ConfigCheckup
Free trial

The Microsoft Cloud Security Benchmark in Microsoft 365

25 controls can be evidenced from a Microsoft 365 tenant, by 125 checks. Each one is listed below with its checks, and so is what sits outside Microsoft 365.

Every framework mapped to Microsoft 365 · Mappings checked against the published standards in October 2026

What Microsoft Cloud Security Benchmark is

Microsoft’s benchmark for securing its cloud services, grouped into identity, privileged access, data protection, logging, endpoint and posture controls.

Who asks for it: Organisations aligning with Microsoft’s own security baseline.

What Microsoft 365 can show

25 controls evidenced by 125 checks. A check maps to a control only where its result is genuine evidence for it, so a control is listed only when a tenant setting can show it.

Outside Microsoft 365

Network security, backup and Azure-specific controls apply to Azure workloads rather than Microsoft 365.

Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.

Every control and the checks behind it

The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.

Microsoft Cloud Security Benchmark: each of the 25 controls and the checks that evidence it
ControlChecks that evidence it
AM-1 Track asset inventory and their risks
DP-1 Discover, classify and label sensitive data
DP-2 Monitor anomalies and threats targeting sensitive data
5 more checks for DP-2
DP-3 Encrypt sensitive data in transit
DP-4 Enable data at rest encryption by default
ES-2 Use modern anti-malware software
6 more checks for ES-2
ES-3 Ensure anti-malware software and signatures are updated
IM-1 Use centralised identity and authentication system
IM-3 Manage application identities securely and automatically
8 more checks for IM-3
IM-6 Use strong authentication controls
8 more checks for IM-6
IM-7 Restrict resource access based on conditions
17 more checks for IM-7
IM-8 Restrict the exposure of credentials and secrets
IR-2 Preparation: set up incident notification
IR-3 Detection and analysis: create incidents based on high-quality alerts
LT-1 Enable threat detection capabilities
LT-2 Enable threat detection for identity and access management
LT-3 Enable logging for security investigation
LT-6 Configure log storage retention
PA-1 Separate and limit highly privileged/administrative users
2 more checks for PA-1
PA-2 Avoid standing access for accounts and permissions
PA-4 Review and reconcile user access regularly
3 more checks for PA-4
PA-5 Set up emergency access
PA-7 Follow just enough administration (least privilege)
3 more checks for PA-7
PV-4 Audit and enforce secure configurations for compute resources
PV-6 Rapidly and automatically remediate vulnerabilities
  • Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.
  • Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.
  • PCI DSS 4.0.1: The card industry’s data security standard.
  • ISO/IEC 27001:2022: The international standard for an information security management system.

Run the Microsoft Cloud Security Benchmark report on every tenant.

ConfigCheckup checks each tenant you connect against Microsoft Cloud Security Benchmark: each control met, partly met or not met, and what Microsoft 365 cannot show.

Start free trialTake the 2-minute tour

14 days of daily monitoring and alerts, every finding with its fix guide, and reports on up to 3 tenants, from your first connected tenant. No card. Then choose the plan that fits. See the price per tenant