="" %}
# Windows Update Rings shall be configured for Windows Devices
## Description
Windows update rings, also known as Windows Update for Business allow you to manage the patch cycle across Windows devices in your organization.
Updates should be staggered across devices in your organization in order to manage any new features or bugs as part of the new update. Critical updates should be deployed immediately to all devices leveraging the Windows update ring service.
If you are an enterprise customer, [Windows Autopatch](https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/overview/windows-autopatch-overview) is another feature that can automate your deployment of Windows update rings.
## Policy
* Windows update rings are configured and assigned to all windows devices
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
OS Requirements: [Configure Update rings for Windows 10 and later policy in Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings#prerequisites)
Windows Autopatch Prerequisites: [Prerequisites - Windows Deployment | Microsoft Learn](https://learn.microsoft.com/en-us/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites)
## Set-Up Instructions
[Configure Update rings for Windows 10 and later policy in Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/windows-10-update-rings#create-and-assign-update-rings)
## End-User Impact
{% hint style="info" %}
Level: Medium- High
{% endhint %}
Patching has always been notorious for being disruptive to end-users. When you configure the Windows update rings, you can define specific time periods where updates will try to be deployed. This is typically in the after hours of business. You can also decide how long end-users can defer updates before they are forced to install them. There will always be use cases where you also have to uninstall updates due to those updates having bugs or disrupting some type of line of business application.
{% hint style="info" %}
Tips
Have a defined process in place for when you need to roll back updates or when you need to push out critical updates to all devices.
In your broad deployment, make sure the quality or deferred updates are pushed out at least 14 days to avoid more frequent rollbacks.
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/SoftwareUpdates at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/SoftwareUpdates)
## Videos
{% embed url="" %}
{% embed url="" %}
# Update Policies shall be configured for Apple Devices
## Description
You can use Microsoft Intune to manage software updates for macOS, iOS, and iPad devices that enrolled as [supervised devices](https://learn.microsoft.com/en-us/mem/intune/enrollment/macos-enroll#user-approved-enrollment). Just like the Windows update rings in the previous section, we can leverage these policies to manage the patch cycle on Apple devices enrolled into Intune.
## Policy
* Update policies are configured for macOS, iOS, and iPad Devices
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Use Microsoft Intune policies to manage macOS software updates | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos#configure-the-policy)
[Use Microsoft Intune policies to manage iOS/iPadOS software updates | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-ios#configure-the-policy)
## End-User Impact
{% hint style="info" %}
Level: Medium- High
{% endhint %}
Patching has always been notorious for being disruptive to end-users. When you configure the update policies, you can define specific time periods where updates will try to be deployed. This is typically in the after hours of business. When you use update policies for macOS, you might want to hide updates from users of supervised macOS devices for a period of time. You can accomplish this with a settings catalog policy for macOS devices that configure update restriction periods. You can follow these instructions to configure these settings: [Use Microsoft Intune policies to manage macOS software updates | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/software-updates-macos#delay-visibility-of-updates)" %}
# App Protection policies should be created for mobile devices
## Description
Leveraging the mobile application management (MAM) features of Microsoft Intune, app protection policies can be created so that users can access corporate applications on mobile devices securely, without having to enroll that device into the MDM solution. These settings allow you to place additional protection on applications such as requiring a pin or preventing cut, copy, and paste to unmanaged applications. App protection policies should be configured for iOS and Android devices.
## Policy
* App protection policies are configured for iOS and Android devices
## Licensing Considerations
Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Create and deploy app protection policies - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policies#create-an-iosipados-or-android-app-protection-policy)
[Android app protection policy settings - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-android)
[iOS/iPadOS app protection policy settings - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
When users go to access corporate data on a managed application like Outlook, they will receive a prompt that the devices is under corporate management. Depending on what settings are configured in the policy they might also have to a take additional action such as setting up an application pin." %}
{% embed url="" %}
{% embed url="" %}
# Mobile devices shall only be able to access corporate data through approved client apps
## Description
Conditional Access policies can be set up to only allow access to corporate data on [client approved apps.](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-grant#require-approved-client-app) This setting would prevent a user from leveraging the native mail client on their mobile application. A client that you are not able to control or wipe if they leave the organization.
## Policy
* Mobile devices shall only be able to access corporate data through approved client apps
## Licensing Considerations
This setting requires at least an Azure AD P1 license which comes standalone or as part of the following bundles:
* EMS+E3/E5
* Microsoft 365 Business Premium
* Microsoft 365 E3
* Microsoft 365 E5
## Set-Up Instructions
1. Follow the steps [outlined here](https://tminus365com-my.sharepoint.com/personal/msp4msps_tminus365_com/Documents/Project%20Capsule/Mobile%20devices%20shall%20only%20be%20able%20to%20access%20corporate%20data%20through%20approved%20client%20apps) to create a conditional access policy that requires approved client apps for mobile devices.
2. In the Access Controls, only select the Required Approved Client App settingsMedium
{% endhint %}
If a user goes to access corporate data on an unapproved client app, like the native mail app on the mobile device, they will be redirected to the Apple Store or Google Play store to download the approved client app (in this case, Outlook)." %}
# Lockout screen and password settings shall be configured for each device
## Description
Lockout screen timeouts should be configured for a certain number of minutes of activity for all device platforms. Password complexity requirements should be enforced and users should be prompted to change their password if it does not meet corporate requirements. In Intune, the location to configure these settings varies depending on the platform.
**Windows**: Security Baselines (Device Lock, Local Policies Security Options), Configuration Profiles (Device Restrictions: Password)
**macOS**: Compliance Policy (System Security)
**iOS**: Compliance Policy (System Security)
**Android**: Compliance Policy (System Security)
## Policy
* All supported devices have configuration settings defined/enforced for lockout screen timeouts and passwords
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
Windows Security Baselines: [Create security baseline profiles in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/security-baselines-configure#create-the-profile)
1. Under Device Lock set the password requirements
2. Under Local Policies Security Options, Set the Minutes of lock screen inactivity until screen save activates policy
macOS Compliancy Policy: [macOS device compliance settings in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-mac-os)
1. Under System Security, modify the Password requirements and minutes of inactivity before password required
iOS Compliancy Policy: [iOS/iPadOS device compliance settings in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios)
1. Under System Security, modify the Password requirements and minutes of inactivity before password required
Android Compliancy Policy: [Android Enterprise compliance settings in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android-for-work)
1. Under System Security, modify the Password requirements and minutes of inactivity before password required
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
End users who enroll devices into Intune after this policy is enforced may be prompted to update their password if the policy requirements are not met on the device." %}
{% embed url="" %}
# Encryption shall be required on all devices
## Description
Disk encryption shall be configured on all corporate owned devices. Encryption of corporate data should also be configured at an application layer where applicable. In the Endpoint Manager Admin center, there is multiple locations to configure device encryption:
**Endpoint Security>Disk Encryption**: Allows you to configure encryption settings for FileVault (macOS) and Bitlocker (Windows).
**Configuration Profiles**: Endpoint Protection (Windows Encryption, FileVault), Device Restrictions (iOS, Android)
**App Protection Policies** (For application data encryption): iOS and Android
## Policy
* Disk encryption shall be required on all devices
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
Disk Encryption: [Manage disk encryption with endpoint security policies in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-disk-encryption-policy)
Configuration Profiles: [Configure Endpoint protection settings in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-protection-configure#create-a-device-profile-containing-endpoint-protection-settings)
App Protection Policies:
* [iOS/iPadOS app protection policy settings - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios)
* [Android app protection policy settings - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-android)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
If configured correctly, the end user should have no interaction with configuring encryption on the device. Leveraging configuration profiles or disk encryption settings should automatically configure the device encryption. There could be a use case where the configuration fails and the end user is prompted to fix on their device." %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Windows Hello for Business should be configured where applicable
## Description
For Windows 10/11 devices, use of Windows Hello for Business replaces the use of passwords with strong two-factor authentication on devices. This authentication consists of a user credential that’s tied to a device and uses a biometric or PIN.
## Policy
* Windows Hello for Business should be configured where applicable
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
Configure Windows Hello at the time of enrollment: [Configure a tenant-wide Windows Hello for Business policy with Microsoft Intune - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/windows-hello)
Configure Windows Hello after device enrollment: [Deploy policy for Windows Hello to groups of Windows 10 and Windows 11 devices in Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/protect/identity-protection-configure)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
Users will be prompted to set up facial recognition or fingerprint depending on the device. Users will also be asked to establish a pin in case that biometric authentication fails or cannot be accessed.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/DeviceConfiguration at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/DeviceConfiguration)
## Videos
{% embed url="" %}
{% embed url="" %}
# Authorized Applications should be deployed to managed devices
## Description
An authorized application inventory should be kept for corporate approved applications. These applications should be packaged and deployed in Microsoft Intune from the applications section of the Intune Admin Center. The application lifecycle should be maintained through Intune, including the patch cycle.
## Policy
* Authorized Applications should be deployed to managed devices
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Add Microsoft Store apps to Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/store-apps-microsoft)
## End-User Impact
{% hint style="info" %}
Level: Low
{% endhint %}
This will vary depending on the applications you are pushing out. The installation package you define will determine if the application will install automatically or provide the option to the user to install the application.
{% hint style="info" %}
Tips
• Leverage packaging tools like Winget and Chocolatey to help automate the app packaging and deployment.
{% endhint %}
## PowerShell Scripts
[powershell-intune-samples/Applications at master · microsoftgraph/powershell-intune-samples (github.com)](https://github.com/microsoftgraph/powershell-intune-samples/tree/master/Applications)
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Device Use Shall be restricted until required applications are installed
## Description
When a user is first onboarding to a new device, required applications, such as your AV or Endpoint protection software, should be allowed to install before the user begins to access the device. This setting can be configured as part of the enrollment status page for people enrolling Windows devices and signing in for the first time.
## Policy
* Device Use Shall be restricted until required applications are installed
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Set up the Enrollment Status Page in the admin center - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-status)
[Selecting Required Apps for your Enrollment Status Page - Microsoft Community Hub](https://techcommunity.microsoft.com/t5/intune-customer-success/selecting-required-apps-for-your-enrollment-status-page/ba-p/2200381)
## End-User Impact
{% hint style="info" %}
Level: Medium
{% endhint %}
This will vary depending on the applications being installed. Its possible the user will have to wait some time for the applications to finish installing. For this reason, its best to define the minimum blocking applications as part of the settings and not make this the full list that will be installed.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# Devices and Applications shall be wiped when a user leaves the organization or reports a lost/stolen
## Description
Standard operating procedures should be put into place to remotely wipe devices and applications when a user leaves the organization or a device is lost or stolen.
## Policy
* Devices and Applications shall be wiped when a user leaves the organization or reports a lost/stolen device
## Licensing Considerations
• Any tenant with Intune licensing can access this setting.
## Set-Up Instructions
[Retire or wipe devices using Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/remote-actions/devices-wipe)
[How to wipe only corporate data from apps - Microsoft Intune | Microsoft Learn](https://learn.microsoft.com/en-us/mem/intune/apps/apps-selective-wipe)
## End-User Impact
{% hint style="info" %}
Level: None
{% endhint %}
There should be no user impact here unless the actions to remotely wipe a device or application is done in error where the user should not have had that action performed against their device.
{% hint style="info" %}
Tips
None Currently
{% endhint %}
## PowerShell Scripts
None Currently
## Videos
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
{% embed url="" %}
# GDAP
GDAP stands for Granular Delegated Admin Privileges and is Microsoft latest version of delegated administration of Microsoft tenants. Check out my blog Post for helpful information on getting up to speed with GDAP:
{% embed url="
### Why do my automations break?
Accessing tenants as a Microsoft partner has traditionally been done with Delegated Access Permissions or DAP. DAP provides you Global Administrator access to all of the downstream tenants. Whenever you set up an app registration using the Secure Application model, you would add that service principal to the Admin Agents group in Partner Center. By doing so, you were able to generate refresh tokens and access tokens into all of your customer environments. We have been leveraging this model for years now to create automation workflows. This model of consent is known as a “pre-consent” since there were no additional steps you needed to take in order to leverage the app registration in these tenants.
Shifting to GDAP, the core benefit is the additional layers of security provided to help protect yourself and your downstream customers against supply chain attacks. As part of the shift to this new model, the “pre-consent” concept is no longer in play. We now need to take additional steps to consent for applications in our downstream customer tenants. The good news is that this can still be done in bulk using an “on-behalf of” consent model, meaning you do not need to grant consent to your application registration on a per customer basis. The bad news is that it now requires many more additional steps and gets confusing. Hence this article 😊
Timelines As of the writing of this article 5/4/2023, Microsoft states that will begin auto-transitioning relationships to GDAP starting May 22, 2023. If this timeline holds true, this is when I believe many people will be reading this article, as their automations will stop working. Get ahead of this now!
### The Steps:
**Create a Service Account for Automations**
The first thing we want to do is set up a new service account for our automations. I think it is important to have a dedicated account here so that nothing breaks over time if you have users leaving your organization. As a best practice, do not use a regular user account for your automations. Here are some requirements for this service account:
1. They need to be a Global Administrator initially. We will need this service account to have the GA role when we acquire access tokens in future steps. This user does not need to have perpetual GA rights so it is recommended to leverage [Privileged Identity Management (PIM)](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) so that you can make this user eligible for the role when you need it and reduce your attack surface.
2. This user requires MFA. This can be enforced through Conditional Access or Per User MFA settings. This MFA has to be with Microsoft and cannot be from a 3rd party like Duo
3. This user needs to be added to the Admin Agents group in Azure AD
In this example, I made a user called Automations:
.
Note that you will need to be signed in as a Global Admin in order to perform this operation. The permissions shown below are just an example, you will likely have many more Microsoft Graph permissions.
**Configuring GDAP Relationships**
Another prerequisite for this working is that you have added a GDAP relationship for all of your customers. The roles scoped as part of those relationships is very important. There are two major concepts that you have to consider:
1. In order to leverage the on-behalf consent model to grant our application rights into our downstream customer environments, we need the relationship to have one of the following roles:
1. Global Admin
2. Privilege Role Admin
3. Cloud Application Admin
2. Additionally, in order to make specific API calls, the GDAP relationship needs to include roles that would encompass those permissions. i.e. if you added a permission to your app registration to read configuration profiles in Intune, you would need the Intune Administrator role as part of the GDAP relationship.
The other key step we need to take with our GDAP relationships, is to assign a Security group for the GDAP relationship that includes the service account we created in the first step as a member. In my use case, I created a group called GDAP\_SG1 and added my service account as a member:
### Why do my integration break?
Accessing tenants as a Microsoft partner has traditionally been done with Delegated Access Permissions or DAP. DAP provides you Global Administrator access to all of the downstream tenants. Whenever you set up an app registration using the Secure Application model, you would add that service principal to the Admin Agents group in Partner Center. By doing so, you were able to generate refresh tokens and access tokens into all of your customer environments. We have been leveraging this model for years now to create automation workflows. This model of consent is known as a “pre-consent” since there were no additional steps you needed to take in order to leverage the app registration in these tenants.
Shifting to GDAP, the core benefit is the additional layers of security provided to help protect yourself and your downstream customers against supply chain attacks. As part of the shift to this new model, the “pre-consent” concept is no longer in play. We now need to take additional steps to consent for applications in our downstream customer tenants. The good news is that this can still be done in bulk using an “on-behalf of” consent model, meaning you do not need to grant consent to your application registration on a per customer basis. The bad news is that it now requires many more additional steps and gets confusing. Hence this article 😊
### MSP/Partner Prerequisite Steps
Here I will outline what you need to direct the MSP/Partner to do in their own environment in order for your integration to support GDAP.
**Create a Service Account for the Integration**
The first thing to do is set up a new service account for your integration. The format could be something like \@mspdomain.com. I think it is important to have a dedicated account here so that nothing breaks over time if you have users leaving the partner organization. As a best practice, do not use a regular user account for your integrations. Here are some requirements for this service account:
1. They need to be a Global Administrator initially. We will need this service account to have the GA role when we acquire access tokens in future steps. This user does not need to have perpetual GA rights so it is recommended to leverage [Privileged Identity Management (PIM)](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started) so that you can make this user eligible for the role when you need it and reduce your attack surface.
2. This user requires MFA. This can be enforced through Conditional Access or Per User MFA settings. This MFA has to be with Microsoft and cannot be from a 3rd party like Duo
3. This user needs to be added to the Admin Agents group in Azure AD
Important! If possible, direct the MSP to leverage a documentation tool like IT Glue or Hudu to store the MFA token and password for this user so that it can be accessed by more than one person if needed.
**Configuring GDAP Relationships**
Another prerequisite is that the partner has added a GDAP relationship for all of their customers.
If you are not familiar with GDAP, check out my other blog post:
* [What is GDAP](https://tminus365.com/granular-delegated-admin-privileges/)
* [GDAP Checklist](https://tminus365.com/our-experience-moving-to-gdap-gdap-checklist/)
* [Leveraging PIM with GDAP](https://tminus365.com/leveraging-pim-with-gdap/)
The roles scoped as part of those relationships is very important. There are two major concepts that you have to consider:
1. In order to leverage the on-behalf consent model to grant your application rights to downstream customer environments, we need the relationship to have one of the following Azure AD roles:
1. Global Admin
2. Privilege Role Admin
3. Cloud Application Admin
2. Additionally, in order to make specific API calls, the GDAP relationship needs to include roles that would encompass those permissions. i.e. if you added a permission for your integration to read configuration profiles in Intune, you would need the Intune Administrator role as part of the GDAP relationship.
This means you need to direct the MSP/Partner for the roles that they need to have as part of their GDAP relationships with customers.
The other key step partners need to take with GDAP relationships is to assign a Security group for the GDAP relationship that includes the service account we created in the first step as a member. The partner could create a Security group specific to your integration or they could leverage an existing security group. In my use case, I created a group called GDAP\_SG1 and added my service account as a member:
. You can chose whatever you like here, just know that the same name cannot be used more than once in your tenant.
The duration has a maximum for two years but you may want to establish short term relationships for things like contract work.
I think selecting the Azure AD roles is where GDAP can start to get overwhelming since you’ve never likely gone this granular in SMB. As an MSP, you are not going to want to set up a relationship, only to figure out you didn’t add all the necessary permissions to be able to support the customer. I will be doing a separate article with recommendations here as there is a lot to consider.
You can select the roles from the pop-out window.
When you are done selecting roles, you can select Save at the bottom of the pop-up and choose Finalize Request. A template email is generated with a custom invitation link and a description of the duration and roles. This link is what the customer has to accept. It requires a Global Admin in the customer tenant to approve the request.
When a customer uses the link as a Global Admin they will see the following:
In the Settings>Partner Relationships section for this customer tenant, you will see the following after refresh
Keep in mind! GDAP relationships can only be used for 1 customer. If you try to use the same link generated for another customers after one has accepted, it will fail.
### Add Security Groups to GDAP relationship
Its important to note that the customer accepting the GDAP link is not the end of the process. You will now need to go in and assign security groups to that relationship in Partner Center.
You can go to the customer page for the customers that have accepted GDAP relationships and click on Admin relationships to view existing GDAP configurations.
Here you can click on the + Add Security Group to bring up a popup of your existing security groups to choose from. If you need to create new security groups, you will need to do that in the AAD.portal.azure.com portal. After you have selected a SG, you can then add one or many of the AAD roles that were part of the relaitonship
### Final Thoughts
**GDAP takes precedence over DAP**
Don’t make the mistake of locking yourself out of certain admin centers because you are testing GDAP.
**Transition from DAP to GDAP**
Microsoft has a bulk migration tool available now till the end of November. The guys over at CIPP have also developed a migration tool as well. Check out [this post](https://tminus365.com/gdap-bulk-migration-demo-cipp-vs-microsoft/) to see more information.
# Leveraging PIM with GDAP
In my [previous blog post,](https://tminus365.com/what-roles-should-i-add-for-gdap/) I talked about the major considerations when adding roles for GDAP relationships. In some instances, you may want to bump up security a step further and pair GDAP with PIM or privileged identity management. This would allow you to have just in time access to customer workloads for users in your organization vs perpetual access. In this article, I would be showing you how to set that up for security groups within your Azure AD environment.
### Prerequisites
An Active Azure AD P2 subscription
I’ve mentioned this before, but PIM comes with Azure AD P2 licensing which is [being offered for free](https://docs.microsoft.com/en-us/partner-center/announcements/2021-october#12) for a year for indirect resellers. This is a great time to test out PIM within your organization to help promote a model of least privilege access.
### Steps:
1. Set up a security group with Azure AD Role Assignment
2. Enable Privileged Access on the Group
3. Add Eligible Assignments
4. Add Security Groups to GDAP Workloads
5. Test user activating membership
### Set up a security group with Azure AD Role assignment
The first thing we need to do is establish a security group with Azure AD Role assignments. This type of group then becomes eligible to be used with PIM to add “eligible” members.
Create a new security group and toggle Azure AD Roles to Yes. The group does not need to be assigned any owners, members, or roles to be created. Its possible/likely you will leave these blank and yes perform the next step of adding eligible members.
### Enable Privileged Access on the Group
Next we will enable privileged access on the group. Click into the group from the group blade. Select Privileged Access and click Enabled Privileged Access
### Add Eligible Assignments
After you click on Enabled Privileged Access, you get the chance to add permanent(Active) or eligible assignments. Eligible means that users can activate this membership for a specified period of time. Click the Eligible tab and click Add Assignments.
From the dropdown, select member and then add the applicable members to the group that could become eligible. These would be members in your Partner Center access those specific workloads for a customer (Global Reader, Exchange, SharePoint, etc.)
After you select the members, you will be able to select the duration of eligibility. The max value is one year and you can set this to be less time
### Add Security Groups to GDAP Workloads
Now that we have our security group created, we need to assign the group to a workload established from a GDAP relationship. This step assumes you have already created that relationship. If you are not familiar with how to establish relationships, [check out my previous article](https://tminus365.com/adding-gdap-relationships/).
In Partner Center, select Customers>Administer>Select Single customer
Select One of your existing GDAP relationships
Click Add Security Groups. Select your recently created security group and click next.
Select the appropriate roles based on the workload you want the security group to have access to. In this example, I made the security group Global Readers, so I am going to grant that role. After you save, the status will go from pending to Active after about 30 seconds (may require page refresh)
### Test user activating membership
Now that we have our PIM Group established and assigned to a workload, we can now test a user activating their temporary membership.
Sign in to [aad.portal.azure.com](http://aad.portal.azure.com/) with a user you added as an eligible member. From the left nav, select All Services and Search or select Azure AD Privileged Identity Management
From the main page, select My Roles
Select Privileged Access Groups and click Activate to activate the membership
Add the number of hours you will need membership and add a reason for activation. This is great to have as an audit trail for compliance.
Once you activate, Azure AD will automatically walk through steps to activate the membership and refresh your session
You will see on the Active Assignments tab that the membership is active. This also includes the end time and ability to deactivate.
Since that the membership is active, you can test your access via Partner Center. Go to Customers>Administer>Expand the Customer you added the Security group to
The workloads you see here should be reflective of what roles you gave to the security group in the previous section. In this example we gave Global Reader rights. This means we could test going into the M365 Admin Center>Clicking into Users and then being able to view users but not create them. If you did something more specific, like assigning the Exchange Admin role to the security group, the only workload you should be seeing is exchange.
### Bonus: More Granular Settings for the Group Membership
We covered the basics above when it comes to creating eligible memberships with groups and PIM. What if you wanted to require approval to activate the membership? What if you wanted to define the maximum duration someone could be eligible vs the 8hr default? What if you wanted to prompt the user for MFA when they try to activate membership? This is all possible from the management section of PIM.
In the Azure AD Portal, go back to Azure AD Privileged identity Management from All Services. Select Privileged access groups and select the security group you made in the previous sections.
Under Manage, select Settings.
Click Member. From here you will be able to select all of the granular settings when it comes to this eligible membership.
### Final Thoughts
I hope that this article provided more targeted guidance on setting up PIM security groups that get assigned to GDAP workloads. I believe that PIM should be put into place for higher levels of permissions into customer environments like the Global Reader role that I showed in the example here. You want your techs to access customer environments securely but you also don’t want to lock things down so much that it becomes a huge pain to perform any investigation or administration. For this reason, you may add techs that constantly access these portals to a perpetual security group and then add techs that do not often need access to the eligible membership assignment.
# GDAP Migration with Microsoft 365 Lighthouse
A few months ago, I [published a video](https://tminus365.com/gdap-bulk-migration-demo-cipp-vs-microsoft/) showcasing a comparison of the GDAP migration tools available. Since that time, the Microsoft 365 Lighthouse team has introduced a new migration tool for GDAP to help partners streamline the move, in bulk, across customers. If you watched my previous comparison video, you saw how clunky the old solution was using a CLI and CSVs. The lighthouse team has been working behind the scenes to create a tool that is much more user friendly and catered to the MSP space. In this article, I will be covering key highlights of the tool and giving you an overall comparison when it comes to this tool, CIPP, and the previous bulk migration tool.
### GDAP Timelines
A couple of key dates are coming up which increases the urgency of you adopting a bulk migration tool for GDAP if you have not already.
Starting January 17, 2023
* Microsoft will stop creating DAP relationships when a new customer or reseller relationship is created.
* Microsoft will start removing inactive DAP relationships that haven’t been used in 90 days.
Starting March 1, 2023
* The Bulk Migration Tool to upgrade existing DAP connections that were granted by customers to GDAP will no longer be available.
* Microsoft will begin to transition remaining active DAP relationships to GDAP with limited Azure Active Directory (Azure AD) roles to perform least-privilege customer management activities. Partners will be required to perform more steps to continue to have access to Azure subscriptions after the limited roles are granted, as documented.
**A key piece to note here is that the new Lighthouse migration tool will STILL be available after March 1st.** The main difference is that you will not be able to automatically transition your active DAP relationships to GDAP. After the March 1st date, if you use the tool, you will get a GDAP relationship link per tenant that you will manually need to accept on a per customer basis. You will want to avoid that to save some time on the initial move.
### Prerequisites
* To run the tool, you need to be a Global Admin
* There are no customer eligibility requirements. A tenant with any type of licensing will be available to select from in the tool.
* AAD P2 licensing is required to use the JIT features/functionality
* Documentation for this tool can be found here: [Set up GDAP for your customers – Microsoft 365 Lighthouse | Microsoft Learn](https://learn.microsoft.com/en-us/microsoft-365/lighthouse/m365-lighthouse-setup-gdap?wt.mc_id=365admincsh_lighthouse\&view=o365-worldwide)
### Using the Tool
In the wizard, you get predefined tiers that are recommendations on partitioning out the various Azure AD roles within your organization. I believe this is one of the best parts of the tool. You are able to rename the tiers to better match your organization and unselect some of the recommendations if it is an Azure AD role you are not going to use.
Next, you are able to create GDAP templates and apply one to many tiers to those templates. For our MSP, we use two templates, License Only and Managed Services, to bucketize our permissions. Our license only customers require significantly less permissions than our managed service customers
Security Group creation is next. You will be creating a new security group for at least each tier you want to use in your environment. The wizard steps you through each of your templates so you can associate the proper security groups. In the example I show below, we also see some additional settings for the **JIT** tier. Just-in-time access is much like PIM but it allows you to have even more security for higher privileged roles like Global Admins, Application Admins, etc. I believe that a JIT/PIM solution is very important to combine with GDAP. Behind the scenes, Lighthouse will create an **Access Package** in your Azure AD environment with the settings you define in this wizard
The final section is associating your templates to one or many customers
Once you are done, you will get a summary to review and then a status page with the customers that have successfully added a GDAP relationship
If you go into Partner Center and search for one of the companies you set up a relationship for, you will see the GDAP relationship listed under the Admin Relationships section
### Comparison
This diagram is a bit biased towards Lighthouse but I do believe it offers the most comprehensive solution for a migration tool.
* Templates can be created in the bulk migration tool but it is manual with CSVs
* Group Creation is done in both CIPP and Lighthouse but in CIPP you are creating one group per Azure AD role. This can make things a little messy in your tenant from the amount of groups that you are creating. Lighthouse allows you to consolidate those groups and reuse them across templates/roles
* Suggested roles is the #1 feature of Lighthouse in my opinion
* Native PIM/JIT support is only available in Lighthouse. You can do this with the bulk migration tool,but you would have to manually set up the JIT/PIM groups as a prerequisite
* CIPP and Lighthouse are both very easy to use
### Conclusion
If you haven’t started the move to GDAP today, I would highly recommend leveraging the Lighthouse migration tool. I had the privilege of working with the Lighthouse team during earlier phases of the rollout and was very happy to see their level of attention to the MSP space. They are also working on functionality that will provide for the longer-term management of GDAP relationships which I am very excited about.
# GoDaddy
" %}
**SUMMARY AND BACKGROUND**
Customers can purchase a Microsoft 365 subscription direct with GoDaddy along with their primary domain. When this occurs, GoDaddy federates this domain and tenant, making it unable to transfer under the CSP program or Direct to Microsoft. Moving and defederating this account has been a major pain point and area of confusion which this blog post addresses.
In the solutions proposed in this guide you can perform the following:
* Defederate the tenant without migrating
* Never have to call GoDaddy
* Keep user accounts vs deleting them
* Have no downtime
High level-steps:
A. Prepare your End Users
B. Become a Tenant Admin in GoDaddy
C. Remove Federation with GoDaddy
D. Reset Users Passwords
E. Add a CSP Provider or Move Direct to Microsoft
F. Provision Licensing into the Account
G. Remove GoDaddy as Delegated Admin
H. Cancel GoDaddy Subscription
### Prepare Your End Users
* Defederating requires users to reset their passwords in order to be able to login to their account. You will need to have a password list to distribute to them or have them provide you passwords beforehand. You could just reset them all to a temporary password after federation and then they can change to whatever they want after.
* Define a date and time in which you will be defederating. I recommend during non-business hours even though there is no downtime in mail flow with this solution. Provide end users with this information.
* Since users may run into activation prompts within their office apps and outlook during the license transition, provide them documentation for how to sign back in after the license switch has taken place. For office apps they can simply go to File>Account>Sign Out>Sign In.
* In outlook, users will be prompted to re-enter their new password after its changed:
" -Authentication Managed
```
An example of a DomainId is “tminus365.com”. This would be the domain that was listed as federated that you want to covert to managed. After this is complete you will get a new commandline. You can run Get-MgDomain again and see that your domain is now “managed”.
Please Note ALL domains in the tenant need to be in a managed state for this to work correctly even if one is no longer in use.
Supporting CMDLET docs:
* Get Started: [Get started with the Microsoft Graph PowerShell SDK | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/microsoftgraph/get-started?view=graph-powershell-1.0)
* Get Domain: [Get-MgDomain (Microsoft.Graph.Identity.DirectoryManagement) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgdomain?view=graph-powershell-1.0)
* Update Domain: [Update-MgDomain (Microsoft.Graph.Identity.DirectoryManagement) | Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/update-mgdomain?view=graph-powershell-1.0)
### Reset Users Password
You can do this manually one user at a time if there aren’t many users in the account or you could use a powershell script to bulk update everyone passwords form a CSV file. If you plan to do them manually, then you can simply login to office.com as the admin we derived from section B and now that the tenant is defederated, you will be able to click into the admin tile and access the Users section like you are familiar with. Otherwise, you can connect to Powershell as administrator and run the powershell script below:
```
##########Connect to MsGraph##########
```
```
Write-Host "Checking for MSGraph module..."
$Module = Get-Module -Name "Microsoft.Graph.Users.Actionst" -ListAvailable
if ($Module -eq $null) {
Write-Host "MSGraph module not found, installing MSGraph"
Install-Module -name Microsoft.Graph.Users.Actions
}
Connect-MgGraph
#Enter the Admin credentials from "Become a tenant Admin in GoDaddy"
############# Define CSV path of Users and Group ##################
$UserPath = Read-Host -Prompt "Enter File Path For CSV list of users"
#####Create CSV template with headers of Userprincipalname and Password#######
Import-Csv -Path $UserPath |%{Update-MgUserPassword -UserId $_.UserPrincipalName –NewPassword $_.Password}
```
### Add a new Provider and Provision Licensing
Now that the tenant is defederated, you can add a CSP provider with their delegated admin link or go direct to Microsoft.
For CSP:
Paste the appropriate link in a browser and sign into the tenant with the Global Admin credentials if you are not already logged in. Accept the relationship. After the acceptance, reload the page and you will see a new CSP listed.
Order licensing for this customer. If you are not changing the subscription, then all you would need to do is provision the same amount of seats as you have today, remove them as delegated admin, and cancel with GoDaddy. There is no other action that would be required. License ownership would transfer and there will be no downtime for users.
If you are changing the subscriptions that are assigned to users (i.e. you are moving them from Business Standard to Business Premium as an example) you will need to perform the following steps:
1. Order the licensing from CSP
2. See the licensing provisioned in the 365 Tenant for this customer under Billing>Your Products
3. Go to Users>Active Users and bulk assign the new licensing from CSP and unassign the licensing from GoDadddy.
4. Remove GoDaddy as Delegated admin
5. Cancel the GoDaddy subscription in the GoDaddy admin portal.
For Microsoft Direct:
1. In the [Microsoft Admin Portal](https://admin.microsoft.com/), go to Billing>Purchase Services
2. Purchase the licensing you want to have for your users
3. Follow the same steps as CSP to Assign licenses to users if you have changed their subscription type. (i.e. Moving from Business Standard to Business Premium).
### Remove GoDaddy as Delegated Admin and Cancel Subscription
Warning! If you do not follow the steps to remove GoDaddy as a delegated admin before you cancel with them, they will run a script to delete all users in the account and remove the primary domain. You need to ensure you remove them as delegated admin after the move and ensure that their admin user is deleted in the account BEFORE cancelling the subscription. This action is recoverable, but it causes you to have to perform more work and it does involve downtime. If you would like to never have any concerns of this issue with additional safeguards, you should look at a solution that migrates to a new tenant in addition to defederation.
In the 365 Admin Portal
Under Settings>Partner Relationships>Click on GoDaddy and remove their roles:
" %}
# CIS Mapped to M365
**Introducing the Comprehensive Security Baselines Guide mapped to CIS Controls**
Are you looking to take your organization's cybersecurity to the next level? When the Cybersecurity & Infrastructure Security Agency (CISA) released the [Secure Cloud Business Applications (SCuBA) project](https://www.cisa.gov/sites/default/files/publications/FINAL-CSSO_SCuBA_Fact_Sheet.pdf), I was thrilled. However, I quickly realized that I needed more than just a checklist to truly implement robust security measures.
That's why I took it upon myself to create the ultimate guide for securing your Azure AD, Teams, Exchange, SharePoint, OneDrive, and Intune environments. The result is the docs that you can find in the [Security](/security/azure-ad-entra) section of this repository.
I'm also have a premium version of the guide, packed with additional valuable resources:
1. Mapping to Industry Standards: Get a clear understanding of how the suggested policies align with widely recognized cybersecurity frameworks such as the **CIS Controls and CIS Benchmarks.** This invaluable feature helps you connect the dots and ensures compliance with industry standards. Example Matrix: