ConfigCheckup
Free trial

CISA SCuBA baselines for Microsoft 365, policy by policy

59 of the 104 policies are checked in full, 14 in part and 31 not at all. Each one is listed below with the check behind it, and so is every one no check covers.

Every framework mapped to Microsoft 365 · Mappings checked against the published standards in October 2026

What CISA SCuBA Microsoft 365 baselines is

The Secure Cloud Business Applications (SCuBA) baselines from the US Cybersecurity and Infrastructure Security Agency, as checked by CISA’s ScubaGear tool (version 2.0): the “SHALL” and “SHOULD” policies for Entra ID, Defender, Exchange Online, SharePoint and Teams, mapped by policy id.

Who asks for it: US federal agencies and anyone using CISA’s secure configuration baselines.

What Microsoft 365 can show

Of the 104 policies in CISA SCuBA Microsoft 365 baselines (ScubaGear 2.0), ConfigCheckup checks 59 in full (57%), 14 in part, and 31 not at all. A check covers a policy in full when it reads the setting the policy names and applies its test, so it never passes a tenant the policy would fail. In part means it reads a different signal, applies a weaker threshold or tests one step of several.

How much of each section ConfigCheckup checks
SectionPoliciesIn fullIn partNot checked
MS.AAD Microsoft Entra ID342923
MS.DEFENDER Microsoft Defender191063
MS.EXO Exchange Online121011
MS.POWERBI Power BI8008
MS.POWERPLATFORM Power Platform9009
MS.SHAREPOINT SharePoint and OneDrive8116
MS.TEAMS Microsoft Teams14941

The 31 policies no check covers

Each one stays on this list until a check covers it, in full or in part, and is counted above as not checked.

  • MS.AAD.2.2v1 Administrators notified when high-risk users are detected
  • MS.AAD.4.1v1 Security logs sent to the security operations centre
  • MS.AAD.9.1v1 Risky AI agents blocked
  • MS.DEFENDER.4.5v1 Apps restricted from files protected by DLP are listed
  • MS.DEFENDER.4.6v1 The DLP policy blocks restricted apps and unwanted Bluetooth apps
  • MS.DEFENDER.5.2v1 Alerts go to a monitored address or a SIEM
  • MS.EXO.4.3v1 DMARC aggregate reports go to CISA (US federal agencies)
  • MS.POWERBI.1.1v1 Publish to web disabled
  • MS.POWERBI.2.1v1 Guest access to the Power BI tenant disabled
  • MS.POWERBI.3.1v1 Inviting external users disabled
  • MS.POWERBI.4.1v1 Service principals with API access limited to security groups
  • MS.POWERBI.4.2v1 Service principals creating profiles limited to security groups
  • MS.POWERBI.5.1v1 ResourceKey-based authentication blocked
  • MS.POWERBI.6.1v1 Python and R interactions disabled
  • MS.POWERBI.7.1v1 Sensitivity labels enabled for Power BI
  • MS.POWERPLATFORM.1.1v1 Production and sandbox environment creation limited to admins
  • MS.POWERPLATFORM.1.2v1 Trial environment creation limited to admins
  • MS.POWERPLATFORM.2.1v1 A DLP policy restricts connectors in the default environment
  • MS.POWERPLATFORM.2.2v1 Every other environment has a DLP policy
  • MS.POWERPLATFORM.3.1v1 Tenant isolation enabled
  • MS.POWERPLATFORM.3.2v1 Inbound and outbound connection allow list configured
  • MS.POWERPLATFORM.4.1v1 Content Security Policy enforced for Power Apps
  • MS.POWERPLATFORM.5.1v1 Power Pages site creation limited to admins
  • MS.POWERPLATFORM.6.1v1 Share with Everyone disabled
  • MS.SHAREPOINT.1.2v1 OneDrive external sharing limited to existing guests or the organisation
  • MS.SHAREPOINT.2.1v1 Default sharing scope is specific people
  • MS.SHAREPOINT.2.2v1 Default sharing permission is view only
  • MS.SHAREPOINT.3.1v1 Anyone links expire within 30 days
  • MS.SHAREPOINT.3.2v1 Link permissions limited to view only
  • MS.SHAREPOINT.3.3v2 Verification-code reauthentication within 30 days
  • MS.TEAMS.5.1v2 Only approved Microsoft apps can be installed

The 14 policies checked in part

  • MS.AAD.7.2v1 Finer-grained roles used instead of Global Administrator
  • MS.AAD.7.5v1 Highly privileged roles provisioned only through a PAM system
  • MS.DEFENDER.1.4v1 Sensitive accounts in the Exchange Online Protection strict preset
  • MS.DEFENDER.1.5v1 Sensitive accounts in the Defender for Office 365 strict preset
  • MS.DEFENDER.2.1v1 User impersonation protection for sensitive accounts in both presets
  • MS.DEFENDER.2.3v1 Domain impersonation protection for key partners in both presets
  • MS.DEFENDER.4.1v2 A custom DLP policy protects sensitive information
  • MS.DEFENDER.6.3v1 Audit logs kept for the required period
  • MS.EXO.2.2v3 SPF fails every sender not approved, for each domain
  • MS.SHAREPOINT.1.1v1 SharePoint external sharing limited to existing guests or the organisation
  • MS.TEAMS.1.3v1 Anonymous users and dial-in callers not admitted automatically
  • MS.TEAMS.1.4v1 Internal users admitted automatically
  • MS.TEAMS.5.2v2 Only approved third-party apps can be installed
  • MS.TEAMS.5.3v2 Only approved custom apps can be installed

Outside Microsoft 365

Policies for Power Platform and Power BI, the SharePoint settings Microsoft Graph does not expose (default links, link expiry, OneDrive’s own sharing level), sending logs to a US federal SOC, and the DMARC reporting address for federal agencies are not assessed. Teams policies are read once the client gives ConfigCheckup the Teams Reader role, and DLP and alert policies once Purview is set up for the tenant. The Frameworks page lists each policy no check covers fully.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every policy and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

MS.AAD Microsoft Entra ID

CISA SCuBA Microsoft 365 baselines, section MS.AAD Microsoft Entra ID: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.AAD.1.1v1Legacy authentication blockedChecked in full
MS.AAD.2.1v1Users detected as high risk blockedChecked in full
MS.AAD.2.2v1Administrators notified when high-risk users are detectedNot checked
MS.AAD.2.3v1Sign-ins detected as high risk blockedChecked in full
MS.AAD.3.1v1Phishing-resistant MFA enforced for all usersChecked in full
MS.AAD.3.2v2MFA enforced for all usersChecked in full
MS.AAD.3.3v2Microsoft Authenticator shows login contextChecked in full
MS.AAD.3.4v1Authentication methods migration set to completeChecked in full
MS.AAD.3.5v2SMS, voice call and email one-time passcode disabledChecked in full
MS.AAD.3.6v1Phishing-resistant MFA required for highly privileged rolesChecked in full
MS.AAD.3.7v1Managed devices required for authenticationChecked in fullIn part:
MS.AAD.3.8v1Managed devices required to register MFAChecked in fullIn part:
MS.AAD.3.9v1Device code authentication blockedChecked in full
MS.AAD.4.1v1Security logs sent to the security operations centreNot checked
MS.AAD.5.1v1Only administrators can register applicationsChecked in full
MS.AAD.5.2v1User consent to applications restrictedChecked in full
MS.AAD.5.3v1Admin consent workflow configuredChecked in full
MS.AAD.5.5v1Adding passwords (client secrets) to applications blockedChecked in full
MS.AAD.5.6v1Application password lifetime of 180 days or lessChecked in full
MS.AAD.5.7v1Application certificate lifetime of 365 days or lessChecked in full
MS.AAD.6.1v1User passwords do not expireChecked in full
MS.AAD.7.1v1Between two and eight Global AdministratorsChecked in full
MS.AAD.7.2v1Finer-grained roles used instead of Global AdministratorChecked in partIn part:
MS.AAD.7.3v1Privileged users have cloud-only accountsChecked in full
MS.AAD.7.4v1No permanent active assignments to highly privileged rolesChecked in full
MS.AAD.7.5v1Highly privileged roles provisioned only through a PAM systemChecked in partIn part:
MS.AAD.7.6v1Global Administrator activation requires approvalChecked in full
MS.AAD.7.7v1Highly privileged role assignments trigger an alertChecked in full
MS.AAD.7.8v1Global Administrator activation triggers an alertChecked in full
MS.AAD.7.9v1Activation of other highly privileged roles triggers an alertChecked in full
MS.AAD.8.1v1Guests have limited or restricted directory accessChecked in full
MS.AAD.8.2v1Only the Guest Inviter role can invite guestsChecked in full
MS.AAD.8.3v1Guest invitations only to authorised domainsChecked in full
MS.AAD.9.1v1Risky AI agents blockedNot checked

MS.DEFENDER Microsoft Defender

CISA SCuBA Microsoft 365 baselines, section MS.DEFENDER Microsoft Defender: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.DEFENDER.1.1v1Standard and strict preset security policies enabledChecked in full
MS.DEFENDER.1.2v1All users in Exchange Online Protection standard or strict presetChecked in full
MS.DEFENDER.1.3v1All users in Defender for Office 365 standard or strict presetChecked in full
MS.DEFENDER.1.4v1Sensitive accounts in the Exchange Online Protection strict presetChecked in partIn part:
MS.DEFENDER.1.5v1Sensitive accounts in the Defender for Office 365 strict presetChecked in partIn part:
MS.DEFENDER.2.1v1User impersonation protection for sensitive accounts in both presetsChecked in partIn part:
MS.DEFENDER.2.2v1Domain impersonation protection for the organisation’s domains in both presetsChecked in full
MS.DEFENDER.2.3v1Domain impersonation protection for key partners in both presetsChecked in partIn part:
MS.DEFENDER.3.1v1Safe Attachments for SharePoint, OneDrive and TeamsChecked in full
MS.DEFENDER.4.1v2A custom DLP policy protects sensitive informationChecked in partIn part:
MS.DEFENDER.4.2v1The DLP policy covers Exchange, OneDrive, SharePoint, Teams chat and devicesChecked in full
MS.DEFENDER.4.3v1The DLP policy blocks sharing sensitive information with everyoneChecked in full
MS.DEFENDER.4.4v1The DLP policy notifies usersChecked in full
MS.DEFENDER.4.5v1Apps restricted from files protected by DLP are listedNot checked
MS.DEFENDER.4.6v1The DLP policy blocks restricted apps and unwanted Bluetooth appsNot checked
MS.DEFENDER.5.1v1The alerts the baselines require are enabledChecked in full
MS.DEFENDER.5.2v1Alerts go to a monitored address or a SIEMNot checked
MS.DEFENDER.6.1v1Unified audit logging enabledChecked in full
MS.DEFENDER.6.3v1Audit logs kept for the required periodChecked in partIn part:

MS.EXO Exchange Online

CISA SCuBA Microsoft 365 baselines, section MS.EXO Exchange Online: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.EXO.1.1v2Automatic forwarding to external domains disabledChecked in fullIn part:
MS.EXO.2.2v3SPF fails every sender not approved, for each domainChecked in partIn part:
MS.EXO.3.1v1DKIM enabled for every domainChecked in fullIn part:
MS.EXO.4.1v1DMARC published for every second-level domainChecked in full
MS.EXO.4.2v1DMARC policy set to rejectChecked in fullIn part:
MS.EXO.4.3v1DMARC aggregate reports go to CISA (US federal agencies)Not checked
MS.EXO.4.4v1An organisational contact receives DMARC aggregate and failure reportsChecked in full
MS.EXO.5.1v1SMTP AUTH disabledChecked in full
MS.EXO.6.1v1Contact folders not shared with all domainsChecked in full
MS.EXO.6.2v1Calendar details not shared with all domainsChecked in full
MS.EXO.7.1v1External sender warnings implementedChecked in full
MS.EXO.13.1v1Mailbox auditing enabledChecked in full

MS.POWERBI Power BI

CISA SCuBA Microsoft 365 baselines, section MS.POWERBI Power BI: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.POWERBI.1.1v1Publish to web disabledNot checked
MS.POWERBI.2.1v1Guest access to the Power BI tenant disabledNot checked
MS.POWERBI.3.1v1Inviting external users disabledNot checked
MS.POWERBI.4.1v1Service principals with API access limited to security groupsNot checked
MS.POWERBI.4.2v1Service principals creating profiles limited to security groupsNot checked
MS.POWERBI.5.1v1ResourceKey-based authentication blockedNot checked
MS.POWERBI.6.1v1Python and R interactions disabledNot checked
MS.POWERBI.7.1v1Sensitivity labels enabled for Power BINot checked

MS.POWERPLATFORM Power Platform

CISA SCuBA Microsoft 365 baselines, section MS.POWERPLATFORM Power Platform: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.POWERPLATFORM.1.1v1Production and sandbox environment creation limited to adminsNot checked
MS.POWERPLATFORM.1.2v1Trial environment creation limited to adminsNot checked
MS.POWERPLATFORM.2.1v1A DLP policy restricts connectors in the default environmentNot checked
MS.POWERPLATFORM.2.2v1Every other environment has a DLP policyNot checked
MS.POWERPLATFORM.3.1v1Tenant isolation enabledNot checked
MS.POWERPLATFORM.3.2v1Inbound and outbound connection allow list configuredNot checked
MS.POWERPLATFORM.4.1v1Content Security Policy enforced for Power AppsNot checked
MS.POWERPLATFORM.5.1v1Power Pages site creation limited to adminsNot checked
MS.POWERPLATFORM.6.1v1Share with Everyone disabledNot checked

MS.SHAREPOINT SharePoint and OneDrive

CISA SCuBA Microsoft 365 baselines, section MS.SHAREPOINT SharePoint and OneDrive: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.SHAREPOINT.1.1v1SharePoint external sharing limited to existing guests or the organisationChecked in partIn part:
MS.SHAREPOINT.1.2v1OneDrive external sharing limited to existing guests or the organisationNot checked
MS.SHAREPOINT.1.3v1External sharing limited to approved domains or security groupsChecked in full
MS.SHAREPOINT.2.1v1Default sharing scope is specific peopleNot checked
MS.SHAREPOINT.2.2v1Default sharing permission is view onlyNot checked
MS.SHAREPOINT.3.1v1Anyone links expire within 30 daysNot checked
MS.SHAREPOINT.3.2v1Link permissions limited to view onlyNot checked
MS.SHAREPOINT.3.3v2Verification-code reauthentication within 30 daysNot checked

MS.TEAMS Microsoft Teams

CISA SCuBA Microsoft 365 baselines, section MS.TEAMS Microsoft Teams: each policy and the checks that cover it
NumberPolicyCoverageChecks
MS.TEAMS.1.1v1External participants cannot request control of shared screensChecked in full
MS.TEAMS.1.2v2Anonymous users cannot start meetingsChecked in full
MS.TEAMS.1.3v1Anonymous users and dial-in callers not admitted automaticallyChecked in partIn part:
MS.TEAMS.1.4v1Internal users admitted automaticallyChecked in partIn part:
MS.TEAMS.1.5v1Dial-in users cannot bypass the lobbyChecked in full
MS.TEAMS.1.6v1Meeting recording disabledChecked in full
MS.TEAMS.1.7v2Events not set to always recordChecked in full
MS.TEAMS.2.1v2External access only on a per-domain basisChecked in full
MS.TEAMS.2.2v2Unmanaged users cannot initiate contactChecked in full
MS.TEAMS.2.3v2Internal users cannot initiate contact with unmanaged usersChecked in full
MS.TEAMS.4.1v1Teams email integration disabledChecked in full
MS.TEAMS.5.1v2Only approved Microsoft apps can be installedNot checked
MS.TEAMS.5.2v2Only approved third-party apps can be installedChecked in partIn part:
MS.TEAMS.5.3v2Only approved custom apps can be installedChecked in partIn part:
  • CIS Microsoft 365 Foundations v6.0.0: The Center for Internet Security’s hardening benchmark for Microsoft 365.
  • SOC 2: The AICPA Trust Services Criteria, asked of SaaS and service providers.
  • NIST SP 800-171: Protecting controlled unclassified information in the US defence supply chain.
  • CMMC Level 2: The NIST SP 800-171 practices, as US defence contractors are assessed on them.

Run the CISA SCuBA report on every tenant.

ConfigCheckup checks each tenant you connect against CISA SCuBA Microsoft 365 baselines: each policy met, partly met or not met, and what Microsoft 365 cannot show.

Start free trialTake the 2-minute tour

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant