What CIS Microsoft 365 Foundations v6.0.0 is
The Center for Internet Security’s Microsoft 365 Foundations Benchmark, version 6.0.0: each check is mapped to the recommendation it evidences, by number.
Who asks for it: Anyone hardening Microsoft 365 to the CIS benchmark.
What Microsoft 365 can show
Of the 140 recommendations in CIS Microsoft 365 Foundations v6.0.0, ConfigCheckup checks 107 in full (76%), 5 in part, and 28 not at all. A check covers a recommendation in full when it reads the setting the recommendation names and applies its test, so it never passes a tenant the recommendation would fail. In part means it reads a different signal, applies a weaker threshold or tests one step of several.
| Section | Recommendations | In full | In part | Not checked |
|---|---|---|---|---|
| 1 Microsoft 365 admin center | 15 | 13 | 1 | 1 |
| 2 Microsoft 365 Defender | 20 | 16 | 2 | 2 |
| 3 Microsoft Purview | 4 | 4 | 0 | 0 |
| 4 Microsoft Intune admin center | 2 | 2 | 0 | 0 |
| 5 Microsoft Entra admin center | 45 | 39 | 1 | 5 |
| 6 Exchange admin center | 12 | 12 | 0 | 0 |
| 7 SharePoint admin center | 13 | 5 | 0 | 8 |
| 8 Microsoft Teams admin center | 17 | 16 | 1 | 0 |
| 9 Microsoft Fabric (Power BI) | 12 | 0 | 0 | 12 |
The 28 recommendations no check covers
Each one stays on this list until a check covers it, in full or in part, and is counted above as not checked.
- 1.3.8 Ensure that Sways cannot be shared with people outside of your organisation (manual in CIS)
- 2.2.1 Ensure emergency access account activity is monitored (manual in CIS)
- 2.4.3 Ensure Microsoft Defender for Cloud Apps is enabled and configured (manual in CIS)
- 5.1.2.1 Ensure 'Per-user MFA' is disabled
- 5.1.2.4 Ensure access to the Entra admin center is restricted (manual in CIS)
- 5.1.2.5 Ensure the option to remain signed in is hidden (manual in CIS)
- 5.1.2.6 Ensure 'LinkedIn account connections' is disabled (manual in CIS)
- 5.1.8.1 Ensure that password hash sync is enabled for hybrid deployments (manual in CIS)
- 7.2.2 Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled
- 7.2.4 Ensure OneDrive content sharing is restricted
- 7.2.7 Ensure link sharing is restricted in SharePoint and OneDrive
- 7.2.8 Ensure external sharing is restricted by security group (manual in CIS)
- 7.2.9 Ensure guest access to a site or OneDrive will expire automatically
- 7.2.10 Ensure reauthentication with verification code is restricted
- 7.2.11 Ensure the SharePoint default sharing link permission is set
- 7.3.1 Ensure Office 365 SharePoint infected files are disallowed for download
- 9.1.1 Ensure guest user access is restricted (manual in CIS)
- 9.1.2 Ensure external user invitations are restricted (manual in CIS)
- 9.1.3 Ensure guest access to content is restricted (manual in CIS)
- 9.1.4 Ensure 'Publish to web' is restricted (manual in CIS)
- 9.1.5 Ensure 'Interact with and share R and Python' visuals is 'Disabled' (manual in CIS)
- 9.1.6 Ensure 'Allow users to apply sensitivity labels for content' is 'Enabled' (manual in CIS)
- 9.1.7 Ensure shareable links are restricted (manual in CIS)
- 9.1.8 Ensure enabling of external data sharing is restricted (manual in CIS)
- 9.1.9 Ensure 'Block ResourceKey Authentication' is 'Enabled' (manual in CIS)
- 9.1.10 Ensure access to APIs by service principals is restricted (manual in CIS)
- 9.1.11 Ensure service principals cannot create and use profiles (manual in CIS)
- 9.1.12 Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted (manual in CIS)
The 5 recommendations checked in part
- 1.1.2 Ensure two emergency access accounts have been defined
- 2.1.10 Ensure DMARC Records for all Exchange Online domains are published
- 2.4.1 Ensure Priority account protection is enabled and configured
- 5.2.4.1 Ensure 'Self service password reset enabled' is set to 'All'
- 8.4.1 Ensure app permission policies are configured
Outside Microsoft 365
Recommendations CIS marks as manual (such as Sway sharing, LinkedIn connections and Power BI tenant settings), and the SharePoint settings Microsoft Graph does not expose (default link type and permission, guest expiry, OneDrive’s own sharing level, infected-file downloads), have no read-only API a check can use. Teams policies are read once the client gives ConfigCheckup the Teams Reader role, and DLP and label policies once Purview is set up for the tenant. The Frameworks page lists each recommendation no check covers fully, and whether a check covers part of it.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every recommendation and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
1 Microsoft 365 admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 1.1.1 | Ensure administrative accounts are cloud-onlyE3 L1 | Checked in full | |
| 1.1.2 | Ensure two emergency access accounts have been definedE3 L1 · Manual in CIS | Checked in part | In part: |
| 1.1.3 | Ensure that between two and four global admins are designatedE3 L1 | Checked in full | |
| 1.1.4 | Ensure administrative accounts use licences with a reduced application footprintE3 L1 | Checked in full | |
| 1.2.1 | Ensure that only organisationally managed/approved public groups existE3 L2 | Checked in full | |
| 1.2.2 | Ensure sign-in to shared mailboxes is blockedE3 L1 | Checked in full | |
| 1.3.1 | Ensure the 'Password expiration policy' is set to 'Set passwords to never expire'E3 L1 | Checked in full | |
| 1.3.2 | Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devicesE3 L2 | Checked in full | |
| 1.3.3 | Ensure 'External sharing' of calendars is not availableE3 L2 | Checked in full | In part: |
| 1.3.4 | Ensure 'User owned apps and services' is restrictedE3 L1 | Checked in full | |
| 1.3.5 | Ensure internal phishing protection for Forms is enabledE3 L1 | Checked in full | |
| 1.3.6 | Ensure the customer lockbox feature is enabledE5 L2 | Checked in full | |
| 1.3.7 | Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'E3 L2 | Checked in full | |
| 1.3.8 | Ensure that Sways cannot be shared with people outside of your organisationE3 L2 · Manual in CIS | Not checked | |
| 1.3.9 | Ensure shared bookings pages are restricted to select usersE3 L1 | Checked in full |
2 Microsoft 365 Defender
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 2.1.1 | Ensure Safe Links for Office Applications is enabledE5 L2 | Checked in full | In part: |
| 2.1.2 | Ensure the Common Attachment Types Filter is enabledE3 L1 | Checked in full | |
| 2.1.3 | Ensure notifications for internal users sending malware is enabledE3 L1 | Checked in full | |
| 2.1.4 | Ensure Safe Attachments policy is enabledE5 L2 | Checked in full | In part: |
| 2.1.5 | Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is enabledE5 L2 | Checked in full | |
| 2.1.6 | Ensure Exchange Online Spam Policies are set to notify administratorsE3 L1 | Checked in full | |
| 2.1.7 | Ensure that an anti-phishing policy has been createdE5 L2 | Checked in full | In part: |
| 2.1.8 | Ensure that SPF records are published for all Exchange DomainsE3 L1 | Checked in full | |
| 2.1.9 | Ensure that DKIM is enabled for all Exchange Online DomainsE3 L1 | Checked in full | In part: |
| 2.1.10 | Ensure DMARC Records for all Exchange Online domains are publishedE3 L1 | Checked in part | In part: |
| 2.1.11 | Ensure comprehensive attachment filtering is appliedE3 L2 | Checked in full | |
| 2.1.12 | Ensure the connection filter IP allow list is not usedE3 L1 | Checked in full | |
| 2.1.13 | Ensure the connection filter safe list is offE3 L1 | Checked in full | |
| 2.1.14 | Ensure inbound anti-spam policies do not contain allowed domainsE3 L1 | Checked in full | |
| 2.1.15 | Ensure outbound anti-spam message limits are in placeE3 L1 | Checked in full | |
| 2.2.1 | Ensure emergency access account activity is monitoredE5 L1 · Manual in CIS | Not checked | |
| 2.4.1 | Ensure Priority account protection is enabled and configuredE5 L1 | Checked in part | In part: |
| 2.4.2 | Ensure Priority accounts have 'Strict protection' presets appliedE5 L1 | Checked in full | |
| 2.4.3 | Ensure Microsoft Defender for Cloud Apps is enabled and configuredE5 L2 · Manual in CIS | Not checked | |
| 2.4.4 | Ensure Zero-hour auto purge for Microsoft Teams is onE5 L1 | Checked in full |
3 Microsoft Purview
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 3.1.1 | Ensure Microsoft 365 audit log search is enabledE3 L1 | Checked in full | |
| 3.2.1 | Ensure DLP policies are enabledE3 L1 | Checked in full | In part: |
| 3.2.2 | Ensure DLP policies are enabled for Microsoft TeamsE5 L1 | Checked in full | |
| 3.3.1 | Ensure Information Protection sensitivity label policies are publishedE3 L1 | Checked in full | In part: |
4 Microsoft Intune admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 4.1 | Ensure devices without a compliance policy are marked 'not compliant'E3 L2 | Checked in full | |
| 4.2 | Ensure device enrollment for personally owned devices is blocked by defaultE3 L2 | Checked in full |
5 Microsoft Entra admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 5.1.2.1 | Ensure 'Per-user MFA' is disabledE3 L1 | Not checked | |
| 5.1.2.2 | Ensure third party integrated applications are not allowedE3 L2 | Checked in full | |
| 5.1.2.3 | Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'E3 L1 | Checked in full | |
| 5.1.2.4 | Ensure access to the Entra admin center is restrictedE3 L1 · Manual in CIS | Not checked | |
| 5.1.2.5 | Ensure the option to remain signed in is hiddenE3 L2 · Manual in CIS | Not checked | |
| 5.1.2.6 | Ensure 'LinkedIn account connections' is disabledE3 L2 · Manual in CIS | Not checked | |
| 5.1.3.1 | Ensure a dynamic group for guest users is createdE3 L1 | Checked in full | |
| 5.1.3.2 | Ensure users cannot create security groupsE3 L1 | Checked in full | |
| 5.1.4.1 | Ensure the ability to join devices to Entra is restrictedE3 L2 | Checked in full | |
| 5.1.4.2 | Ensure the maximum number of devices per user is limitedE3 L1 | Checked in full | |
| 5.1.4.3 | Ensure the GA role is not added as a local administrator during Entra joinE3 L1 | Checked in full | |
| 5.1.4.4 | Ensure local administrator assignment is limited during Entra joinE3 L1 | Checked in full | |
| 5.1.4.5 | Ensure Local Administrator Password Solution is enabledE3 L1 | Checked in full | In part: |
| 5.1.4.6 | Ensure users are restricted from recovering BitLocker keysE3 L2 | Checked in full | |
| 5.1.5.1 | Ensure user consent to apps accessing company data on their behalf is not allowedE3 L2 | Checked in full | |
| 5.1.5.2 | Ensure the admin consent workflow is enabledE3 L1 | Checked in full | |
| 5.1.6.1 | Ensure that collaboration invitations are sent to allowed domains onlyE3 L2 | Checked in full | |
| 5.1.6.2 | Ensure that guest user access is restrictedE3 L1 | Checked in full | |
| 5.1.6.3 | Ensure guest user invitations are limited to the Guest Inviter roleE3 L2 | Checked in full | |
| 5.1.8.1 | Ensure that password hash sync is enabled for hybrid deploymentsE3 L1 · Manual in CIS | Not checked | |
| 5.2.2.1 | Ensure multifactor authentication is enabled for all users in administrative rolesE3 L1 | Checked in full | In part: |
| 5.2.2.2 | Ensure multifactor authentication is enabled for all usersE3 L1 | Checked in full | |
| 5.2.2.3 | Enable Conditional Access policies to block legacy authenticationE3 L1 | Checked in full | |
| 5.2.2.4 | Ensure sign-in frequency is enabled and browser sessions are not persistent for administrative usersE3 L1 | Checked in full | |
| 5.2.2.5 | Ensure 'Phishing-resistant MFA strength' is required for administratorsE3 L2 | Checked in full | |
| 5.2.2.6 | Enable Identity Protection user risk policiesE5 L1 | Checked in full | In part: |
| 5.2.2.7 | Enable Identity Protection sign-in risk policiesE5 L1 | Checked in full | In part: |
| 5.2.2.8 | Ensure 'sign-in risk' is blocked for medium and high riskE5 L2 | Checked in full | In part: |
| 5.2.2.9 | Ensure a managed device is required for authenticationE3 L1 | Checked in full | In part: |
| 5.2.2.10 | Ensure a managed device is required to register security informationE3 L1 | Checked in full | In part: |
| 5.2.2.11 | Ensure sign-in frequency for Intune Enrollment is set to 'Every time'E3 L1 | Checked in full | |
| 5.2.2.12 | Ensure the device code sign-in flow is blockedE3 L1 | Checked in full | |
| 5.2.3.1 | Ensure Microsoft Authenticator is configured to protect against MFA fatigueE3 L1 | Checked in full | |
| 5.2.3.2 | Ensure custom banned passwords lists are usedE3 L1 | Checked in full | |
| 5.2.3.3 | Ensure password protection is enabled for on-premises Active DirectoryE3 L1 | Checked in full | |
| 5.2.3.4 | Ensure all member users are 'MFA capable'E3 L1 | Checked in full | |
| 5.2.3.5 | Ensure weak authentication methods are disabledE3 L1 | Checked in full | |
| 5.2.3.6 | Ensure system-preferred multifactor authentication is enabledE3 L1 | Checked in full | |
| 5.2.3.7 | Ensure the email OTP authentication method is disabledE3 L2 | Checked in full | |
| 5.2.4.1 | Ensure 'Self service password reset enabled' is set to 'All'E3 L1 · Manual in CIS | Checked in part | In part: |
| 5.3.1 | Ensure 'Privileged Identity Management' is used to manage rolesE5 L2 | Checked in full | |
| 5.3.2 | Ensure 'Access reviews' for guest users are configuredE5 L1 | Checked in full | |
| 5.3.3 | Ensure 'Access reviews' for privileged roles are configuredE5 L1 | Checked in full | |
| 5.3.4 | Ensure approval is required for Global Administrator role activationE5 L1 | Checked in full | |
| 5.3.5 | Ensure approval is required for Privileged Role Administrator activationE5 L1 | Checked in full |
6 Exchange admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 6.1.1 | Ensure 'AuditDisabled' organisationally is set to 'False'E3 L1 | Checked in full | |
| 6.1.2 | Ensure mailbox audit actions are configuredE3 L1 | Checked in full | |
| 6.1.3 | Ensure 'AuditBypassEnabled' is not enabled on mailboxesE3 L1 | Checked in full | |
| 6.2.1 | Ensure all forms of mail forwarding are blocked and/or disabledE3 L1 | Checked in full | In part: |
| 6.2.2 | Ensure mail transport rules do not whitelist specific domainsE3 L1 | Checked in full | |
| 6.2.3 | Ensure email from external senders is identifiedE3 L1 | Checked in full | |
| 6.3.1 | Ensure users installing Outlook add-ins is not allowedE3 L2 | Checked in full | |
| 6.5.1 | Ensure modern authentication for Exchange Online is enabledE3 L1 | Checked in full | |
| 6.5.2 | Ensure MailTips are enabled for end usersE3 L1 | Checked in full | |
| 6.5.3 | Ensure additional storage providers are restricted in Outlook on the webE3 L2 | Checked in full | |
| 6.5.4 | Ensure SMTP AUTH is disabledE3 L1 | Checked in full | |
| 6.5.5 | Ensure Direct Send submissions are rejectedE3 L2 | Checked in full |
7 SharePoint admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 7.2.1 | Ensure modern authentication for SharePoint applications is requiredE3 L1 | Checked in full | |
| 7.2.2 | Ensure SharePoint and OneDrive integration with Azure AD B2B is enabledE3 L1 | Not checked | |
| 7.2.3 | Ensure external content sharing is restrictedE3 L1 | Checked in full | |
| 7.2.4 | Ensure OneDrive content sharing is restrictedE3 L2 | Not checked | |
| 7.2.5 | Ensure that SharePoint guest users cannot share items they don't ownE3 L2 | Checked in full | |
| 7.2.6 | Ensure SharePoint external sharing is restrictedE3 L2 | Checked in full | |
| 7.2.7 | Ensure link sharing is restricted in SharePoint and OneDriveE3 L1 | Not checked | |
| 7.2.8 | Ensure external sharing is restricted by security groupE3 L2 · Manual in CIS | Not checked | |
| 7.2.9 | Ensure guest access to a site or OneDrive will expire automaticallyE3 L1 | Not checked | |
| 7.2.10 | Ensure reauthentication with verification code is restrictedE3 L1 | Not checked | |
| 7.2.11 | Ensure the SharePoint default sharing link permission is setE3 L1 | Not checked | |
| 7.3.1 | Ensure Office 365 SharePoint infected files are disallowed for downloadE5 L2 | Not checked | |
| 7.3.2 | Ensure OneDrive sync is restricted for unmanaged devicesE3 L2 | Checked in full |
8 Microsoft Teams admin center
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 8.1.1 | Ensure external file sharing in Teams is enabled for only approved cloud storage servicesE3 L2 | Checked in full | |
| 8.1.2 | Ensure users can't send emails to a channel email addressE3 L1 | Checked in full | |
| 8.2.1 | Ensure external domains are restricted in the Teams admin centerE3 L2 | Checked in full | |
| 8.2.2 | Ensure communication with unmanaged Teams users is disabledE3 L1 | Checked in full | |
| 8.2.3 | Ensure external Teams users cannot initiate conversationsE3 L1 | Checked in full | |
| 8.2.4 | Ensure the organisation cannot communicate with accounts in trial Teams tenantsE3 L1 | Checked in full | |
| 8.4.1 | Ensure app permission policies are configuredE3 L1 · Manual in CIS | Checked in part | In part: |
| 8.5.1 | Ensure anonymous users can't join a meetingE3 L2 | Checked in full | |
| 8.5.2 | Ensure anonymous users and dial-in callers can't start a meetingE3 L1 | Checked in full | |
| 8.5.3 | Ensure only people inside the organisation can bypass the lobbyE3 L1 | Checked in full | |
| 8.5.4 | Ensure users dialing in can't bypass the lobbyE3 L1 | Checked in full | |
| 8.5.5 | Ensure meeting chat does not allow anonymous usersE3 L2 | Checked in full | |
| 8.5.6 | Ensure only organisers and co-organisers can presentE3 L2 | Checked in full | |
| 8.5.7 | Ensure external participants can't give or request controlE3 L1 | Checked in full | |
| 8.5.8 | Ensure external meeting chat is offE3 L2 | Checked in full | |
| 8.5.9 | Ensure meeting recording is off by defaultE3 L2 | Checked in full | |
| 8.6.1 | Ensure users can report security concerns in TeamsE3 L1 | Checked in full |
9 Microsoft Fabric (Power BI)
| Number | Recommendation | Coverage | Checks |
|---|---|---|---|
| 9.1.1 | Ensure guest user access is restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.2 | Ensure external user invitations are restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.3 | Ensure guest access to content is restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.4 | Ensure 'Publish to web' is restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.5 | Ensure 'Interact with and share R and Python' visuals is 'Disabled'E3 L2 · Manual in CIS | Not checked | |
| 9.1.6 | Ensure 'Allow users to apply sensitivity labels for content' is 'Enabled'E3 L1 · Manual in CIS | Not checked | |
| 9.1.7 | Ensure shareable links are restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.8 | Ensure enabling of external data sharing is restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.9 | Ensure 'Block ResourceKey Authentication' is 'Enabled'E3 L1 · Manual in CIS | Not checked | |
| 9.1.10 | Ensure access to APIs by service principals is restrictedE3 L1 · Manual in CIS | Not checked | |
| 9.1.11 | Ensure service principals cannot create and use profilesE3 L1 · Manual in CIS | Not checked | |
| 9.1.12 | Ensure service principals ability to create workspaces, connections and deployment pipelines is restrictedE3 L1 · Manual in CIS | Not checked |
Related frameworks
- CISA SCuBA Microsoft 365 baselines: CISA’s secure configuration baselines for Microsoft 365.
- CIS Controls v8.1: The CIS Critical Security Controls, by implementation group.
- Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
- Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.