$Number $Name
" -Fragment - + $Number = $BaselineName.ToUpper() + '-' + $BaselineGroup.GroupNumber + $Name = $BaselineGroup.GroupName + $GroupAnchor = New-MarkdownAnchor -GroupNumber $BaselineGroup.GroupNumber -GroupName $BaselineGroup.GroupName + $MarkdownLink = "$Name" + $Fragments += $Fragment | ConvertTo-Html -PreContent "$Number $MarkdownLink
" -Fragment } $Title = "$($FullName) Baseline Report" @@ -177,6 +202,100 @@ function New-Report { $ReportSummary } +function Import-SecureBaseline{ + <# + .Description + This function parses the secure baseline via each product markdown document to align policy with the + software baseline. + .Functionality + Internal + #> + [CmdletBinding()] + param ( + [Parameter(Mandatory = $false)] + [ValidateScript({Test-Path -PathType Container $_})] + [string] + $BaselinePath = (Join-Path -Path $PSScriptRoot -ChildPath "..\..\..\..\baselines\") + ) + + $ProductNames = Get-ChildItem $BaselinePath -Filter "*.md" | ForEach-Object {$_.Name.SubString(0, $_.Name.Length - 3)} + $Output = @{} + + foreach ($Product in $ProductNames) { + $Output[$Product] = @() + $ProductPath = Join-Path -Path $BaselinePath -ChildPath "$Product.md" + $MdLines = Get-Content -Path $ProductPath + + # Select-String line numbers aren't 0-indexed, hence the "-1" on the next line + $LineNumbers = Select-String "^## [0-9]+\." "$($BaselinePath)$($Product).md" | ForEach-Object {$_."LineNumber"-1} + $Groups = $LineNumbers | ForEach-Object {$MdLines[$_]} + + foreach ($GroupName in $Groups) { + $Group = @{} + $Group.GroupNumber = $GroupName.Split(".")[0].SubString(3) # 3 to remove the "## " + $Group.GroupName = $GroupName.Split(".")[1].Trim() # 1 to remove the leading space + $Group.Controls = @() + + $IdRegex = "#### MS\.[$($Product.ToUpper())]+\.$($Group.GroupNumber)\." + # Select-String line numbers aren't 0-indexed, hence the "-1" on the next line + $LineNumbers = Select-String $IdRegex "$($BaselinePath)$($Product).md" | ForEach-Object {$_."LineNumber"-1} + + foreach ($LineNumber in $LineNumbers) { + # This assumes that the value is on the immediate next line after the ID and ends in a period. + $LineAdvance = 1; + $Value = ([string]$MdLines[$LineNumber+$LineAdvance]).Trim() + + while ($Value.Substring($Value.Length-1,1) -ne "."){ + $LineAdvance++ + $Value += ' ' + ([string]$MdLines[$LineNumber+$LineAdvance]).Trim() + } + + $Value = [System.Net.WebUtility]::HtmlEncode($Value) + $Id = [string]$MdLines[$LineNumber].Substring(5) + + if ($Id.EndsWith("X")){ + $Deleted = $true + $Id = $Id -Replace ".$" + $Value = "[DELETED] " + $Value + } + else { + $Deleted = $false + } + + $Group.Controls += @{"Id"=$Id; "Value"=$Value; "Deleted"=$Deleted} + } + + $Output[$Product] += $Group + } + } + + $Output +} + +function New-MarkdownAnchor{ + param ( + [Parameter(Mandatory = $true)] + [ValidateNotNullOrEmpty()] + [string] + $GroupNumber, + [Parameter(Mandatory = $true)] + [ValidateNotNullOrEmpty()] + [string] + $GroupName + ) + [Int32]$OutNumber = $null + + if ($true -eq [Int32]::TryParse($GroupNumber, [ref]$OutNumber)){ + $MangledName = $GroupName.ToLower().Trim().Replace(' ', '-') + return "#$($GroupNumber.Trim())-$MangledName" + } + else { + $InvalidGroupNumber = New-Object System.ArgumentException "$GroupNumber is not valid" + throw $InvalidGroupNumber + } +} + Export-ModuleMember -Function @( - 'New-Report' + 'New-Report', + 'Import-SecureBaseline' ) diff --git a/PowerShell/ScubaGear/Modules/CreateReport/scripts/main.js b/PowerShell/ScubaGear/Modules/CreateReport/scripts/main.js index f0b4929910..546012becc 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/scripts/main.js +++ b/PowerShell/ScubaGear/Modules/CreateReport/scripts/main.js @@ -3,11 +3,19 @@ */ const colorRows = () => { let rows = document.querySelectorAll('tr'); - const statusCol = 1; - const criticalityCol = 2; + const requirementCol = 1; + const statusCol = 2; + const criticalityCol = 3; for (let i = 0; i < rows.length; i++) { try { - if (rows[i].children[statusCol].innerHTML === "Fail") { + if (rows[i].children[requirementCol].innerHTML.startsWith("[DELETED]")) { + rows[i].style.color = "var(--test-deleted-color)"; + rows[i].style.background = "var(--test-other)"; + } + else if (rows[i].children[statusCol].innerHTML.startsWith("Bug")){ + rows[i].style.background = "var(--test-bug-color)"; + } + else if (rows[i].children[statusCol].innerHTML === "Fail") { rows[i].style.background = "var(--test-fail)"; } else if (rows[i].children[statusCol].innerHTML === "Warning") { @@ -24,8 +32,8 @@ const colorRows = () => { } else if (rows[i].children[statusCol].innerHTML.includes("Error")) { rows[i].style.background = "var(--test-fail)"; - rows[i].querySelectorAll('td')[1].style.borderColor = "var(--border-color)"; - rows[i].querySelectorAll('td')[1].style.color = "#d10000"; + rows[i].querySelectorAll('td')[statusCol].style.borderColor = "var(--border-color)"; + rows[i].querySelectorAll('td')[statusCol].style.color = "var(--test-error-color)"; } } catch (error) { @@ -103,7 +111,7 @@ const fillCAPTable = () => { } else if (capColNames[i] === "Conditions") { th.setAttribute("class", "conditions"); - } + } th.innerHTML = capColNames[i]; header.appendChild(th); } diff --git a/PowerShell/ScubaGear/Modules/CreateReport/styles/ParentReportStyle.css b/PowerShell/ScubaGear/Modules/CreateReport/styles/ParentReportStyle.css index 3b88cc0f57..b99033f775 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/styles/ParentReportStyle.css +++ b/PowerShell/ScubaGear/Modules/CreateReport/styles/ParentReportStyle.css @@ -20,7 +20,7 @@ footer { a.individual_reports:link { font-family: Arial, Helvetica, sans-serif; - color: var(--header-color); + color: var(--unvisited-link-color); text-decoration: underline; } @@ -39,7 +39,7 @@ a.individual_reports:active { font-family: Arial, Helvetica, sans-serif; color: var(--link-color); text-decoration: none; -} +} table.tenantdata tr:first-child { color: var(--text-color); @@ -49,8 +49,7 @@ table.tenantdata tr:first-child { .warning { background-color: var(--test-warning); } .pass { background-color: var(--test-pass); } .manual { background-color: var(--test-other); } - .error { - background-color: var(--test-fail); - color: #d10000; + background-color: var(--test-fail); + color: var(--test-error-color); } \ No newline at end of file diff --git a/PowerShell/ScubaGear/Modules/CreateReport/styles/main.css b/PowerShell/ScubaGear/Modules/CreateReport/styles/main.css index c1a96e7fe3..d07c52bb6c 100644 --- a/PowerShell/ScubaGear/Modules/CreateReport/styles/main.css +++ b/PowerShell/ScubaGear/Modules/CreateReport/styles/main.css @@ -2,15 +2,20 @@ --background-primary: white; --background-secondary: #b9bec2; --test-pass: #d5ebd5; - --test-fail: #deb8b8; + --test-fail: #E5C7C7; --test-warning: #fff7d6; --test-other: #ebebf2; + --test-deleted-bg: #b2beb5; + --test-deleted-color: #6f7478; + --test-bug-color: #e80b0b; + --test-error-color: #DD4803; --cap-even: #0052882d; --cap-hover: #00528850; --header-color: #005288; --note-color: #ee4e04; --header-bottom: black; --link-color: #85B065; + --unvisited-link-color: #0092CC; --text-color: black; --border-color: black; --toggle-height: 25px; @@ -19,21 +24,22 @@ } html[data-theme='dark'] { - --background-primary: #1f1b24; + --background-primary: #10171D; --background-secondary: #121212; - --test-pass: #1d3b1d; - --test-fail: #501414; - --test-warning: #5a3b00; + --test-pass: #1C361C; + --test-fail: #381919; + --test-warning: #524100; --test-other: #414141; --cap-even: #0052882d; --cap-hover: #007ccf50; + --test-error-color: #FD885D; --header-color: #b7c8d2; --note-color: #ee4e04; --header-bottom: rgb(221, 221, 221); --link-color: #85B065; + --unvisited-link-color: #0092CC; --text-color: #bdbdbd; --border-color: #7b7b7b; - } body { @@ -45,7 +51,7 @@ body { table { margin: auto; - font-size: 12px; + font-size: 13px; font-family: Arial, Helvetica, sans-serif; border-collapse: collapse; width: 1000px; @@ -232,17 +238,17 @@ th.conditions { width: var(--toggle-width); height: var(--toggle-height); left: 50px; - } - - /* Hide default HTML checkbox */ - .switch input { +} + +/* Hide default HTML checkbox */ +.switch input { opacity: 0; width: 0; height: 0; - } - - /* The slider */ - .slider { +} + +/* The slider */ +.slider { position: absolute; cursor: pointer; top: 0; @@ -252,9 +258,9 @@ th.conditions { background-color: #b9bec2; -webkit-transition: .4s; transition: .4s; - } - - .slider:before { +} + +.slider:before { position: absolute; content: ""; height: var(--toggle-radius); @@ -264,26 +270,49 @@ th.conditions { background-color: white; -webkit-transition: .4s; transition: .4s; - } - - input:checked + .slider { +} + +input:checked + .slider { background-color: #005288ad; - } - - input:focus + .slider { +} + +input:focus + .slider { box-shadow: 0 0 1px #005288ad; - } - - input:checked + .slider:before { +} + +input:checked + .slider:before { -webkit-transform: translateX(var(--toggle-radius)); -ms-transform: translateX(var(--toggle-radius)); transform: translateX(var(--toggle-radius)); - } - - .slider.round { +} + +.slider.round { border-radius: var(--toggle-height); - } - - .slider.round:before { +} + +.slider.round:before { border-radius: 50%; - } \ No newline at end of file +} + +a.control_group:link { + font-family: Arial, Helvetica, sans-serif; + color: var(--unvisited-link-color); + text-decoration: underline; +} + +a.control_group:visited { + font-family: Arial, Helvetica, sans-serif; + color: var(--link-color); +} + +a.control_group:hover { + font-family: Arial, Helvetica, sans-serif; + color: var(--link-color); + text-decoration: none; +} + +a.control_group:active { + font-family: Arial, Helvetica, sans-serif; + color: var(--link-color); + text-decoration: none; +} \ No newline at end of file diff --git a/PowerShell/ScubaGear/Modules/Orchestrator.psm1 b/PowerShell/ScubaGear/Modules/Orchestrator.psm1 index 90147c32c9..8732885277 100644 --- a/PowerShell/ScubaGear/Modules/Orchestrator.psm1 +++ b/PowerShell/ScubaGear/Modules/Orchestrator.psm1 @@ -751,6 +751,8 @@ function Invoke-ReportCreation { $Images = Join-Path -Path $ReporterPath -ChildPath "images" -ErrorAction 'Stop' Copy-Item -Path $Images -Destination $IndividualReportPath -Force -Recurse -ErrorAction 'Stop' + $SecureBaselines = Import-SecureBaseline + foreach ($Product in $ProductNames) { $BaselineName = $ArgToProd[$Product] $N += 1 @@ -775,6 +777,7 @@ function Invoke-ReportCreation { 'OutProviderFileName' = $OutProviderFileName; 'OutRegoFileName' = $OutRegoFileName; 'DarkMode' = $DarkMode; + 'SecureBaselines' = $SecureBaselines } $Report = New-Report @CreateReportParams @@ -804,8 +807,8 @@ function Invoke-ReportCreation { } if ($Report.Errors -gt 0) { - $Noun = Pluralize -SingularNoun "check" -PluralNoun "errors" -Count $Report.Manual - $ErrorSummary = "$($Report.Errors) PowerShell $($Noun)
"
+ $Noun = Pluralize -SingularNoun "error" -PluralNoun "errors" -Count $Report.Errors
+ $ErrorSummary = "$($Report.Errors) $($Noun)
"
}
$Fragment += [pscustomobject]@{
diff --git a/PowerShell/ScubaGear/Modules/RunRego/RunRego.psm1 b/PowerShell/ScubaGear/Modules/RunRego/RunRego.psm1
index 9eb03a7af7..d81d46c921 100644
--- a/PowerShell/ScubaGear/Modules/RunRego/RunRego.psm1
+++ b/PowerShell/ScubaGear/Modules/RunRego/RunRego.psm1
@@ -38,7 +38,11 @@ function Invoke-Rego {
# Permissions: chmod 755 ./opa
$Cmd = Join-Path -Path $OPAPath -ChildPath "opa" -ErrorAction 'Stop'
}
- $CmdArgs = @("eval", "-i", $InputFile, "-d", $RegoFile, "data.$PackageName.tests", "-f", "values")
+
+ # Load Utils
+ $RegoFileObject = Get-Item $RegoFile
+ $ScubaUtils = Join-Path -Path $RegoFileObject.DirectoryName -ChildPath "Utils"
+ $CmdArgs = @("eval", "data.$PackageName.tests", "-i", $InputFile, "-d", $RegoFile, "-d", $ScubaUtils, "-f", "values")
$TestResults = $(& $Cmd @CmdArgs) | Out-String -ErrorAction 'Stop' | ConvertFrom-Json -ErrorAction 'Stop'
$TestResults
}
diff --git a/Rego/AADConfig.rego b/Rego/AADConfig.rego
index b9c2b0ea15..1a99f4dd80 100644
--- a/Rego/AADConfig.rego
+++ b/Rego/AADConfig.rego
@@ -1,17 +1,15 @@
package aad
import future.keywords
+import data.report.utils.NotCheckedDetails
+import data.report.utils.Format
+import data.report.utils.ReportDetailsBoolean
################
# The report formatting functions below are generic and used throughout the policies #
################
-Format(Array) = format_int(count(Array), 10)
Description(String1, String2, String3) = trim(concat(" ", [String1, String2, String3]), " ")
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
-
ReportDetailsArray(Array, String) = Description(Format(Array), String, "")
# Set to the maximum number of array items to be
@@ -124,12 +122,8 @@ GroupExclusionsFullyExempt(Policy, PolicyID) := true if {
count({ y | y := input.scuba_config.Aad[PolicyID].CapExclusions.Groups }) == 0
}
-################
-# Baseline 2.1 #
-################
-
#
-# Baseline 2.1: Policy 1
+# MS.AAD.1.1v1
#--
default Policy2_1_1ConditionsMatch(_) := false
@@ -155,8 +149,7 @@ Policies2_1[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Legacy authentication SHALL be blocked",
- "Control" : "AAD 2.1",
+ "PolicyId" : "MS.AAD.1.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_1,
@@ -167,13 +160,8 @@ tests[{
true
}
-#--
-################
-# Baseline 2.2 #
-################
-
#
-# Baseline 2.2: Policy 1
+# MS.AAD.2.1v1
#--
default Policy2_2_1ConditionsMatch(_) := false
@@ -198,8 +186,7 @@ Policies2_2_1[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Users detected as high risk SHALL be blocked",
- "Control" : "AAD 2.2",
+ "PolicyId" : "MS.AAD.2.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_2_1,
@@ -212,29 +199,25 @@ tests[{
#--
#
-# Baseline 2.2: Policy 2
+# MS.AAD.2.2v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "A notification SHOULD be sent to the administrator when high-risk users are detected",
- "Control" : "AAD 2.2",
+ "PolicyId": PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.2 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.2.2v1"
true
}
#--
-################
-# Baseline 2.3 #
-################
-
#
-# Baseline 2.3: Policy 1
+# MS.AAD.3.1v1
#--
default Policy2_3_1ConditionsMatch(_) := false
@@ -259,8 +242,7 @@ Policies2_3[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Sign-ins detected as high risk SHALL be blocked",
- "Control" : "AAD 2.3",
+ "PolicyId": "MS.AAD.3.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_3,
@@ -273,12 +255,8 @@ tests[{
#--
-################
-# Baseline 2.4 #
-################
-
#
-# Baseline 2.4: Policy 1
+# MS.AAD.4.1v1
#--
default Policy2_4_1ConditionsMatch(_) := false
Policy2_4_1ConditionsMatch(Policy) := true if {
@@ -301,8 +279,7 @@ Policies2_4_1[Cap.DisplayName] {
}
tests[{
- "Requirement" : "MFA SHALL be required for all users",
- "Control" : "AAD 2.4",
+ "PolicyId" : "MS.AAD.4.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_4_1,
@@ -315,103 +292,127 @@ tests[{
#--
#
-# Baseline 2.4: Policy 2
+# MS.AAD.4.2v1
#--
# At this time we are unable to fully test for MFA due to conflicting and multiple ways to configure authentication methods
# Awaiting API changes and feature updates from Microsoft for automated checking
tests[{
- "Requirement" : "Phishing-resistant MFA SHALL be used for all users",
- "Control" : "AAD 2.4",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.4.2v1"
true
}
#--
#
-# Baseline 2.4: Policy 3
+# MS.AAD.4.3v1
#--
# At this time we are unable to test for all users due to conflicting and multiple ways to configure authentication methods
# Awaiting API changes and feature updates from Microsoft for automated checking
tests[{
- "Requirement" : "If phishing-resistant MFA cannot be used, an MFA method from the list [see AAD baseline 2.4] SHALL be used in the interim",
- "Control" : "AAD 2.4",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.4.3v1"
true
}
#--
#
-# Baseline 2.4: Policy 4
+# MS.AAD.4.4v1
#--
# At this time we are unable to test for SMS/Voice settings due to lack of API to validate
# Awaiting API changes and feature updates from Microsoft for automated checking
tests[{
- "Requirement" : "SMS or Voice as the MFA method SHALL NOT be used",
- "Control" : "AAD 2.4",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.4.4v1"
true
}
#--
-################
-# Baseline 2.5 #
-################
-
#
-# Baseline 2.5: Policy 1
+# MS.AAD.5.1v1
#--
# At this time we are unable to test for log collection until we integrate Azure Powershell capabilities
tests[{
- "Requirement" : "The following critical logs SHALL be sent at a minimum: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents",
- "Control" : "AAD 2.5",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.5 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
+ "RequirementMet" : false
+}] {
+ PolicyId := "MS.AAD.5.1v1"
+ true
+}
+#--
+
+#
+# MS.AAD.5.2v1
+#--
+tests[{
+ "PolicyId": PolicyId,
+ "Criticality" : "Should/Not-Implemented",
+ "Commandlet" : [],
+ "ActualValue" : [],
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.5.2v1"
true
}
#--
#
-# Baseline 2.5: Policy 2
+# MS.AAD.5.3v1
+#--
+tests[{
+ "PolicyId": PolicyId,
+ "Criticality" : "Should/Not-Implemented",
+ "Commandlet" : [],
+ "ActualValue" : [],
+ "ReportDetails" : NotCheckedDetails(PolicyId),
+ "RequirementMet" : false
+}] {
+ PolicyId := "MS.AAD.5.3v1"
+ true
+}
+#--
+
+#
+# MS.AAD.5.4v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "The logs SHALL be sent to the agency's SOC for monitoring",
- "Control" : "AAD 2.5",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.5 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.5.4v1"
true
}
#--
-################
-# Baseline 2.6 #
-################
-
AuthPoliciesBad_2_6[Policy.Id] {
Policy = input.authorization_policies[_]
Policy.DefaultUserRolePermissions.AllowedToCreateApps == true
@@ -425,11 +426,10 @@ AllAuthPoliciesAllowedCreate[{
}
#
-# Baseline 2.6: Policy 1
+# MS.AAD.6.1v1
#--
tests[{
- "Requirement" : "Only administrators SHALL be allowed to register third-party applications",
- "Control" : "AAD 2.6",
+ "PolicyId" : "MS.AAD.6.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgPolicyAuthorizationPolicy"],
"ActualValue" : {"all_allowed_create_values": AllAuthPoliciesAllowedCreate},
@@ -442,13 +442,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.7 #
-################
-
#
-# Baseline 2.7: Policy 1
+# MS.AAD.7.1v1
#--
BadDefaultGrantPolicies[Policy.Id] {
Policy = input.authorization_policies[_]
@@ -463,8 +458,7 @@ AllDefaultGrantPolicies[{
}
tests[{
- "Requirement" : "Only administrators SHALL be allowed to consent to third-party applications",
- "Control" : "AAD 2.7",
+ "PolicyId" : "MS.AAD.7.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgPolicyAuthorizationPolicy"],
"ActualValue" : {"all_grant_policy_values": AllDefaultGrantPolicies},
@@ -478,7 +472,7 @@ tests[{
#--
#
-# Baseline 2.7: Policy 2
+# MS.AAD.7.2v1
#--
BadConsentPolicies[Policy.Id] {
Policy := input.admin_consent_policies[_]
@@ -494,8 +488,7 @@ AllConsentPolicies[{
tests[{
- "Requirement" : "An admin consent workflow SHALL be configured",
- "Control" : "AAD 2.7",
+ "PolicyId" : "MS.AAD.7.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgPolicyAdminConsentRequestPolicy"],
"ActualValue" : {"all_consent_policies": AllConsentPolicies},
@@ -508,7 +501,7 @@ tests[{
#--
#
-# Baseline 2.7: Policy 3
+# MS.AAD.7.3v1
#--
AllConsentSettings[{
"SettingsGroup": SettingGroup.DisplayName,
@@ -539,8 +532,7 @@ BadConsentSettings[{
}
tests[{
- "Requirement" : "Group owners SHALL NOT be allowed to consent to third-party applications",
- "Control" : "AAD 2.7",
+ "PolicyId" : "MS.AAD.7.3v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgDirectorySetting"],
"ActualValue" : AllConsentSettings,
@@ -552,35 +544,25 @@ tests[{
}
#--
-
-################
-# Baseline 2.8 #
-################
-
#
-# Baseline 2.8: Policy 1
+# MS.AAD.8.1v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "User passwords SHALL NOT expire",
- "Control" : "AAD 2.8",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.8 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.8.1v1"
true
}
#--
-
-################
-# Baseline 2.9 #
-################
-
#
-# Baseline 2.9: Policy 1
+# MS.AAD.9.1v1
#--
default Policy2_9_1ConditionsMatch(_) := false
Policy2_9_1ConditionsMatch(Policy) := true if {
@@ -605,8 +587,7 @@ Policies2_9[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Sign-in frequency SHALL be configured to 12 hours",
- "Control" : "AAD 2.9",
+ "PolicyId" : "MS.AAD.9.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_9,
@@ -618,13 +599,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.10 #
-#################
-
#
-# Baseline 2.10: Policy 1
+# MS.AAD.10.1v1
#--
default Policy2_10_1ConditionsMatch(_) := false
Policy2_10_1ConditionsMatch(Policy) := true if {
@@ -648,8 +624,7 @@ Policies2_10[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Browser sessions SHALL not be persistent",
- "Control" : "AAD 2.10",
+ "PolicyId" : "MS.AAD.10.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_10,
@@ -661,13 +636,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.11 #
-#################
-
#
-# Baseline 2.11: Policy 1
+# MS.AAD.11.1v1
#--
GlobalAdmins[User.DisplayName] {
some id
@@ -676,8 +646,7 @@ GlobalAdmins[User.DisplayName] {
}
tests[{
- "Requirement" : "A minimum of two users and a maximum of four users SHALL be provisioned with the Global Administrator role",
- "Control" : "AAD 2.11",
+ "PolicyId" : "MS.AAD.11.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedUser"],
"ActualValue" : GlobalAdmins,
@@ -690,13 +659,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.12 #
-#################
-
#
-# Baseline 2.12: Policy 1
+# MS.AAD.12.1v1
#--
FederatedAdmins[User.DisplayName] {
some id
@@ -705,8 +669,7 @@ FederatedAdmins[User.DisplayName] {
}
tests[{
- "Requirement" : "Users that need to be assigned to highly privileged Azure AD roles SHALL be provisioned cloud-only accounts that are separate from the on-premises directory or other federated identity providers",
- "Control" : "AAD 2.12",
+ "PolicyId" : "MS.AAD.12.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedUser"],
"ActualValue" : AdminNames,
@@ -719,12 +682,8 @@ tests[{
}
#--
-#################
-# Baseline 2.13 #
-#################
-
#
-# Baseline 2.13: Policy 1
+# MS.AAD.13.1v1
#--
Policies2_13[Cap.DisplayName] {
Cap := input.conditional_access_policies[_]
@@ -744,8 +703,7 @@ Policies2_13[Cap.DisplayName] {
}
tests[{
- "Requirement" : "MFA SHALL be required for user access to highly privileged roles",
- "Control" : "AAD 2.13",
+ "PolicyId" : "MS.AAD.13.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole", "Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_13,
@@ -758,7 +716,7 @@ tests[{
#################
-# Helper functions for policies 2.14, 2.15, 2.16
+# Helper functions for policies
#################
# DoPIMRoleRulesExist will return true when the JSON privileged_roles.Rules element exists and false when it does not.
@@ -783,12 +741,8 @@ DoPIMRoleAssignmentsExist {
default check_if_role_assignments_exist := false
check_if_role_assignments_exist := DoPIMRoleAssignmentsExist
-#################
-# Baseline 2.14 #
-#################
-
#
-# Baseline 2.14: Policy 1
+# MS.AAD.14.1v1
#--
RolesWithoutLimitedExpirationPeriod[Role.DisplayName] {
Role := input.privileged_roles[_]
@@ -811,8 +765,7 @@ RolesWithoutLimitedExpirationPeriod[Role.DisplayName] {
}
tests[{
- "Requirement" : "Permanent active role assignments SHALL NOT be allowed for highly privileged roles. Active assignments SHALL have an expiration period.",
- "Control" : "AAD 2.14",
+ "PolicyId" : "MS.AAD.14.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : RolesWithoutLimitedExpirationPeriod,
@@ -826,7 +779,7 @@ tests[{
#--
#
-# Baseline 2.14: Policy 2
+# MS.AAD.14.2v1
#--
RolesAssignedOutsidePim[Role.DisplayName] {
Role := input.privileged_roles[_]
@@ -836,8 +789,7 @@ RolesAssignedOutsidePim[Role.DisplayName] {
}
tests[{
- "Requirement" : "Provisioning of users to highly privileged roles SHALL NOT occur outside of a PAM system, such as the Azure AD PIM service, because this bypasses the controls the PAM system provides",
- "Control" : "AAD 2.14",
+ "PolicyId" : "MS.AAD.14.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : RolesAssignedOutsidePim,
@@ -851,12 +803,8 @@ tests[{
#--
-#################
-# Baseline 2.15 #
-#################
-
#
-# Baseline 2.15: Policy 1
+# MS.AAD.15.1v1
#--
RolesWithoutApprovalRequired[RoleName] {
Role := input.privileged_roles[_]
@@ -868,8 +816,7 @@ RolesWithoutApprovalRequired[RoleName] {
}
tests[{
- "Requirement" : "Activation of highly privileged roles SHOULD require approval",
- "Control" : "AAD 2.15",
+ "PolicyId" : "MS.AAD.15.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : RolesWithoutApprovalRequired,
@@ -882,13 +829,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.16 #
-#################
-
#
-# Baseline 2.16: Policy 1
+# MS.AAD.16.1v1
#--
RolesWithoutActiveAssignmentAlerts[RoleName] {
Role := input.privileged_roles[_]
@@ -909,8 +851,7 @@ RolesWithoutEligibleAssignmentAlerts[RoleName] {
}
tests[{
- "Requirement" : "Eligible and Active highly privileged role assignments SHALL trigger an alert",
- "Control" : "AAD 2.16",
+ "PolicyId" : "MS.AAD.16.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : RolesWithoutAssignmentAlerts,
@@ -925,7 +866,7 @@ tests[{
#--
#
-# Baseline 2.16: Policy 2
+# MS.AAD.16.2v1
#--
AdminsWithoutActivationAlert[RoleName] {
Role := input.privileged_roles[_]
@@ -938,8 +879,7 @@ AdminsWithoutActivationAlert[RoleName] {
}
tests[{
- "Requirement" : "User activation of the Global Administrator role SHALL trigger an alert",
- "Control" : "AAD 2.16",
+ "PolicyId" : "MS.AAD.16.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : AdminsWithoutActivationAlert,
@@ -953,11 +893,10 @@ tests[{
#--
#
-# Baseline 2.16: Policy 3
+# MS.AAD.16.3v1
#--
tests[{
- "Requirement" : "User activation of other highly privileged roles SHOULD trigger an alert",
- "Control" : "AAD 2.16",
+ "PolicyId" : "MS.AAD.16.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MgSubscribedSku", "Get-PrivilegedRole"],
"ActualValue" : NonGlobalAdminsWithoutActivationAlert,
@@ -971,13 +910,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.17 #
-#################
-
#
-# Baseline 2.17: Policy 1
+# MS.AAD.17.1v1
#--
Policies2_17[Cap.DisplayName] {
Cap := input.conditional_access_policies[_]
@@ -992,8 +926,7 @@ Policies2_17[Cap.DisplayName] {
}
tests[{
- "Requirement" : "Managed devices SHOULD be required for authentication",
- "Control" : "AAD 2.17",
+ "PolicyId" : "MS.AAD.17.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MgIdentityConditionalAccessPolicy"],
"ActualValue" : Policies2_17,
@@ -1005,15 +938,9 @@ tests[{
}
#--
-
-#################
-# Baseline 2.18 #
-#################
-
#
-# Baseline 2.18: Policy 1
+# MS.AAD.18.1v1
#--
-
AuthPoliciesBadAllowInvites[Policy.Id] {
Policy = input.authorization_policies[_]
Policy.AllowInvitesFrom != "adminsAndGuestInviters"
@@ -1031,8 +958,7 @@ AllAuthPoliciesAllowInvites[{
}
tests[{
- "Requirement" : "Only users with the Guest Inviter role SHOULD be able to invite guest users",
- "Control" : "AAD 2.18",
+ "PolicyId" : "MS.AAD.18.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MgPolicyAuthorizationPolicy"],
"ActualValue" : {"all_allow_invite_values": AllAuthPoliciesAllowInvites},
@@ -1046,24 +972,24 @@ tests[{
#--
#
-# Baseline 2.18: Policy 2
+# MS.AAD.18.2v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes",
- "Control" : "AAD 2.18",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.18 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.AAD.18.2v1"
true
}
#--
#
-# Baseline 2.18: Policy 3
+# MS.AAD.18.3v1
#--
# must hardcode the ID. See
# https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/users-restrict-guest-permissions
@@ -1091,10 +1017,8 @@ RoleIdByPolicy[concat("", ["\"", Level, "\"", " (", Policy.Id, ")"])] {
Level := LevelAsString(Policy.GuestUserRoleId)
}
-
tests[{
- "Requirement" : "Guest users SHOULD have limited access to Azure AD directory objects",
- "Control" : "AAD 2.18",
+ "PolicyId" : "MS.AAD.18.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MgPolicyAuthorizationPolicy"],
"ActualValue" : {"all_roleid_values" : AllAuthPoliciesRoleIds},
diff --git a/Rego/DefenderConfig.rego b/Rego/DefenderConfig.rego
index 621de67d71..69b2b51e3a 100644
--- a/Rego/DefenderConfig.rego
+++ b/Rego/DefenderConfig.rego
@@ -1,34 +1,31 @@
package defender
import future.keywords
+import data.report.utils.NotCheckedDetails
+import data.report.utils.ReportDetailsBoolean
## Report details menu
#
+# NOTE: Use report.utils package for common report formatting functions.
+#
# If you simply want a boolean "Requirement met" / "Requirement not met"
-# just call ReportDetails(Status) and leave it at that.
+# just call ReportDetailsBoolean(Status) and leave it at that.
#
# If you want to customize the error message, wrap the ReportDetails call
# inside CustomizeError, like so:
-# CustomizeError(ReportDetails(Status), "Custom error message")
+# CustomizeError(ReportDetailsBoolean(Status), "Custom error message")
#
# If you want to customize the error message with details about an array,
# generate the custom error message using GenerateArrayString, for example:
-# CustomizeError(ReportDetails(Status), GenerateArrayString(BadPolicies, "bad policies found:"))
+# CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(BadPolicies, "bad policies found:"))
#
# If the setting in question requires a defender license,
# wrap the details string inside ApplyLicenseWarning, like so:
-# ApplyLicenseWarning(ReportDetails(Status))
+# ApplyLicenseWarning(ReportDetailsBoolean(Status))
#
# These functions can be nested. For example:
-# ApplyLicenseWarning(CustomizeError(ReportDetails(Status), "Custom error message"))
+# ApplyLicenseWarning(CustomizeError(ReportDetailsBoolean(Status), "Custom error message"))
#
##
-ReportDetails(Status) := "Requirement met" if {
- Status == true
-}
-
-ReportDetails(Status) := "Requirement not met" if {
- Status == false
-}
GenerateArrayString(Array, CustomString) := Output if {
# Example usage and output:
@@ -42,13 +39,13 @@ GenerateArrayString(Array, CustomString) := Output if {
CustomizeError(Message, CustomString) := Message if {
# If the message reports success, don't apply the custom
# error message
- Message == ReportDetails(true)
+ Message == ReportDetailsBoolean(true)
}
CustomizeError(Message, CustomString) := CustomString if {
# If the message does not report success, apply the custom
# error message
- Message != ReportDetails(true)
+ Message != ReportDetailsBoolean(true)
}
ApplyLicenseWarning(Message) := Message if {
@@ -57,19 +54,15 @@ ApplyLicenseWarning(Message) := Message if {
input.defender_license == true
}
-ApplyLicenseWarning(Message) := concat("", [ReportDetails(false), LicenseWarning]) if {
+ApplyLicenseWarning(Message) := concat("", [ReportDetailsBoolean(false), LicenseWarning]) if {
# If a defender license is not present, assume failure and
# replace the message with the warning
input.defender_license == false
LicenseWarning := " **NOTE: Either you do not have sufficient permissions or your tenant does not have a license for Microsoft Defender for Office 365 Plan 1, which is required for this feature.**"
}
-################
-# Baseline 2.1 #
-################
-
#
-# Baseline 2.1: Policy 1
+# MS.DEFENDER.1.1v1
#--
StandardPresetSecurityPolicy[Rules.State] {
Rules := input.protection_policy_rules[_]
@@ -77,12 +70,12 @@ StandardPresetSecurityPolicy[Rules.State] {
}
tests[{
- "Requirement" : "Standard Preset security profiles SHOULD NOT be used",
- "Control" : "Defender 2.1",
+ #TODO: Multiple mappings
+ "PolicyId" : "MS.DEFENDER.1.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-EOPProtectionPolicyRule"],
"ActualValue" : Policy,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policy := StandardPresetSecurityPolicy
@@ -92,7 +85,7 @@ tests[{
}
#--
-#
+# TODO: Resolve Policy Id
# Baseline 2.1: Policy 2
#--
StrictPresetSecurityPolicy[Rules.State] {
@@ -106,7 +99,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-EOPProtectionPolicyRule"],
"ActualValue" : Policy,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policy := StrictPresetSecurityPolicy
@@ -116,11 +109,6 @@ tests[{
}
#--
-
-################
-# Baseline 2.2 #
-################
-
# Determine the set of rules that pertain to SSNs, ITINs, or credit card numbers.
# Used in multiple bullet points below
SensitiveRules[{
@@ -146,7 +134,7 @@ SensitiveRules[{
}
#
-# Baseline 2.2: Policy 1
+# MS.DEFENDER.2.1v1
#--
# Step 1: Ensure that there is coverage for SSNs, ITINs, and credit cards
SSNRules[Rule.Name] {
@@ -165,12 +153,13 @@ CardRules[Rule.Name] {
}
tests[{
- "Requirement" : "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Social Security Number (SSN)",
- "Control" : "Defender 2.2",
+ #TODO: Appears this policy is broken into 3 parts in code and only 1 in baseline
+ #"Requirement" : "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Social Security Number (SSN)",
+ "PolicyId" : "MS.DEFENDER.2.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-DlpComplianceRule"],
"ActualValue" : Rules,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Rules := SSNRules
@@ -184,7 +173,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-DlpComplianceRule"],
"ActualValue" : Rules,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Rules := ITINRules
@@ -198,7 +187,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-DlpComplianceRule"],
"ActualValue" : Rules,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Rules := CardRules
@@ -260,12 +249,13 @@ TeamsPolicies[{
}
tests[{
- "Requirement" : "The custom policy SHOULD be applied in Exchange",
- "Control" : "Defender 2.2",
+ #TODO: Appears this policy is broken into 4 parts in code and only 1 in baseline
+ #"Requirement" : "The custom policy SHOULD be applied in Exchange",
+ "PolicyId" : "MS.DEFENDER.2.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DLPCompliancePolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := ExchangePolicies
@@ -279,7 +269,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-DLPCompliancePolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := SharePointPolicies
@@ -293,7 +283,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-DLPCompliancePolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := OneDrivePolicies
@@ -307,7 +297,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-DLPCompliancePolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := TeamsPolicies
@@ -339,12 +329,11 @@ SensitiveRulesNotBlocking[Rule.Name] {
}
tests[{
- "Requirement" : "The action for the DLP policy SHOULD be set to block sharing sensitive information with everyone when DLP conditions are met",
- "Control" : "Defender 2.2",
+ "PolicyId" : "MS.DEFENDER.2.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpComplianceRule"],
"ActualValue" : Rules,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Rules, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Rules, ErrorMessage)),
"RequirementMet" : Status
}] {
Rules := SensitiveRulesNotBlocking
@@ -363,12 +352,11 @@ SensitiveRulesNotNotifying[Rule.Name] {
}
tests[{
- "Requirement" : "Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled",
- "Control" : "Defender 2.2",
+ "PolicyId" : "MS.DEFENDER.2.4v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpComplianceRule"],
"ActualValue" : Rules,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Rules, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Rules, ErrorMessage)),
"RequirementMet" : Status
}] {
Rules := SensitiveRulesNotNotifying
@@ -382,14 +370,14 @@ tests[{
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "A list of apps that are not allowed to access files protected by DLP policy SHOULD be defined",
- "Control" : "Defender 2.2",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.2 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.DEFENDER.2.5v1"
true
}
#--
@@ -399,14 +387,14 @@ tests[{
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "A list of browsers that are not allowed to access files protected by DLP policy SHOULD be defined",
- "Control" : "Defender 2.2",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.2 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.DEFENDER.2.6v1"
true
}
#--
@@ -425,12 +413,11 @@ MalwarePoliciesWithoutFileFilter[Policy.Name] {
}
tests[{
- "Requirement" : "The common attachments filter SHALL be enabled in the default anti-malware policy and in all existing policies",
- "Control" : "Defender 2.3",
+ "PolicyId" : "MS.DEFENDER.3.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-MalwareFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := MalwarePoliciesWithoutFileFilter
@@ -450,12 +437,13 @@ MalwarePoliciesBlockingEXE[Policy.Name] {
}
tests[{
- "Requirement" : "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: exe files",
- "Control" : "Defender 2.3",
+ #TODO: Appears this policy is broken into 3 parts in code and only 1 in baseline
+ #"Requirement" : "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: exe files",
+ "PolicyId" : "MS.DEFENDER.3.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MalwareFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := MalwarePoliciesBlockingEXE
@@ -476,7 +464,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-MalwareFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := MalwarePoliciesBlockingCMD
@@ -497,7 +485,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-MalwareFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := MalwarePoliciesBlockingVBE
@@ -520,12 +508,11 @@ MalwarePoliciesWithoutZAP[Policy.Name] {
}
tests[{
- "Requirement" : "Zero-hour Auto Purge (ZAP) for malware SHOULD be enabled in the default anti-malware policy and in all existing custom policies",
- "Control" : "Defender 2.4",
+ "PolicyId" : "MS.DEFENDER.4.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-MalwareFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := MalwarePoliciesWithoutZAP
@@ -555,12 +542,11 @@ ProtectedUsersPolicies[{
# assert that at least one of the enabled policies includes protected users
tests[{
- "Requirement" : "User impersonation protection SHOULD be enabled for key agency leaders",
- "Control" : "Defender 2.5",
+ "PolicyId" : "MS.DEFENDER.5.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := ProtectedUsersPolicies
@@ -586,12 +572,11 @@ ProtectedOrgDomainsPolicies[{
# assert that at least one of the enabled policies includes
# protection for the org's own domains
tests[{
- "Requirement" : "Domain impersonation protection SHOULD be enabled for domains owned by the agency",
- "Control" : "Defender 2.5",
+ "PolicyId" : "MS.DEFENDER.5.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policies := ProtectedOrgDomainsPolicies
@@ -616,12 +601,11 @@ ProtectedCustomDomainsPolicies[{
# assert that at least one of the enabled policies includes
# protection for custom domains
tests[{
- "Requirement" : "Domain impersonation protection SHOULD be added for frequent partners",
- "Control" : "Defender 2.5",
+ "PolicyId" : "MS.DEFENDER.5.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), ErrorMessage),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), ErrorMessage),
"RequirementMet" : Status
}] {
Policies := ProtectedCustomDomainsPolicies
@@ -646,12 +630,11 @@ IntelligenceProtectionPolicies[{
# assert that at least one of the enabled policies includes
# intelligence protection
tests[{
- "Requirement" : "Intelligence for impersonation protection SHALL be enabled",
- "Control" : "Defender 2.5",
+ "PolicyId" : "MS.DEFENDER.5.5v1",
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policies := IntelligenceProtectionPolicies
@@ -664,12 +647,13 @@ tests[{
#--
# Step 1: Default (SHALL)
tests[{
- "Requirement" : "Message action SHALL be set to quarantine if the message is detected as impersonated: users default policy",
- "Control" : "Defender 2.5",
+ #TODO: Multiple mappings
+ #"Requirement" : "Message action SHALL be set to quarantine if the message is detected as impersonated: users default policy",
+ "PolicyId" : "MS.DEFENDER.5.6v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.TargetedUserProtectionAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -683,7 +667,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.TargetedDomainProtectionAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -697,7 +681,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.MailboxIntelligenceProtectionAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -721,7 +705,7 @@ tests[ {
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := AntiPhishTargetedUserNotQuarantine
@@ -743,7 +727,7 @@ tests[ {
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := AntiPhishTargetedDomainNotQuarantine
@@ -765,7 +749,7 @@ tests[ {
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := AntiPhishMailIntNotQuarantine
@@ -781,12 +765,13 @@ tests[ {
# represent this, we have two tests checking the default and the
# nondefault.
tests[ {
- "Requirement" : "Mail classified as spoofed SHALL be quarantined: default policy",
- "Control" : "Defender 2.5",
+ #TODO: Multiple Mappings
+ #"Requirement" : "Mail classified as spoofed SHALL be quarantined: default policy",
+ "PolicyId" : "MS.DEFENDER.5.7v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.AuthenticationFailAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -810,7 +795,7 @@ tests[ {
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where the action for spoofed emails is not set to quarantine:"
@@ -824,12 +809,13 @@ tests[ {
#--
# First contact default policy
tests[ {
- "Requirement" : "All safety tips SHALL be enabled: first contact default policy",
- "Control" : "Defender 2.5",
+ #TODO: Multiple Mappings
+ #"Requirement" : "All safety tips SHALL be enabled: first contact default policy",
+ "PolicyId" : "MS.DEFENDER.5.8v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableFirstContactSafetyTips,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -852,7 +838,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where first contact safety tips are not enabled:"
@@ -867,7 +853,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableSimilarUsersSafetyTips,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -890,7 +876,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where similar user safety tips are not enabled:"
@@ -905,7 +891,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableSimilarDomainsSafetyTips,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -928,7 +914,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where similar domains safety tips are not enabled:"
@@ -943,7 +929,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableUnusualCharactersSafetyTips,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -966,7 +952,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where unusual character safety tips are not enabled:"
@@ -981,7 +967,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableViaTag,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -1004,7 +990,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where via tag is not enabled:"
@@ -1019,7 +1005,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policy.EnableUnauthenticatedSender,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.anti_phish_policies[_]
@@ -1042,7 +1028,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-AntiPhishPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti phish policy(ies) found where '?' for unauthenticated sender is not enabled:"
@@ -1061,12 +1047,13 @@ tests[{
# Baseline 2.6: Policy 1
#--
tests[{
- "Requirement" : "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: default policy",
+ "PolicyId" : "MS.DEFENDER.6.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.BulkThreshold,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_] # Refactor
@@ -1086,7 +1073,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where bulk complaint level threshold is set to 7 or more:"
@@ -1100,12 +1087,13 @@ tests[{
#--
# Step 1: The default policy (SHALL)
tests[{
- "Requirement" : "Spam SHALL be moved to either the junk email folder or the quarantine folder: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple Mappings
+ #"Requirement" : "Spam SHALL be moved to either the junk email folder or the quarantine folder: default policy",
+ "PolicyId" : "MS.DEFENDER.6.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.SpamAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1119,7 +1107,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.HighConfidenceSpamAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1140,7 +1128,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where spam is not being sent to the Quarantine folder or the Junk Mail Folder:"
@@ -1160,7 +1148,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where high confidence spam is not being sent to the Quarantine folder or the Junk Mail Folder:"
@@ -1174,12 +1162,13 @@ tests[{
#--
# Step 1: The default policy (SHALL)
tests[{
- "Requirement" : "Phishing SHALL be quarantined: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "Phishing SHALL be quarantined: default policy",
+ "PolicyId" : "MS.DEFENDER.6.3v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.PhishSpamAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1193,7 +1182,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.HighConfidencePhishAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1215,7 +1204,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where phishing isn't moved to the quarantine folder:"
@@ -1235,7 +1224,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where high-confidence phishing isn't moved to quarantine folder:"
@@ -1247,12 +1236,13 @@ tests[{
# Baseline 2.6: Policy 4
#--
tests[{
- "Requirement" : "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: default policy",
+ "PolicyId" : "MS.DEFENDER.6.4v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.BulkSpamAction,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1272,7 +1262,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where bulk spam action is not Quarantine or Move to Junk Email Folder"
@@ -1285,12 +1275,13 @@ tests[{
# Baseline 2.6: Policy 5
#--
tests[{
- "Requirement" : "Spam in quarantine SHOULD be retained for at least 30 days: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple Mappings
+ #"Requirement" : "Spam in quarantine SHOULD be retained for at least 30 days: default policy",
+ "PolicyId" : "MS.DEFENDER.6.5v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.QuarantineRetentionPeriod,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1310,7 +1301,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where spam in quarantine isn't retained for 30 days:"
@@ -1323,12 +1314,13 @@ tests[{
# Baseline 2.6: Policy 6
#--
tests[{
- "Requirement" : "Spam safety tips SHOULD be turned on: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "Spam safety tips SHOULD be turned on: default policy",
+ "PolicyId" : "MS.DEFENDER.6.6v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.InlineSafetyTipsEnabled,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1348,7 +1340,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where spam safety tips is disabled:"
@@ -1362,12 +1354,13 @@ tests[{
#--
# Step 1: The default policy (SHALL)
tests[{
- "Requirement" : "Zero-hour auto purge (ZAP) SHALL be enabled: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "Zero-hour auto purge (ZAP) SHALL be enabled: default policy",
+ "PolicyId" : "MS.DEFENDER.6.7v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.ZapEnabled,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1381,7 +1374,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.SpamZapEnabled,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1395,7 +1388,7 @@ tests[{
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policy.PhishZapEnabled,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Policy := input.hosted_content_filter_policies[_]
@@ -1416,7 +1409,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policies found where Zero-hour auto purge is disabled:"
@@ -1436,7 +1429,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policies found where Zero-hour auto purge for spam is disabled:"
@@ -1456,7 +1449,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where Zero-hour auto purge for phishing is disabled:"
@@ -1474,12 +1467,13 @@ AllowedSenderDomainsNotEmpty [Policy.Identity] {
count(Policy.AllowedSenderDomains) > 0
}
tests[{
- "Requirement" : "Allowed senders MAY be added but allowed domains SHALL NOT be added: default policy",
- "Control" : "Defender 2.6",
+ #TODO: Multiple mappings
+ #"Requirement" : "Allowed senders MAY be added but allowed domains SHALL NOT be added: default policy",
+ "PolicyId" : "MS.DEFENDER.6.8v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom anti-spam policy(ies) found where there is at least one allowed sender domain:"
@@ -1498,7 +1492,7 @@ tests[{
"Criticality" : "Should",
"Commandlet" : ["Get-HostedContentFilterPolicy"],
"ActualValue" : Policies,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(Policies, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(Policies, ErrorMessage)),
"RequirementMet" : Status
}] {
ErrorMessage := "custom policy(ies) found where there is at least one allowed sender domain:"
@@ -1527,12 +1521,11 @@ AllDomainsSafeLinksPolicies[{
}
tests[{
- "Requirement" : "The Safe Links Policy SHALL include all agency domains-and by extension-all users",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksRule", "Get-AcceptedDomain"],
"ActualValue" : AllDomainsSafeLinksPolicies,
- "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetails(Status), ErrorMessage)),
+ "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetailsBoolean(Status), ErrorMessage)),
"RequirementMet" : Status
}] {
DomainNames := {Name.DomainName | Name = input.all_domains[_]}
@@ -1554,12 +1547,11 @@ EnableSafeLinksForEmailCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "URL rewriting and malicious link click checking SHALL be enabled",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := EnableSafeLinksForEmailCorrect
@@ -1580,12 +1572,11 @@ EnableSafeLinksForTeamsCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "Malicious link click checking SHALL be enabled with Microsoft Teams",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.3v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := EnableSafeLinksForTeamsCorrect
@@ -1606,12 +1597,11 @@ ScanUrlsCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "Real-time suspicious URL and file-link scanning SHALL be enabled",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.4v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := ScanUrlsCorrect
@@ -1632,12 +1622,11 @@ DeliverMessageAfterScanCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "URLs SHALL be scanned completely before message delivery",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.5v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := DeliverMessageAfterScanCorrect
@@ -1658,12 +1647,11 @@ EnableForInternalSendersCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "Internal agency email messages SHALL have safe links enabled",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.6v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := EnableForInternalSendersCorrect
@@ -1684,12 +1672,11 @@ TrackClicksCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "User click tracking SHALL be enabled",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.7v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := TrackClicksCorrect
@@ -1709,12 +1696,11 @@ EnableSafeLinksForOfficeCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "Safe Links in Office 365 apps SHALL be turned on",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.8v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := EnableSafeLinksForOfficeCorrect
@@ -1734,12 +1720,11 @@ AllowClickThroughCorrect[Policy.Identity] {
}
tests[{
- "Requirement" : "Users SHALL NOT be enabled to click through to the original URL",
- "Control" : "Defender 2.7",
+ "PolicyId" : "MS.DEFENDER.7.9v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeLinksPolicy", "Get-SafeLinksRule"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := AllowClickThroughCorrect
@@ -1767,12 +1752,11 @@ AllDomainsSafeAttachmentRules[{
}
tests[{
- "Requirement" : "At least one Safe Attachments Policy SHALL include all agency domains-and by extension-all users",
- "Control" : "Defender 2.8",
+ "PolicyId" : "MS.DEFENDER.8.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeAttachmentRule", "Get-AcceptedDomain"],
"ActualValue" : AllDomainsSafeAttachmentRules,
- "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetails(Status), ErrorMessage)),
+ "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetailsBoolean(Status), ErrorMessage)),
"RequirementMet" : Status
}] {
DomainNames := {Name.DomainName | Name = input.all_domains[_]}
@@ -1801,12 +1785,11 @@ BlockMalwarePolicies[{
}
tests[{
- "Requirement" : "The action for malware in email attachments SHALL be set to block",
- "Control" : "Defender 2.8",
+ "PolicyId" : "MS.DEFENDER.8.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SafeAttachmentPolicy", "Get-SafeAttachmentRule", "Get-AcceptedDomain"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetails(Status), ErrorMessage)),
+ "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetailsBoolean(Status), ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := BlockMalwarePolicies
@@ -1828,12 +1811,11 @@ RedirectionPolicies[{
}
tests[{
- "Requirement" : "Redirect emails with detected attachments to an agency-specified email SHOULD be enabled",
- "Control" : "Defender 2.8",
+ "PolicyId" : "MS.DEFENDER.8.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SafeAttachmentPolicy", "Get-SafeAttachmentRule", "Get-AcceptedDomain"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetails(Status), ErrorMessage)),
+ "ReportDetails" : ApplyLicenseWarning(CustomizeError(ReportDetailsBoolean(Status), ErrorMessage)),
"RequirementMet" : Status
}] {
Policies := RedirectionPolicies
@@ -1854,12 +1836,11 @@ ATPPolicies[{
}
tests[{
- "Requirement" : "Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams",
- "Control" : "Defender 2.8",
+ "PolicyId" : "MS.DEFENDER.8.4v1",
"Criticality" : "Should",
"Commandlet" : ["Get-AtpPolicyForO365"],
"ActualValue" : Policies,
- "ReportDetails" : ApplyLicenseWarning(ReportDetails(Status)),
+ "ReportDetails" : ApplyLicenseWarning(ReportDetailsBoolean(Status)),
"RequirementMet" : Status
}] {
Policies := ATPPolicies
@@ -1894,12 +1875,11 @@ EnabledAlerts[Alert.Name] {
}
tests[{
- "Requirement" : "At a minimum, the alerts required by the Exchange Online Minimum Viable Secure Configuration Baseline SHALL be enabled",
- "Control" : "Defender 2.9",
+ "PolicyId" : "MS.DEFENDER.9.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-ProtectionAlert"],
"ActualValue" : MissingAlerts,
- "ReportDetails" : CustomizeError(ReportDetails(Status), GenerateArrayString(MissingAlerts, ErrorMessage)),
+ "ReportDetails" : CustomizeError(ReportDetailsBoolean(Status), GenerateArrayString(MissingAlerts, ErrorMessage)),
"RequirementMet" : Status
}] {
MissingAlerts := RequiredAlerts - EnabledAlerts
@@ -1913,14 +1893,14 @@ tests[{
#--
# SIEM incorporation cannot be checked programmatically
tests[{
- "Requirement" : "The alerts SHOULD be sent to a monitored address or incorporated into a SIEM",
- "Control" : "Defender 2.9",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.9 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.DEFENDER.9.2v1"
true
}
#--
@@ -1942,12 +1922,11 @@ CorrectLogConfigs[{
# Baseline 2.10: Policy 1
#--
tests[{
- "Requirement" : "Unified audit logging SHALL be enabled",
- "Control" : "Defender 2.10",
+ "PolicyId" : "MS.DEFENDER.10.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-AdminAuditLogConfig"],
"ActualValue" : CorrectLogConfigs,
- "ReportDetails" : ReportDetails(Status),
+ "ReportDetails" : ReportDetailsBoolean(Status),
"RequirementMet" : Status
}] {
Status := count(CorrectLogConfigs) >= 1
@@ -1961,14 +1940,14 @@ tests[{
# Would require looping through all users. See discussion in GitHub
# issue #200.
tests[{
- "Requirement" : "Advanced audit SHALL be enabled",
- "Control" : "Defender 2.10",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.10 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.DEFENDER.10.2v1"
true
}
#--
@@ -1980,14 +1959,14 @@ tests[{
# It is not required to maintain these logs in the M365 cloud environment; doing so would require an additional add-on SKU.
# This requirement can be met by offloading the logs out of the cloud environment.
tests[{
- "Requirement" : "Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31",
- "Control" : "Defender 2.10",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.10 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.DEFENDER.10.3v1"
true
}
#--
diff --git a/Rego/EXOConfig.rego b/Rego/EXOConfig.rego
index a2b5a0dd57..c1655d224e 100644
--- a/Rego/EXOConfig.rego
+++ b/Rego/EXOConfig.rego
@@ -1,13 +1,10 @@
package exo
import future.keywords
-
-Format(Array) = format_int(count(Array), 10)
-
-Description(String1, String2, String3) = trim(concat(" ", [String1, concat(" ", [String2, String3])]), " ")
-
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
+import data.report.utils.NotCheckedDetails
+import data.report.utils.Format
+import data.report.utils.ReportDetailsBoolean
+import data.report.utils.Description
+import data.report.utils.ReportDetailsString
ReportDetailsArray(Status, Array1, Array2) = Detail if {
Status == true
@@ -21,16 +18,6 @@ ReportDetailsArray(Status, Array1, Array2) = Detail if {
Detail := Description(Fraction, "agency domain(s) found in violation:", String)
}
-ReportDetailsString(Status, String) = Detail if {
- Status == true
- Detail := "Requirement met"
-}
-
-ReportDetailsString(Status, String) = Detail if {
- Status == false
- Detail := String
-}
-
AllDomains := {Domain.domain | Domain = input.spf_records[_]}
CustomDomains[Domain.domain] {
@@ -39,12 +26,8 @@ CustomDomains[Domain.domain] {
}
-################
-# Baseline 2.1 #
-################
-
#
-# Baseline 2.1: Policy 1
+# MS.EXO.1.1v1
#--
RemoteDomainsAllowingForwarding[Domain.DomainName] {
Domain := input.remote_domains[_]
@@ -52,8 +35,7 @@ RemoteDomainsAllowingForwarding[Domain.DomainName] {
}
tests[{
- "Requirement" : "Automatic forwarding to external domains SHALL be disabled",
- "Control" : "EXO 2.1",
+ "PolicyId" : "MS.EXO.1.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-RemoteDomain"],
"ActualValue" : Domains,
@@ -66,30 +48,25 @@ tests[{
}
#--
-
-################
-# Baseline 2.2 #
-################
-
#
-# Baseline 2.2: Policy 1
+# MS.EXO.2.1v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "A list of approved IP addresses for sending mail SHALL be maintained",
- "Control" : "EXO 2.2",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Exchange Online Secure Configuration Baseline policy 2.# for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.EXO.2.1v1"
true
}
#--
#
-# Baseline 2.2: Policy 2
+# MS.EXO.2.2v1
#--
DomainsWithoutSpf[DNSResponse.domain] {
DNSResponse := input.spf_records[_]
@@ -98,8 +75,7 @@ DomainsWithoutSpf[DNSResponse.domain] {
}
tests[{
- "Requirement" : "An SPF policy(s) that designates only these addresses as approved senders SHALL be published",
- "Control" : "EXO 2.2",
+ "PolicyId" : "MS.EXO.2.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-ScubaSpfRecords", "Get-AcceptedDomain"],
"ActualValue" : Domains,
@@ -111,13 +87,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.3 #
-################
-
#
-# Baseline 2.3: Policy 1
+# MS.EXO.3.1v1
#--
DomainsWithDkim[DkimConfig.Domain] {
DkimConfig := input.dkim_config[_]
@@ -129,8 +100,7 @@ DomainsWithDkim[DkimConfig.Domain] {
}
tests[{
- "Requirement" : "DKIM SHOULD be enabled for any custom domain",
- "Control" : "EXO 2.3",
+ "PolicyId" : "MS.EXO.3.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DkimSigningConfig", "Get-ScubaDkimRecords", "Get-AcceptedDomain"],
"ActualValue" : [input.dkim_records, input.dkim_config],
@@ -142,13 +112,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.4 #
-################
-
#
-# Baseline 2.4: Policy 1
+# MS.EXO.4.1v1
#--
DomainsWithoutDmarc[DmarcRecord.domain] {
DmarcRecord := input.dmarc_records[_]
@@ -157,8 +122,7 @@ DomainsWithoutDmarc[DmarcRecord.domain] {
}
tests[{
- "Requirement" : "A DMARC policy SHALL be published for every second-level domain",
- "Control" : "EXO 2.4",
+ "PolicyId" : "MS.EXO.4.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-ScubaDmarcRecords", "Get-AcceptedDomain"],
"ActualValue" : input.dmarc_records,
@@ -171,7 +135,7 @@ tests[{
#--
#
-# Baseline 2.4: Policy 2
+# MS.EXO.4.2v1
#--
DomainsWithoutPreject[DmarcRecord.domain] {
DmarcRecord := input.dmarc_records[_]
@@ -180,8 +144,7 @@ DomainsWithoutPreject[DmarcRecord.domain] {
}
tests[{
- "Requirement" : "The DMARC message rejection option SHALL be \"p=reject\"",
- "Control" : "EXO 2.4",
+ "PolicyId" : "MS.EXO.4.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-ScubaDmarcRecords", "Get-AcceptedDomain"],
"ActualValue" : input.dmarc_records,
@@ -194,7 +157,7 @@ tests[{
#--
#
-# Baseline 2.4: Policy 3
+# MS.EXO.4.3v1
#--
DomainsWithoutDHSContact[DmarcRecord.domain] {
DmarcRecord := input.dmarc_records[_]
@@ -203,8 +166,7 @@ DomainsWithoutDHSContact[DmarcRecord.domain] {
}
tests[{
- "Requirement" : "The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov",
- "Control" : "EXO 2.4",
+ "PolicyId" : "MS.EXO.4.3v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-ScubaDmarcRecords", "Get-AcceptedDomain"],
"ActualValue" : input.dmarc_records,
@@ -217,7 +179,7 @@ tests[{
#--
#
-# Baseline 2.4: Policy 4
+# MS.EXO.4.4v1
#--
DomainsWithoutAgencyContact[DmarcRecord.domain] {
DmarcRecord := input.dmarc_records[_]
@@ -226,8 +188,7 @@ DomainsWithoutAgencyContact[DmarcRecord.domain] {
}
tests[{
- "Requirement" : "An agency point of contact SHOULD be included for aggregate and/or failure reports",
- "Control" : "EXO 2.4",
+ "PolicyId" : "MS.EXO.4.4v1",
"Criticality" : "Should",
"Commandlet" : ["Get-ScubaDmarcRecords", "Get-AcceptedDomain"],
"ActualValue" : input.dmarc_records,
@@ -239,13 +200,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.5 #
-################
-
#
-# Baseline 2.5: Policy 1
+# MS.EXO.5.1v1
#--
SmtpClientAuthEnabled[TransportConfig.Name] {
@@ -254,8 +210,7 @@ SmtpClientAuthEnabled[TransportConfig.Name] {
}
tests[{
- "Requirement" : "SMTP AUTH SHALL be disabled in Exchange Online",
- "Control" : "EXO 2.5",
+ "PolicyId" : "MS.EXO.5.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-TransportConfig"],
"ActualValue" : input.transport_config,
@@ -266,15 +221,10 @@ tests[{
}
#--
-
-################
-# Baseline 2.6 #
-################
-
# Are both the tests supposed to be the same?
#
-# Baseline 2.6: Policy 1
+# MS.EXO.6.1v1
#--
SharingPolicyAllowedSharing[SharingPolicy.Name] {
@@ -285,8 +235,7 @@ SharingPolicyAllowedSharing[SharingPolicy.Name] {
tests[{
- "Requirement" : "Contact folders SHALL NOT be shared with all domains, although they MAY be shared with specific domains",
- "Control" : "EXO 2.6",
+ "PolicyId" : "MS.EXO.6.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SharingPolicy"],
"ActualValue" : input.sharing_policy,
@@ -300,12 +249,11 @@ tests[{
#--
#
-# Baseline 2.6: Policy 2
+# MS.EXO.6.2v1
#--
tests[{
- "Requirement" : "Calendar details SHALL NOT be shared with all domains, although they MAY be shared with specific domains",
- "Control" : "EXO 2.6",
+ "PolicyId" : "MS.EXO.6.2v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SharingPolicy"],
"ActualValue" : input.sharing_policy,
@@ -317,16 +265,11 @@ tests[{
}
#--
-
-################
-# Baseline 2.7 #
-################
#
-# Baseline 2.7: Policy 1
+# MS.EXO.7.1v1
#--
tests[{
- "Requirement" : "External sender warnings SHALL be implemented",
- "Control" : "EXO 2.7",
+ "PolicyId" : "MS.EXO.7.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-TransportRule"],
"ActualValue" : [Rule.FromScope | Rule = Rules[_]],
@@ -341,18 +284,12 @@ tests[{
}
#--
-
-################
-# Baseline 2.8 #
-################
-
#
-# Baseline 2.8: Policy 1
+# MS.EXO.8.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "A DLP solution SHALL be used. The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft",
- "Control" : "EXO 2.8",
+ "PolicyId" : "MS.EXO.8.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -364,12 +301,11 @@ tests[{
#--
#
-# Baseline 2.8: Policy 2
+# MS.EXO.8.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "The DLP solution SHALL protect PII and sensitive information, as defined by the agency. At a minimum, the sharing of credit card numbers, Taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) via email SHALL be restricted",
- "Control" : "EXO 2.8",
+ "PolicyId" : "MS.EXO.8.2v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -380,18 +316,12 @@ tests[{
}
#--
-
-################
-# Baseline 2.9 #
-################
-
#
-# Baseline 2.9: Policy 1
+# MS.EXO.9.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Emails SHALL be filtered by the file types of included attachments. The selected filtering solution SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter",
- "Control" : "EXO 2.9",
+ "PolicyId" : "MS.EXO.9.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -403,12 +333,11 @@ tests[{
#--
#
-# Baseline 2.9: Policy 2
+# MS.EXO.9.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "The attachment filter SHOULD attempt to determine the true file type and assess the file extension",
- "Control" : "EXO 2.9",
+ "PolicyId" : "MS.EXO.9.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -420,12 +349,11 @@ tests[{
#--
#
-# Baseline 2.9: Policy 3
+# MS.EXO.9.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe)",
- "Control" : "EXO 2.9",
+ "PolicyId" : "MS.EXO.9.3v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -436,18 +364,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.10 #
-#################
-
#
-# Baseline 2.10: Policy 1
+# MS.EXO.10.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Emails SHALL be scanned for malware",
- "Control" : "EXO 2.10",
+ "PolicyId" : "MS.EXO.10.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -459,12 +381,11 @@ tests[{
#--
#
-# Baseline 2.10: Policy 2
+# MS.EXO.10.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Emails identified as containing malware SHALL be quarantined or dropped",
- "Control" : "EXO 2.10",
+ "PolicyId" : "MS.EXO.10.2v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -476,12 +397,11 @@ tests[{
#--
#
-# Baseline 2.10: Policy 3
+# MS.EXO.10.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Email scanning SHOULD be capable of reviewing emails after delivery",
- "Control" : "EXO 2.10",
+ "PolicyId" : "MS.EXO.10.3v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -492,18 +412,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.11 #
-#################
-
#
-# Baseline 2.11: Policy 1
+# MS.EXO.11.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Impersonation protection checks SHOULD be used",
- "Control" : "EXO 2.11",
+ "PolicyId" : "MS.EXO.11.1v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -515,12 +429,11 @@ tests[{
#--
#
-# Baseline 2.11: Policy 2
+# MS.EXO.11.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed",
- "Control" : "EXO 2.11",
+ "PolicyId" : "MS.EXO.11.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -532,12 +445,11 @@ tests[{
#--
#
-# Baseline 2.11: Policy 3
+# MS.EXO.11.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence",
- "Control" : "EXO 2.11",
+ "PolicyId" : "MS.EXO.11.3v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -548,13 +460,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.12 #
-#################
-
#
-# Baseline 2.12: Policy 1
+# MS.EXO.12.1v1
#--
ConnFiltersWithIPAllowList[ConnFilter.Name] {
@@ -563,8 +470,7 @@ ConnFiltersWithIPAllowList[ConnFilter.Name] {
}
tests[{
- "Requirement" : "IP allow lists SHOULD NOT be created",
- "Control" : "EXO 2.12",
+ "PolicyId" : "MS.EXO.12.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedConnectionFilterPolicy"],
"ActualValue" : input.conn_filter,
@@ -577,7 +483,7 @@ tests[{
#--
#
-# Baseline 2.12: Policy 2
+# MS.EXO.12.2v1
#--
ConnFiltersWithSafeList[ConnFilter.Name] {
@@ -586,8 +492,7 @@ ConnFiltersWithSafeList[ConnFilter.Name] {
}
tests[{
- "Requirement" : "Safe lists SHOULD NOT be enabled",
- "Control" : "EXO 2.12",
+ "PolicyId" : "MS.EXO.12.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-HostedConnectionFilterPolicy"],
"ActualValue" : input.conn_filter,
@@ -598,13 +503,8 @@ tests[{
}
#--
-
-#################
-# Baseline 2.13 #
-#################
-
#
-# Baseline 2.13: Policy 1
+# MS.EXO.13.1v1
#--
AuditEnabled[OrgConfig.Name] {
OrgConfig := input.org_config[_]
@@ -612,8 +512,7 @@ AuditEnabled[OrgConfig.Name] {
}
tests[{
- "Requirement" : "Mailbox auditing SHALL be enabled",
- "Control" : "EXO 2.13",
+ "PolicyId" : "MS.EXO.13.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-OrganizationConfig"],
"ActualValue" : input.org_config,
@@ -624,18 +523,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.14 #
-#################
-
#
-# Baseline 2.14: Policy 1
+# MS.EXO.14.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "A spam filter SHALL be enabled. The filtering solution selected SHOULD offer services comparable to the native spam filtering offered by Microsoft",
- "Control" : "EXO 2.14",
+ "PolicyId" : "MS.EXO.14.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -647,12 +540,11 @@ tests[{
#--
#
-# Baseline 2.14: Policy 2
+# MS.EXO.14.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder",
- "Control" : "EXO 2.14",
+ "PolicyId" : "MS.EXO.14.2v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -664,12 +556,11 @@ tests[{
#--
#
-# Baseline 2.14: Policy 3
+# MS.EXO.14.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Allowed senders MAY be added, but allowed domains SHALL NOT be added",
- "Control" : "EXO 2.14",
+ "PolicyId" : "MS.EXO.14.3v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -680,18 +571,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.15 #
-#################
-
#
-# Baseline 2.15: Policy 1
+# MS.EXO.15.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "URL comparison with a block-list SHOULD be enabled",
- "Control" : "EXO 2.15",
+ "PolicyId" : "MS.EXO.15.1v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -703,12 +588,11 @@ tests[{
#--
#
-# Baseline 2.15: Policy 2
+# MS.EXO.15.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Direct download links SHOULD be scanned for malware",
- "Control" : "EXO 2.15",
+ "PolicyId" : "MS.EXO.15.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -720,12 +604,11 @@ tests[{
#--
#
-# Baseline 2.15: Policy 3
+# MS.EXO.15.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "User click tracking SHOULD be enabled",
- "Control" : "EXO 2.15",
+ "PolicyId" : "MS.EXO.15.3v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -736,18 +619,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.16 #
-#################
-
#
-# Baseline 2.16: Policy 1
+# MS.EXO.16.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "At a minimum, the following alerts SHALL be enabled...[see Exchange Online secure baseline for list]",
- "Control" : "EXO 2.16",
+ "PolicyId" : "MS.EXO.16.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -759,12 +636,11 @@ tests[{
#--
#
-# Baseline 2.16: Policy 2
+# MS.EXO.16.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "The alerts SHOULD be sent to a monitored address or incorporated into a SIEM",
- "Control" : "EXO 2.16",
+ "PolicyId" : "MS.EXO.16.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -775,18 +651,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.17 #
-#################
-
#
-# Baseline 2.17: Policy 1
+# MS.EXO.17.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Unified audit logging SHALL be enabled",
- "Control" : "EXO 2.17",
+ "PolicyId" : "MS.EXO.17.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -798,12 +668,11 @@ tests[{
#--
#
-# Baseline 2.17: Policy 2
+# MS.EXO.17.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Advanced audit SHALL be enabled",
- "Control" : "EXO 2.17",
+ "PolicyId" : "MS.EXO.17.2v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -815,12 +684,11 @@ tests[{
#--
#
-# Baseline 2.17: Policy 3
+# MS.EXO.17.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31",
- "Control" : "EXO 2.17",
+ "PolicyId" : "MS.EXO.17.3v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
diff --git a/Rego/OneDriveConfig.rego b/Rego/OneDriveConfig.rego
index 46511e2fdc..59172e940d 100644
--- a/Rego/OneDriveConfig.rego
+++ b/Rego/OneDriveConfig.rego
@@ -1,17 +1,11 @@
package onedrive
import future.keywords
+import data.report.utils.NotCheckedDetails
+import data.report.utils.ReportDetailsBoolean
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
-
-
-################
-# Baseline 2.1 #
-################
-
+#--
#
-# Baseline 2.1: Policy 1
+# MS.ONEDRIVE.1.1v1
#--
AnyoneLinksPolicy[Policy]{
Policy := input.SPO_tenant_info[_]
@@ -19,8 +13,7 @@ AnyoneLinksPolicy[Policy]{
}
tests[{
- "Requirement" : "Anyone links SHOULD be disabled",
- "Control" : "OneDrive 2.1",
+ "PolicyId" : "MS.ONEDRIVE.1.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : Policies,
@@ -34,25 +27,20 @@ tests[{
#--
tests[{
- "Requirement" : "Anyone links SHOULD be disabled",
- "Control" : "OneDrive 2.1",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically while using Service Principals. See Onedrive Secure Configuration Baseline policy 2.1 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.ONEDRIVE.1.1v1"
input.OneDrive_PnP_Flag
}
#--
-
-################
-# Baseline 2.2 #
-################
-
#
-# Baseline 2.2: Policy 1
+# MS.ONEDRIVE.2.1v1
#--
ReportDetails2_2(Policy) = Description if {
Policy.OneDriveSharingCapability != 2
@@ -72,8 +60,7 @@ ReportDetails2_2(Policy) = Description if {
}
tests[{
- "Requirement" : "An expiration date SHOULD be set for Anyone links",
- "Control" : "OneDrive 2.2",
+ "PolicyId" : "MS.ONEDRIVE.2.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : [Policy.OneDriveSharingCapability, Policy.RequireAnonymousLinksExpireInDays],
@@ -90,25 +77,36 @@ tests[{
}
tests[{
- "Requirement" : "An expiration date SHOULD be set for Anyone links",
- "Control" : "OneDrive 2.2",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically while using Service Principals. See Onedrive Secure Configuration Baseline policy 2.2 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.ONEDRIVE.2.1v1"
input.OneDrive_PnP_Flag
}
#--
-
-################
-# Baseline 2.3 #
-################
+#
+# MS.ONEDRIVE.2.2v1
+#--
+tests[{
+ "PolicyId" : PolicyId,
+ "Criticality" : "Should/Not-Implemented",
+ "Commandlet" : [],
+ "ActualValue" : [],
+ "ReportDetails" : NotCheckedDetails(PolicyId),
+ "RequirementMet" : false
+}] {
+ PolicyId := "MS.ONEDRIVE.2.2v1"
+ input.OneDrive_PnP_Flag
+}
+#--
#
-# Baseline 2.3: Policy 1
+# MS.ONEDRIVE.3.1v1
#--
ReportDetails2_3(Policy) = Description if {
Policy.OneDriveSharingCapability != 2
@@ -144,8 +142,7 @@ ReportDetails2_3(Policy) = Description if {
}
tests[{
- "Requirement" : "Anyone link permissions SHOULD be limited to View",
- "Control" : "OneDrive 2.3",
+ "PolicyId" : "MS.ONEDRIVE.3.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : [Policy.OneDriveSharingCapability, Policy.FileAnonymousLinkType, Policy.FolderAnonymousLinkType],
@@ -162,25 +159,20 @@ tests[{
}
tests[{
- "Requirement" : "Anyone link permissions SHOULD be limited to View",
- "Control" : "OneDrive 2.3",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically while using Service Principals. See Onedrive Secure Configuration Baseline policy 2.3 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.ONEDRIVE.3.1v1"
input.OneDrive_PnP_Flag
}
#--
-
-################
-# Baseline 2.4 #
-################
-
#
-# Baseline 2.4: Policy 1
+# MS.ONEDRIVE.4.1v1
#--
DefinedDomainsPolicy[Policy]{
Policy := input.Tenant_sync_info[_]
@@ -188,8 +180,7 @@ DefinedDomainsPolicy[Policy]{
}
tests[{
- "Requirement" : "OneDrive Client for Windows SHALL be restricted to agency-Defined Domain(s)",
- "Control" : "OneDrive 2.4",
+ "PolicyId" : "MS.ONEDRIVE.4.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : Policies,
@@ -201,13 +192,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.5 #
-################
-
#
-# Baseline 2.5: Policy 1
+# MS.ONEDRIVE.5.1v1
#--
ClientSyncPolicy[Policy]{
Policy := input.Tenant_sync_info[_]
@@ -216,7 +202,7 @@ ClientSyncPolicy[Policy]{
tests[{
"Requirement" : "OneDrive Client Sync SHALL only be allowed only within the local domain",
- "Control" : "OneDrive 2.5",
+ "PolicyId" : "MS.ONEDRIVE.5.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SPOTenantSyncClientRestriction", "Get-PnPTenantSyncClientRestriction"],
"ActualValue" : Policies,
@@ -228,46 +214,34 @@ tests[{
}
#--
-
-################
-# Baseline 2.6 #
-################
-
#
-# Baseline 2.6: Policy 1
+# MS.ONEDRIVE.6.1v1
#--
-# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "OneDrive Client Sync SHALL be restricted to the local domain",
- "Control" : "OneDrive 2.6",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Onedrive Secure Configuration Baseline policy 2.6 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.ONEDRIVE.6.1v1"
true
}
#--
-
-################
-# Baseline 2.7 #
-################
-
#
-# Baseline 2.7: Policy 1
+# MS.ONEDRIVE.7.1v1
#--
-# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "Legacy Authentication SHALL be blocked",
- "Control" : "OneDrive 2.7",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Onedrive Secure Configuration Baseline policy 2.7 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.ONEDRIVE.7.1v1"
true
}
-#--
+#--
\ No newline at end of file
diff --git a/Rego/PowerPlatformConfig.rego b/Rego/PowerPlatformConfig.rego
index 82b00d63bf..d6f8b42bc2 100644
--- a/Rego/PowerPlatformConfig.rego
+++ b/Rego/PowerPlatformConfig.rego
@@ -1,14 +1,10 @@
package powerplatform
import future.keywords
-
-
-Format(Array) = format_int(count(Array), 10)
-
-Description(String1, String2, String3) = trim(concat(" ", [String1, concat(" ", [String2, String3])]), " ")
-
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
+import data.report.utils.NotCheckedDetails
+import data.report.utils.Format
+import data.report.utils.ReportDetailsBoolean
+import data.report.utils.Description
+import data.report.utils.ReportDetailsString
ReportDetailsArray(Status, Array, String1) = Detail if {
Status == true
@@ -20,27 +16,13 @@ ReportDetailsArray(Status, Array, String1) = Detail if {
String2 := concat(", ", Array)
Detail := Description(Format(Array), String1, String2)
}
-ReportDetailsString(Status, String) = Detail if {
- Status == true
- Detail := "Requirement met"
-}
-
-ReportDetailsString(Status, String) = Detail if {
- Status == false
- Detail := String
-}
-
-
-################
-# Baseline 2.1 #
-################
#
-# Baseline 2.1: Policy 1
+# MS.POWERPLATFORM.1.1v1
#--
tests[{
- "Requirement" : "The ability to create production and sandbox environments SHALL be restricted to admins",
- "Control" : "Power Platform 2.1",
+ #"Requirement" : "The ability to create production and sandbox environments SHALL be restricted to admins",
+ "PolicyId" : "MS.POWERPLATFORM.1.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-TenantSettings"],
"ActualValue" : EnvironmentCreation.disableEnvironmentCreationByNonAdminUsers,
@@ -52,11 +34,11 @@ tests[{
}
#--
-# Baseline 2.1: Policy 1 PoSh Error
+# MS.POWERPLATFORM.1.1v1
#--
tests[{
- "Requirement" : "The ability to create production and sandbox environments SHALL be restricted to admins",
- "Control" : "Power Platform 2.1",
+ #"Requirement" : "The ability to create production and sandbox environments SHALL be restricted to admins",
+ "PolicyId" : "MS.POWERPLATFORM.1.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-TenantSettings"],
"ActualValue" : "PowerShell Error",
@@ -67,7 +49,7 @@ tests[{
}
#--
-#
+# TODO: Resolve Policy Id
# Baseline 2.1: Policy 2
#--
tests[{
@@ -84,7 +66,7 @@ tests[{
}
#--
-#
+# TODO: Resolve Policy Id
# Baseline 2.1: Policy 2 PoSh Error
#--
tests[{
@@ -100,13 +82,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.2 #
-################
-
#
-# Baseline 2.2: Policy 1
+# MS.POWERPLATFORM.2.1v1
#--
DefaultEnvPolicies[{"PolicyName" : Policy.displayName}]{
TenantId := input.tenant_id
@@ -118,8 +95,7 @@ DefaultEnvPolicies[{"PolicyName" : Policy.displayName}]{
# Note: there is only one default environment per tenant and it cannot be deleted or backed up
tests[{
- "Requirement" : "A DLP policy SHALL be created to restrict connector access in the default Power Platform environment",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : DefaultEnvPolicies,
@@ -132,7 +108,7 @@ tests[{
#--
#
-# Baseline 2.2: Policy 2
+# MS.POWERPLATFORM.2.2v1
#--
# gets the list of all tenant environments
AllEnvironments [{ "EnvName" : EnvName }] {
@@ -157,8 +133,7 @@ EnvWithoutPolicies [Env] {
}
tests[{
- "Requirement" : "Non-default environments SHOULD have at least one DLP policy that affects them",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : EnvWithoutPolicies,
@@ -173,11 +148,10 @@ tests[{
#--
#
-# Baseline 2.2: Policy 2 No DLP Policies found
+# MS.POWERPLATFORM.2.2v1
#--
tests[{
- "Requirement" : "Non-default environments SHOULD have at least one DLP policy that affects them",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : "No DLP Policies found",
@@ -190,11 +164,10 @@ tests[{
#--
#
-# Baseline 2.2: Policy 2 PoSh Error
+# MS.POWERPLATFORM.2.2v1
#--
tests[{
- "Requirement" : "Non-default environments SHOULD have at least one DLP policy that affects them",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : "PowerShell Error",
@@ -206,7 +179,7 @@ tests[{
#--
#
-# Baseline 2.2: Policy 3
+# MS.POWERPLATFORM.2.3v1
#--
# gets the set of connectors that are allowed in the default environment
# general and confidential groups refer to business and non-business
@@ -253,8 +226,7 @@ AllowedInBaseline := {
}
tests[{
- "Requirement" : "All connectors except those listed...[see Power Platform secure configuration baseline for list]...SHOULD be added to the Blocked category in the default environment policy",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : RogueConnectors,
@@ -270,11 +242,10 @@ tests[{
#--
#
-# Baseline 2.2: Policy 3 Error No DLP policies Found
+# MS.POWERPLATFORM.2.3v1
#--
tests[{
- "Requirement" : "All connectors except those listed...[see Power Platform secure configuration baseline for list]...SHOULD be added to the Blocked category in the default environment policy",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : "No DLP Policies found",
@@ -287,11 +258,10 @@ tests[{
#--
#
-# Baseline 2.2: Policy 3 PoSh Error
+# MS.POWERPLATFORM.2.3v1
#--
tests[{
- "Requirement" : "All connectors except those listed...[see Power Platform secure configuration baseline for list]...SHOULD be added to the Blocked category in the default environment policy",
- "Control" : "Power Platform 2.2",
+ "PolicyId" : "MS.POWERPLATFORM.2.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-DlpPolicy"],
"ActualValue" : "PowerShell error",
@@ -302,17 +272,11 @@ tests[{
}
#--
-
-################
-# Baseline 2.3 #
-################
-
#
-# Baseline 2.3: Policy 1
+# MS.POWERPLATFORM.3.1v1
#--
tests[{
- "Requirement" : "Power Platform tenant isolation SHALL be enabled",
- "Control" : "Power Platform 2.3",
+ "PolicyId" : "MS.POWERPLATFORM.3.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-PowerAppTenantIsolationPolicy"],
"ActualValue" : TenantIsolation.properties.isDisabled,
@@ -325,11 +289,10 @@ tests[{
#--
#
-# Baseline 2.3: Policy 1 PoSh Error
+# MS.POWERPLATFORM.3.1v1
#--
tests[{
- "Requirement" : "Power Platform tenant isolation SHALL be enabled",
- "Control" : "Power Platform 2.3",
+ "PolicyId" : "MS.POWERPLATFORM.3.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-PowerAppTenantIsolationPolicy"],
"ActualValue" : "PowerShell Error",
@@ -341,40 +304,51 @@ tests[{
#--
#
-# Baseline 2.3: Policy 2
+# MS.POWERPLATFORM.3.2v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "An inbound/outbound connection allowlist SHOULD be configured",
- "Control" : "Power Platform 2.3",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Power Platform Secure Configuration Baseline policy 2.3 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.POWERPLATFORM.3.2v1"
true
}
#--
-
-################
-# Baseline 2.4 #
-################
+#
+# MS.POWERPLATFORM.3.3v1
+#--
+tests[{
+ "PolicyId" : PolicyId,
+ "Criticality" : "Should/Not-Implemented",
+ "Commandlet" : [],
+ "ActualValue" : [],
+ "ReportDetails" : NotCheckedDetails(PolicyId),
+ "RequirementMet" : false
+}] {
+ PolicyId := "MS.POWERPLATFORM.3.3v1"
+ true
+}
+#--
#
-# Baseline 2.4: Policy 1
+# MS.POWERPLATFORM.4.1v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "Content security policies for model-driven Power Apps SHALL be enabled",
- "Control" : "Power Platform 2.4",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Power Platform Secure Configuration Baseline policy 2.4 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.POWERPLATFORM.4.1v1"
true
}
#--
\ No newline at end of file
diff --git a/Rego/SharepointConfig.rego b/Rego/SharepointConfig.rego
index ce3ef93fbc..459b7b46e9 100644
--- a/Rego/SharepointConfig.rego
+++ b/Rego/SharepointConfig.rego
@@ -1,21 +1,13 @@
package sharepoint
import future.keywords
-
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
-
-
-################
-# Baseline 2.1 #
-################
+import data.report.utils.NotCheckedDetails
+import data.report.utils.ReportDetailsBoolean
#
-# Baseline 2.1: Policy 1
+# MS.SHAREPOINT.1.1v1
#--
tests[{
- "Requirement" : "File and folder links default sharing setting SHALL be set to \"Specific People (Only the People the User Specifies)\"",
- "Control" : "Sharepoint 2.1",
+ "PolicyId" : "MS.SHAREPOINT.1.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : Policy.DefaultSharingLinkType,
@@ -26,18 +18,27 @@ tests[{
Status := Policy.DefaultSharingLinkType == 1
}
#--
-
-
-################
-# Baseline 2.2 #
-################
+#
+# MS.SHAREPOINT.1.2v1
+#--
+tests[{
+ "PolicyId" : PolicyId,
+ "Criticality" : "Shall/Not-Implemented",
+ "Commandlet" : [],
+ "ActualValue" : [],
+ "ReportDetails" : NotCheckedDetails(PolicyId),
+ "RequirementMet" : false
+}] {
+ PolicyId := "MS.SHAREPOINT.1.2v1"
+ true
+}
+#--
#
-# Baseline 2.2: Policy 1
+# MS.SHAREPOINT.1.3v1
#--
tests[{
- "Requirement" : "External sharing SHOULD be limited to approved domains and security groups per interagency collaboration needs",
- "Control" : "Sharepoint 2.2",
+ "PolicyId" : "MS.SHAREPOINT.1.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : Policy.SharingCapability,
@@ -88,29 +89,24 @@ tests[{
################
#
-# Baseline 2.3: Policy 1
+# MS.SHAREPOINT.2.1v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "Sharing settings for specific SharePoint sites SHOULD align to their sensitivity level",
- "Control" : "Sharepoint 2.3",
+ "PolicyId" : PolicyId,
"Criticality" : "Should/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Sharepoint Secure Configuration Baseline policy 2.3 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.SHAREPOINT.2.1v1"
true
}
#--
-
-################
-# Baseline 2.4 #
-################
-
#
-# Baseline 2.4: Policy 1
+# MS.SHAREPOINT.3.1v1
#--
ReportDetails2_4_1(Policy) = Description if {
Policy.SharingCapability == 0
@@ -146,8 +142,7 @@ ReportDetails2_4_1(Policy) = Description if {
}
tests[{
- "Requirement" : "Expiration timer for 'Guest access to a site or OneDrive' should be set to 30 days",
- "Control" : "Sharepoint 2.4",
+ "PolicyId" : "MS.SHAREPOINT.3.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-SPOTenant", "Get-PnPTenant"],
"ActualValue" : [Policy.SharingCapability, Policy.ExternalUserExpirationRequired, Policy.ExternalUserExpireInDays],
@@ -166,7 +161,7 @@ tests[{
}
#--
-#
+# TODO: Resolve Policy Id
# Baseline 2.4: Policy 2
#--
ReportDetails2_4_2(Policy) = Description if {
@@ -223,29 +218,26 @@ tests[{
}
#--
-
-################
-# Baseline 2.5 #
-################
-
-#
+# TODO: Resolve Policy Id
# Baseline 2.5: Policy 1
#--
# At this time we are unable to test for X because of Y
tests[{
"Requirement" : "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)",
"Control" : "Sharepoint 2.5",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/Not-Implemented",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Currently cannot be checked automatically. See Sharepoint Secure Configuration Baseline policy 2.5 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.SHAREPOINT.TBD"
true
}
#--
-#
+# TODO: Resolve Policy Id
# Baseline 2.5: Policy 2
#--
tests[{
diff --git a/Rego/TeamsConfig.rego b/Rego/TeamsConfig.rego
index 649885e04e..c6a6f11f58 100644
--- a/Rego/TeamsConfig.rego
+++ b/Rego/TeamsConfig.rego
@@ -1,13 +1,18 @@
+################
+# Teams Baseline
+################
+
+#
+# Reference: Secure Baseline file, teams.md
+#--
+# This file implements controls/policies documented in the secure baseline. The tests.PolicyId
+# (e.g., MS.TEAMS.1.1v1) aligns this files to the secure baseline control.
package teams
import future.keywords
-
-Format(Array) = format_int(count(Array), 10)
-
-Description(String1, String2, String3) = trim(concat(" ", [String1, concat(" ", [String2, String3])]), " ")
-
-ReportDetailsBoolean(Status) = "Requirement met" if {Status == true}
-
-ReportDetailsBoolean(Status) = "Requirement not met" if {Status == false}
+import data.report.utils.NotCheckedDetails
+import data.report.utils.Format
+import data.report.utils.ReportDetailsBoolean
+import data.report.utils.Description
ReportDetailsArray(Status, Array, String1) = Detail if {
Status == true
@@ -20,23 +25,8 @@ ReportDetailsArray(Status, Array, String1) = Detail if {
Detail := Description(Format(Array), String1, String2)
}
-ReportDetailsString(Status, String) = Detail if {
- Status == true
- Detail := "Requirement met"
-}
-
-ReportDetailsString(Status, String) = Detail if {
- Status == false
- Detail := String
-}
-
-
-################
-# Baseline 2.1 #
-################
-
#
-# Baseline 2.1: Policy 1
+# MS.TEAMS.1.1v1
#--
# The english translation of the following is:
# Iterate through all meeting policies. For each, check if AllowExternalParticipantGiveRequestControl
@@ -47,8 +37,7 @@ MeetingsAllowingExternalControl[Policy.Identity] {
}
tests[{
- "Requirement" : "External participants SHOULD NOT be enabled to request control of shared desktops or windows in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist",
- "Control" : "Teams 2.1",
+ "PolicyId" : "MS.TEAMS.1.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : Policies,
@@ -61,13 +50,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.2 #
-################
-
#
-# Baseline 2.2: Policy 1
+# MS.TEAMS.2.1v1
#--
MeetingsAllowingAnonStart[Policy.Identity] {
Policy := input.meeting_policies[_]
@@ -75,8 +59,7 @@ MeetingsAllowingAnonStart[Policy.Identity] {
}
tests[{
- "Requirement" : "Anonymous users SHALL NOT be enabled to start meetings in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist",
- "Control" : "Teams 2.2",
+ "PolicyId" : "MS.TEAMS.2.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : Policies,
@@ -89,13 +72,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.3 #
-################
-
#
-# Baseline 2.3: Policy 1
+# MS.TEAMS.3.1v1
#--
ReportDetails2_3(Policy) = Description if {
Policy.AutoAdmittedUsers != "Everyone"
@@ -115,8 +93,7 @@ ReportDetails2_3(Policy) = Description if {
}
tests[{
- "Requirement" : "Anonymous users, including dial-in users, SHOULD NOT be admitted automatically",
- "Control" : "Teams 2.3",
+ "PolicyId" : "MS.TEAMS.3.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : [Policy.AutoAdmittedUsers, Policy.AllowPSTNUsersToBypassLobby],
@@ -131,8 +108,7 @@ tests[{
}
tests[{
- "Requirement" : "Anonymous users, including dial-in users, SHOULD NOT be admitted automatically",
- "Control" : "Teams 2.3",
+ "PolicyId" : "MS.TEAMS.3.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : "PowerShell Error",
@@ -144,11 +120,10 @@ tests[{
#--
#
-# Baseline 2.3: Policy 2
+# MS.TEAMS.3.2v1
#--
tests[{
- "Requirement" : "Internal users SHOULD be admitted automatically",
- "Control" : "Teams 2.3",
+ "PolicyId" : "MS.TEAMS.3.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : Policy.AutoAdmittedUsers,
@@ -162,11 +137,10 @@ tests[{
}
#
-# Baseline 2.3: Policy 2
+# MS.TEAMS.3.2v1
#--
tests[{
- "Requirement" : "Internal users SHOULD be admitted automatically",
- "Control" : "Teams 2.3",
+ "PolicyId" : "MS.TEAMS.3.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : "PowerShell Error",
@@ -177,13 +151,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.4 #
-################
-
#
-# Baseline 2.4: Policy 1
+# MS.TEAMS.4.1v1
#--
ExternalAccessConfig[Policy.Identity] {
Policy := input.federation_configuration[_]
@@ -193,8 +162,7 @@ ExternalAccessConfig[Policy.Identity] {
}
tests[{
- "Requirement" : "External access SHALL only be enabled on a per-domain basis",
- "Control" : "Teams 2.4",
+ "PolicyId" : "MS.TEAMS.4.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-CsTenantFederationConfiguration"],
"ActualValue" : Policies,
@@ -230,13 +198,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.5 #
-################
-
#
-# Baseline 2.5: Policy 1
+# MS.TEAMS.5.1v1
#--
# There are two relevant settings:
# - AllowTeamsConsumer: Is contact to or from unmanaged users allowed at all?
@@ -262,8 +225,7 @@ FederationConfiguration[Policy.Identity] {
}
tests[{
- "Requirement" : "Unmanaged users SHALL NOT be enabled to initiate contact with internal users",
- "Control" : "Teams 2.5",
+ "PolicyId" : "MS.TEAMS.5.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-CsTenantFederationConfiguration"],
"ActualValue" : Policies,
@@ -277,7 +239,7 @@ tests[{
#--
#
-# Baseline 2.5: Policy 2
+# MS.TEAMS.5.2v1
#--
InternalCannotenable[Policy.Identity] {
Policy := input.federation_configuration[_]
@@ -285,8 +247,7 @@ InternalCannotenable[Policy.Identity] {
}
tests[{
- "Requirement" : "Internal users SHOULD NOT be enabled to initiate contact with unmanaged users",
- "Control" : "Teams 2.5",
+ "PolicyId" : "MS.TEAMS.5.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTenantFederationConfiguration"],
"ActualValue" : Policies,
@@ -299,13 +260,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.6 #
-################
-
#
-# Baseline 2.6: Policy 1
+# MS.TEAMS.6.1v1
#--
SkpyeBlocConfig[Policy.Identity] {
Policy := input.federation_configuration[_]
@@ -313,8 +269,7 @@ SkpyeBlocConfig[Policy.Identity] {
}
tests[{
- "Requirement" : "Contact with Skype users SHALL be blocked",
- "Control" : "Teams 2.6",
+ "PolicyId" : "MS.TEAMS.6.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-CsTenantFederationConfiguration"],
"ActualValue" : Policies,
@@ -327,13 +282,8 @@ tests[{
}
#--
-
-################
-# Baseline 2.7 #
-################
-
#
-# Baseline 2.7: Policy 1
+# MS.TEAMS.7.1v1
#--
ConfigsAllowingEmail[Policy.Identity] {
Policy := input.client_configuration[_]
@@ -358,8 +308,7 @@ ReportDetails2_7(IsGCC, IsEnabled) = Description if {
}
tests[{
- "Requirement" : "Teams email integration SHALL be disabled",
- "Control" : "Teams 2.7",
+ "PolicyId" : "MS.TEAMS.7.1v1",
"Criticality" : "Shall",
"Commandlet" : ["Get-CsTeamsClientConfiguration", "Get-CsTenant"],
"ActualValue" : {"ClientConfig": input.client_configuration, "AssignedPlans": AssignedPlans},
@@ -380,15 +329,21 @@ tests[{
Conditions := [IsEnabled, IsGCC]
Status := count([Condition | Condition = Conditions[_]; Condition == true]) > 0
}
-#--
-
-################
-# Baseline 2.8 #
-################
+tests[{
+ "PolicyId" : "MS.TEAMS.7.1v1",
+ "Criticality" : "Shall",
+ "Commandlet" : ["Get-CsTeamsClientConfiguration"],
+ "ActualValue" : "PowerShell Error",
+ "ReportDetails" : "PowerShell Error",
+ "RequirementMet" : false
+}] {
+ count(input.teams_tenant_info) == 0
+}
+#--
#
-# Baseline 2.8: Policy 1
+# MS.TEAMS.8.1v1
#--
PoliciesBlockingDefaultApps[Policy.Identity] {
Policy := input.app_policies[_]
@@ -396,8 +351,7 @@ PoliciesBlockingDefaultApps[Policy.Identity] {
}
tests[{
- "Requirement" : "Agencies SHOULD allow all apps published by Microsoft, but MAY block specific Microsoft apps as needed",
- "Control" : "Teams 2.8",
+ "PolicyId" : "MS.TEAMS.8.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsAppPermissionPolicy"],
"ActualValue" : Policies,
@@ -411,7 +365,7 @@ tests[{
#--
#
-# Baseline 2.8: Policy 2
+# MS.TEAMS.8.2v1
#--
PoliciesAllowingGlobalApps[Policy.Identity] {
Policy := input.app_policies[_]
@@ -424,8 +378,7 @@ PoliciesAllowingCustomApps[Policy.Identity] {
}
tests[{
- "Requirement" : "Agencies SHOULD NOT allow installation of all third-party apps, but MAY allow specific apps as needed",
- "Control" : "Teams 2.8",
+ "PolicyId" : "MS.TEAMS.8.2v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsAppPermissionPolicy"],
"ActualValue" : Policies,
@@ -438,8 +391,7 @@ tests[{
}
tests[{
- "Requirement" : "Agencies SHOULD NOT allow installation of all custom apps, but MAY allow specific apps as needed",
- "Control" : "Teams 2.8",
+ "PolicyId" : "MS.TEAMS.8.2av1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsAppPermissionPolicy"],
"ActualValue" : Policies,
@@ -453,33 +405,27 @@ tests[{
#--
#
-# Baseline 2.8: Policy 3
+# MS.TEAMS.8.3v1
#--
# At this time we are unable to test for X because of Y
tests[{
- "Requirement" : "Agencies SHALL establish policy dictating the app review and approval process to be used by the agency",
- "Control" : "Teams 2.8",
+ "PolicyId" : PolicyId,
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
- "ReportDetails" : "Cannot be checked automatically. See Microsoft Teams Secure Configuration Baseline policy 2.8 for instructions on manual check",
+ "ReportDetails" : NotCheckedDetails(PolicyId),
"RequirementMet" : false
}] {
+ PolicyId := "MS.TEAMS.8.3v1"
true
}
#--
-
-################
-# Baseline 2.9 #
-################
-
#
-# Baseline 2.9: Policy 1
+# MS.TEAMS.9.1v1
#--
tests[{
- "Requirement" : "Cloud video recording SHOULD be disabled in the global (org-wide default) meeting policy",
- "Control" : "Teams 2.9",
+ "PolicyId" : "MS.TEAMS.9.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : Policy.AllowCloudRecording,
@@ -492,11 +438,10 @@ tests[{
}
#
-# Baseline 2.9: Policy 1
+# MS.TEAMS.9.1v1
#--
tests[{
- "Requirement" : "Cloud video recording SHOULD be disabled in the global (org-wide default) meeting policy",
- "Control" : "Teams 2.9",
+ "PolicyId" : "MS.TEAMS.9.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : "PowerShell Error",
@@ -508,7 +453,7 @@ tests[{
#--
#
-# Baseline 2.9: Policy 2
+# MS.TEAMS.9.3v1
#--
PoliciesAllowingOutsideRegionStorage[Policy.Identity] {
Policy := input.meeting_policies[_]
@@ -517,8 +462,7 @@ PoliciesAllowingOutsideRegionStorage[Policy.Identity] {
}
tests[{
- "Requirement" : "For all meeting polices that allow cloud recording, recordings SHOULD be stored inside the country of that agency's tenant",
- "Control" : "Teams 2.9",
+ "PolicyId" : "MS.TEAMS.9.3v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingPolicy"],
"ActualValue" : Policies,
@@ -531,17 +475,11 @@ tests[{
}
#--
-
-#################
-# Baseline 2.10 #
-#################
-
#
-# Baseline 2.10: Policy 1
+# MS.TEAMS.10.1v1
#--
tests[{
- "Requirement" : "Record an event SHOULD be set to Organizer can record",
- "Control" : "Teams 2.10",
+ "PolicyId" : "MS.TEAMS.10.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingBroadcastPolicy"],
"ActualValue" : Policy.BroadcastRecordingMode,
@@ -554,11 +492,10 @@ tests[{
}
#
-# Baseline 2.10: Policy 1
+# MS.TEAMS.10.1v1
#--
tests[{
- "Requirement" : "Record an event SHOULD be set to Organizer can record",
- "Control" : "Teams 2.10",
+ "PolicyId" : "MS.TEAMS.10.1v1",
"Criticality" : "Should",
"Commandlet" : ["Get-CsTeamsMeetingBroadcastPolicy"],
"ActualValue" : "PowerShell Error",
@@ -569,18 +506,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.11 #
-#################
-
#
-# Baseline 2.11: Policy 1
+# MS.TEAMS.11.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "A DLP solution SHALL be enabled",
- "Control" : "Teams 2.11",
+ "PolicyId" : "MS.TEAMS.11.1v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -592,12 +523,11 @@ tests[{
#--
#
-# Baseline 2.11: Policy 2
+# MS.TEAMS.11.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Agencies SHOULD use either the native DLP solution offered by Microsoft or a DLP solution that offers comparable services",
- "Control" : "Teams 2.11",
+ "PolicyId" : "MS.TEAMS.11.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -609,12 +539,11 @@ tests[{
#--
#
-# Baseline 2.11: Policy 3
+# MS.TEAMS.11.4v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "The DLP solution SHALL protect Personally Identifiable Information (PII) and sensitive information, as defined by the agency. At a minimum, the sharing of credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) via email SHALL be restricted",
- "Control" : "Teams 2.11",
+ "PolicyId" : "MS.TEAMS.11.4v1",
"Criticality" : "Shall/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -625,18 +554,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.12 #
-#################
-
#
-# Baseline 2.12: Policy 1
+# MS.TEAMS.12.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Attachments included with Teams messages SHOULD be scanned for malware",
- "Control" : "Teams 2.12",
+ "PolicyId" : "MS.TEAMS.12.1v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -648,12 +571,11 @@ tests[{
#--
#
-# Baseline 2.12: Policy 2
+# MS.TEAMS.12.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Users SHOULD be prevented from opening or downloading files detected as malware",
- "Control" : "Teams 2.12",
+ "PolicyId" : "MS.TEAMS.12.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -664,18 +586,12 @@ tests[{
}
#--
-
-#################
-# Baseline 2.13 #
-#################
-
#
-# Baseline 2.13: Policy 1
+# MS.TEAMS.13.1v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "URL comparison with a block-list SHOULD be enabled",
- "Control" : "Teams 2.13",
+ "PolicyId" : "MS.TEAMS.13.1v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -687,12 +603,11 @@ tests[{
#--
#
-# Baseline 2.13: Policy 2
+# MS.TEAMS.13.2v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "Direct download links SHOULD be scanned for malware",
- "Control" : "Teams 2.13",
+ "PolicyId" : "MS.TEAMS.13.2v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
@@ -704,12 +619,11 @@ tests[{
#--
#
-# Baseline 2.13: Policy 3
+# MS.TEAMS.13.3v1
#--
# At this time we are unable to test because settings are configured in M365 Defender or using a third-party app
tests[{
- "Requirement" : "User click tracking SHOULD be enabled",
- "Control" : "Teams 2.13",
+ "PolicyId" : "MS.TEAMS.13.3v1",
"Criticality" : "Should/3rd Party",
"Commandlet" : [],
"ActualValue" : [],
diff --git a/Rego/Utils/ReportUtils.rego b/Rego/Utils/ReportUtils.rego
new file mode 100644
index 0000000000..f8460f06de
--- /dev/null
+++ b/Rego/Utils/ReportUtils.rego
@@ -0,0 +1,62 @@
+package report.utils
+import future.keywords
+
+#
+BaselineVersion() := moduleVersion if {
+ not input.module_version
+ moduleVersion := "main"
+}
+
+BaselineVersion() := moduleVersion if {
+ moduleVersion := input.module_version
+}
+
+#baselineVersion := "3.0.0." # Baseline version is pinned to a module version
+ScubaBaseUrl := sprintf("https://github.com/cisagov/ScubaGear/blob/%v/baselines/", [BaselineVersion()])
+
+################
+# Helper functions for this file
+################
+
+PolicyAnchor(PolicyId) := anchor if {
+ anchor := sprintf("#%v", [replace(lower(PolicyId), ".", "")])
+}
+
+PolicyProduct(PolicyId) := product if {
+ dotIndexes := indexof_n(PolicyId, ".")
+ product := lower(substring(PolicyId, 3, dotIndexes[1]-dotIndexes[0]-1))
+}
+
+PolicyLink(PolicyId) := link if {
+ link := sprintf("Secure Configuration Baseline policy", [ScubaBaseUrl, PolicyProduct(PolicyId), PolicyAnchor(PolicyId)])
+}
+
+################
+# The report formatting functions below are generic and used throughout the policies #
+################
+
+#
+NotCheckedDetails(PolicyId) := details if {
+ link := PolicyLink(PolicyId)
+ details := sprintf("Not currently checked automatically. See %v for instructions on manual check", [link])
+}
+
+#
+Format(Array) := format_int(count(Array), 10)
+
+#
+ReportDetailsBoolean(Status) := "Requirement met" if {Status == true}
+ReportDetailsBoolean(Status) := "Requirement not met" if {Status == false}
+
+#
+Description(String1, String2, String3) := trim(concat(" ", [String1, concat(" ", [String2, String3])]), " ")
+
+#
+ReportDetailsString(Status, String) := Detail if {
+ Status == true
+ Detail := "Requirement met"
+}
+ReportDetailsString(Status, String) := Detail if {
+ Status == false
+ Detail := String
+}
\ No newline at end of file
diff --git a/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/TestResults.json b/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/TestResults.json
index 356d90a3de..ed79cc0e36 100644
--- a/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/TestResults.json
+++ b/Testing/Unit/PowerShell/CreateReport/CreateReportStubs/TestResults.json
@@ -1,2465 +1,2318 @@
[
- {
- "ActualValue": false,
- "Commandlet": "Get-MgPolicyAdminConsentRequestPolicy",
- "Control": "AAD 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "An admin consent workflow SHALL be configured",
- "RequirementMet": false
- },
- {
- "ActualValue": true,
- "Commandlet": "Get-MgPolicyAuthorizationPolicy",
- "Control": "AAD 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Only administrators SHALL be allowed to register third-party applications",
- "RequirementMet": false
- },
- {
- "ActualValue": "",
- "Commandlet": "Get-MgDirectoryRoleMember",
- "Control": "AAD 2.12",
- "Criticality": "Shall",
- "ReportDetails": "0 admin(s) that are not cloud-only found",
- "Requirement": "Users that need to be assigned to highly privileged Azure AD roles SHALL be provisioned cloud-only accounts that are separate from the on-premises directory or other federated identity providers",
- "RequirementMet": true
- },
- {
- "ActualValue": "Role ID : 10dae51f-b6af-4016-8d66-8c2a99b929b3",
- "Commandlet": "Get-MgPolicyAuthorizationPolicy",
- "Control": "AAD 2.18",
- "Criticality": "Should",
- "ReportDetails": "Permission level set to \"Limited access\"",
- "Requirement": "Guest users SHOULD have limited access to Azure AD directory objects",
- "RequirementMet": true
- },
- {
- "ActualValue": "[ManagePermissionGrantsForSelf.microsoft-user-default-legacy]",
- "Commandlet": "Get-MgPolicyAuthorizationPolicy",
- "Control": "AAD 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Only administrators SHALL be allowed to consent to third-party applications",
- "RequirementMet": false
- },
- {
- "ActualValue": "everyone",
- "Commandlet": "Get-MgPolicyAuthorizationPolicy",
- "Control": "AAD 2.18",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Only users with the Guest Inviter role SHOULD be able to invite guest users",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.18",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.18 for instructions on manual check",
- "Requirement": "Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.2",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.2 for instructions on manual check",
- "Requirement": "A notification SHOULD be sent to the administrator when high-risk users are detected",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.4",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
- "Requirement": "If phishing-resistant MFA cannot be used, an MFA method from the list [see AAD baseline 2.4] SHALL be used in the interim",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.4",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
- "Requirement": "Phishing-resistant MFA SHALL be used for all users",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.4",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.4 for instructions on manual check",
- "Requirement": "SMS or Voice as the MFA method SHALL NOT be used",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.5",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.5 for instructions on manual check",
- "Requirement": "The following critical logs SHALL be sent at a minimum: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.5",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.5 for instructions on manual check",
- "Requirement": "The logs SHALL be sent to the agency\u0027s SOC for monitoring",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "AAD 2.8",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Azure Active Directory Secure Configuration Baseline policy 2.8 for instructions on manual check",
- "Requirement": "User passwords SHALL NOT expire",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.1",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Legacy authentication SHALL be blocked",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.10",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Browser sessions SHALL not be persistent",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.13",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "MFA SHALL be required for user access to highly privileged roles",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.17",
- "Criticality": "Should",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Managed devices SHOULD be required for authentication",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.2",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Users detected as high risk SHALL be blocked",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.3",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Sign-ins detected as high risk SHALL be blocked",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.4",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "MFA SHALL be required for all users",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-MgIdentityConditionalAccessPolicy",
- "Control": "AAD 2.9",
- "Criticality": "Shall",
- "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements",
- "Requirement": "Sign-in frequency SHALL be configured to 12 hours",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Application Administrator",
- "Cloud Application Administrator",
- "Exchange Administrator",
- "Global Administrator",
- "Hybrid Identity Administrator",
- "Privileged Role Administrator",
- "SharePoint Administrator",
- "User Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.14",
- "Criticality": "Shall",
- "ReportDetails": "8 role(s) configured to allow permanent active assignment or expiration period too long:\u003cbr/\u003eApplication Administrator, Cloud Application Administrator, Exchange Administrator, Global Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator, User Administrator",
- "Requirement": "Permanent active role assignments SHALL NOT be allowed for highly privileged roles. Active assignments SHALL have an expiration period.",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Application Administrator",
- "Cloud Application Administrator",
- "Exchange Administrator",
- "Global Administrator",
- "Hybrid Identity Administrator",
- "Privileged Role Administrator",
- "SharePoint Administrator",
- "User Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.15",
- "Criticality": "Should",
- "ReportDetails": "8 role(s) that do not require approval to activate found:\u003cbr/\u003eApplication Administrator, Cloud Application Administrator, Exchange Administrator, Global Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator, User Administrator",
- "Requirement": "Activation of highly privileged roles SHOULD require approval",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Application Administrator",
- "Cloud Application Administrator",
- "Exchange Administrator",
- "Global Administrator",
- "Hybrid Identity Administrator",
- "Privileged Role Administrator",
- "SharePoint Administrator",
- "User Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.16",
- "Criticality": "Shall",
- "ReportDetails": "8 role(s) without notification e-mail configured for role assignments found:\u003cbr/\u003eApplication Administrator, Cloud Application Administrator, Exchange Administrator, Global Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator, User Administrator",
- "Requirement": "Eligible and Active highly privileged role assignments SHALL trigger an alert",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Application Administrator",
- "Cloud Application Administrator",
- "Exchange Administrator",
- "Global Administrator",
- "Hybrid Identity Administrator",
- "Privileged Role Administrator",
- "SharePoint Administrator",
- "User Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.16",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "User activation of the Global Administrator role SHALL trigger an alert",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Application Administrator",
- "Cloud Application Administrator",
- "Exchange Administrator",
- "Hybrid Identity Administrator",
- "Privileged Role Administrator",
- "SharePoint Administrator",
- "User Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.16",
- "Criticality": "Should",
- "ReportDetails": "7 role(s) without notification e-mail configured for role activations found:\u003cbr/\u003eApplication Administrator, Cloud Application Administrator, Exchange Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator, User Administrator",
- "Requirement": "User activation of other highly privileged roles SHOULD trigger an alert",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "FNU LNU"
- ],
- "Commandlet": "Get-MgDirectoryRoleMember",
- "Control": "AAD 2.11",
- "Criticality": "Shall",
- "ReportDetails": "1 global admin(s) found:\u003cbr/\u003eFNU LNU",
- "Requirement": "A minimum of two users and a maximum of four users SHALL be provisioned with the Global Administrator role",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Global Administrator"
- ],
- "Commandlet": "Get-MgRoleManagementDirectoryRoleAssignmentScheduleInstance",
- "Control": "AAD 2.14",
- "Criticality": "Shall",
- "ReportDetails": "1 role(s) assigned to users outside of PIM:\u003cbr/\u003eGlobal Administrator",
- "Requirement": "Provisioning of users to highly privileged roles SHALL NOT occur outside of a PAM system, such as the Azure AD PIM service, because this bypasses the controls the PAM system provides",
- "RequirementMet": false
- },
- {
- "ActualValue": false,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "All safety tips SHALL be enabled: domain impersonation default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": false,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "All safety tips SHALL be enabled: first contact default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": false,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "All safety tips SHALL be enabled: user impersonation default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": false,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "All safety tips SHALL be enabled: user impersonation unusual characters default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHALL be enabled: \"?\" for unauthenticated senders for spoof default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHALL be enabled: \"via\" tag default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for phishing: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for spam messages: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Spam safety tips SHOULD be turned on: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": 7,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": 15,
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Spam in quarantine SHOULD be retained for at least 30 days: default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "MoveToJmf",
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Mail classified as spoofed SHALL be quarantined: default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "MoveToJmf",
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "High confidence spam SHALL be moved to either the junk email folder or the quarantine folder: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": "MoveToJmf",
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Spam SHALL be moved to either the junk email folder or the quarantine folder: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": "MoveToJmf",
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Phishing SHALL be quarantined: default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "MoveToJmf",
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": "NoAction",
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: domains default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "NoAction",
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: mailbox default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "NoAction",
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: users default policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "Quarantine",
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "High confidence phishing SHALL be quarantined: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Defender 2.10",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.10 for instructions on manual check",
- "Requirement": "Advanced audit SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Defender 2.10",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.10 for instructions on manual check",
- "Requirement": "Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.2 for instructions on manual check",
- "Requirement": "A list of apps that are not allowed to access files protected by DLP policy SHOULD be defined",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.2 for instructions on manual check",
- "Requirement": "A list of browsers that are not allowed to access files protected by DLP policy SHOULD be defined",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Defender 2.9",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Defender Secure Configuration Baseline policy 2.9 for instructions on manual check",
- "Requirement": "The alerts SHOULD be sent to a monitored address or incorporated into a SIEM",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AdminAuditLogConfig"
- ],
- "Control": "Defender 2.10",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Unified audit logging SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "No users are included for targeted user protection.",
- "Requirement": "User impersonation protection SHOULD be enabled for key agency leaders",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: \"?\" for unauthenticated senders for spoof non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: \"via\" tag non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: domain impersonation non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: first contact non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: user impersonation non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "All safety tips SHOULD be enabled: user impersonation unusual characters non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Mail classified as spoofed SHOULD be quarantined: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: domains non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: mailbox non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: users non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Domain impersonation protection SHOULD be enabled for domains owned by the agency",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Intelligence for impersonation protection SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AntiPhishPolicy"
- ],
- "Control": "Defender 2.5",
- "Criticality": "Should",
- "ReportDetails": "The Custom Domains protection policies: Enabled, EnableTargetedDomainsProtection, and TargetedDomainsToProtect are not set correctly",
- "Requirement": "Domain impersonation protection SHOULD be added for frequent partners",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-AtpPolicyForO365"
- ],
- "Control": "Defender 2.8",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Safe attachments SHOULD be enabled for SharePoint, OneDrive, and Microsoft Teams",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-DLPCompliancePolicy"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "No policy found that applies to OneDrive.",
- "Requirement": "The custom policy SHOULD be applied in OneDrive",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-DlpComplianceRule"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Shall",
- "ReportDetails": "No matching rule found for U.S. Individual Taxpayer Identification Number (ITIN)",
- "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Individual Taxpayer Identification Number (ITIN)",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-DlpComplianceRule"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Shall",
- "ReportDetails": "No matching rule found for U.S. Social Security Number (SSN)",
- "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Social Security Number (SSN)",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-EOPProtectionPolicyRule"
- ],
- "Control": "Defender 2.1",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Standard Preset security profiles SHOULD NOT be used",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-EOPProtectionPolicyRule"
- ],
- "Control": "Defender 2.1",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Strict Preset security profiles SHOULD NOT be used",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Allowed senders MAY be added but allowed domains SHALL NOT be added: default policy",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Allowed senders MAY be added but allowed domains SHOULD NOT be added: non-default",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "High confidence phishing SHOULD be quarantined: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "High confidence spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Phishing SHOULD be quarantined: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Spam in quarantine SHOULD be retained for at least 30 days: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Spam safety tips SHOULD be turned on: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: non-default policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for Spam: non-default",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for phishing: non-default",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-HostedContentFilterPolicy"
- ],
- "Control": "Defender 2.6",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled: non-default",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-MalwareFilterPolicy"
- ],
- "Control": "Defender 2.3",
- "Criticality": "Should",
- "ReportDetails": "No malware policies found that block .cmd files.",
- "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: cmd files",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-MalwareFilterPolicy"
- ],
- "Control": "Defender 2.3",
- "Criticality": "Should",
- "ReportDetails": "No malware policies found that block .exe files.",
- "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: exe files",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-MalwareFilterPolicy"
- ],
- "Control": "Defender 2.3",
- "Criticality": "Should",
- "ReportDetails": "No malware policies found that block .vbe files.",
- "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: vbe files",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-MalwareFilterPolicy"
- ],
- "Control": "Defender 2.4",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Zero-hour Auto Purge (ZAP) for malware SHOULD be enabled in the default anti-malware policy and in all existing custom policies",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeAttachmentPolicy",
- "Get-SafeAttachmentRule",
- "Get-AcceptedDomain"
- ],
- "Control": "Defender 2.8",
- "Criticality": "Shall",
- "ReportDetails": "No enabled policy found with action set to block that apply to all domains",
- "Requirement": "The action for malware in email attachments SHALL be set to block",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeAttachmentPolicy",
- "Get-SafeAttachmentRule",
- "Get-AcceptedDomain"
- ],
- "Control": "Defender 2.8",
- "Criticality": "Should",
- "ReportDetails": "No enabled policy found with action set to block and at least one contact specified",
- "Requirement": "Redirect emails with detected attachments to an agency-specified email SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeAttachmentRule",
- "Get-AcceptedDomain"
- ],
- "Control": "Defender 2.8",
- "Criticality": "Shall",
- "ReportDetails": "No policy found that applies to all domains: tqhjy.onmicrosoft.com",
- "Requirement": "At least one Safe Attachments Policy SHALL include all agency domains-and by extension-all users",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Internal agency email messages SHALL have safe links enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Malicious link click checking SHALL be enabled with Microsoft Teams",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Real-time suspicious URL and file-link scanning SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Safe Links in Office 365 apps SHALL be turned on",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "URL rewriting and malicious link click checking SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "URLs SHALL be scanned completely before message delivery",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "User click tracking SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksPolicy",
- "Get-SafeLinksRule"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "Users SHALL NOT be enabled to click through to the original URL",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SafeLinksRule",
- "Get-AcceptedDomain"
- ],
- "Control": "Defender 2.7",
- "Criticality": "Shall",
- "ReportDetails": "No policy found that applies to all domains: tqhjy.onmicrosoft.com",
- "Requirement": "The Safe Links Policy SHALL include all agency domains-and by extension-all users",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Default"
- ],
- "Commandlet": [
- "Get-MalwareFilterPolicy"
- ],
- "Control": "Defender 2.3",
- "Criticality": "Shall",
- "ReportDetails": "1 malware policy(ies) found that do(es) not have the common attachments filter enabled: Default",
- "Requirement": "The common attachments filter SHALL be enabled in the default anti-malware policy and in all existing policies",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Default Teams DLP policy rule"
- ],
- "Commandlet": [
- "Get-DlpComplianceRule"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "1 rule(s) found that do(es) not notify at least one user: Default Teams DLP policy rule",
- "Requirement": "Notifications to inform users and help educate them on the proper use of sensitive information SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Default Teams DLP policy rule",
- "Items containing 1-9 credit card numbers shared externally",
- "Items with 10 or more credit card numbers shared externally"
- ],
- "Commandlet": [
- "Get-DlpComplianceRule"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: Credit Card Number",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- "Default Teams DLP policy rule",
- "Items containing 1-9 credit card numbers shared externally",
- "Items with 10 or more credit card numbers shared externally"
- ],
- "Commandlet": [
- "Get-DlpComplianceRule"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "3 rule(s) found that do(es) not block access: Default Teams DLP policy rule, Items containing 1-9 credit card numbers shared externally, Items with 10 or more credit card numbers shared externally",
- "Requirement": "The action for the DLP policy SHOULD be set to block sharing sensitive information with everyone when DLP conditions are met",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Malware campaign detected after delivery",
- "Unusual increase in email reported as phish"
- ],
- "Commandlet": [
- "Get-ProtectionAlert"
- ],
- "Control": "Defender 2.9",
- "Criticality": "Shall",
- "ReportDetails": "2 disabled required alert(s) found: Malware campaign detected after delivery, Unusual increase in email reported as phish",
- "Requirement": "At a minimum, the alerts required by the Exchange Online Minimum Viable Secure Configuration Baseline SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "Locations": [
- "All"
- ],
- "Name": "Default Office 365 DLP policy",
- "Workload": "Exchange, SharePoint, OneDriveForBusiness"
- }
- ],
- "Commandlet": [
- "Get-DLPCompliancePolicy"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "The custom policy SHOULD be applied in Exchange",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- {
- "Locations": [
- "All"
- ],
- "Name": "Default Office 365 DLP policy",
- "Workload": "Exchange, SharePoint, OneDriveForBusiness"
- }
- ],
- "Commandlet": [
- "Get-DLPCompliancePolicy"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "The custom policy SHOULD be applied in SharePoint",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- {
- "Locations": [
- "All"
- ],
- "Name": "Default policy for Teams",
- "Workload": "Exchange, SharePoint, OneDriveForBusiness, Teams"
- }
- ],
- "Commandlet": [
- "Get-DLPCompliancePolicy"
- ],
- "Control": "Defender 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "The custom policy SHOULD be applied in Teams",
- "RequirementMet": true
- },
- {
- "ActualValue": false,
- "Commandlet": "Get-HostedConnectionFilterPolicy",
- "Control": "EXO 2.12",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Safe lists SHOULD NOT be enabled",
- "RequirementMet": true
- },
- {
- "ActualValue": false,
- "Commandlet": "Get-OrganizationConfig",
- "Control": "EXO 2.13",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Mailbox auditing SHALL be enabled",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": "Get-TransportConfig",
- "Control": "EXO 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "SMTP AUTH SHALL be disabled in Exchange Online",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.10",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Emails SHALL be scanned for malware",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.10",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Emails identified as containing malware SHALL be quarantined or dropped",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.10",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Email scanning SHOULD be capable of reviewing emails after delivery",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.11",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Impersonation protection checks SHOULD be used",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.11",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "The phishing protection solution SHOULD include an AI-based phishing detection tool comparable to EOP Mailbox Intelligence",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.11",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.14",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "A spam filter SHALL be enabled. The filtering solution selected SHOULD offer services comparable to the native spam filtering offered by Microsoft",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.14",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Allowed senders MAY be added, but allowed domains SHALL NOT be added",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.14",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.15",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Direct download links SHOULD be scanned for malware",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.15",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "URL comparison with a block-list SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.15",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "User click tracking SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.16",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "At a minimum, the following alerts SHALL be enabled...[see Exchange Online secure baseline for list]",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.16",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "The alerts SHOULD be sent to a monitored address or incorporated into a SIEM",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.17",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Advanced audit SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.17",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.17",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Unified audit logging SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.2",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Exchange Online Secure Configuration Baseline policy 2.# for instructions on manual check",
- "Requirement": "A list of approved IP addresses for sending mail SHALL be maintained",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.8",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "A DLP solution SHALL be used. The selected DLP solution SHOULD offer services comparable to the native DLP solution offered by Microsoft",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.8",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "The DLP solution SHALL protect PII and sensitive information, as defined by the agency. At a minimum, the sharing of credit card numbers, Taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) via email SHALL be restricted",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.9",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe)",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.9",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Emails SHALL be filtered by the file types of included attachments. The selected filtering solution SHOULD offer services comparable to Microsoft Defender\u0027s Common Attachment Filter",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "",
- "Control": "EXO 2.9",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "The attachment filter SHOULD attempt to determine the true file type and assess the file extension",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-HostedConnectionFilterPolicy",
- "Control": "EXO 2.12",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "IP allow lists SHOULD NOT be created",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Get-TransportRule",
- "Control": "EXO 2.7",
- "Criticality": "Shall",
- "ReportDetails": "No transport rule found with that applies to emails received from outside the organization",
- "Requirement": "External sender warnings SHALL be implemented",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Anonymous:CalendarSharingFreeBusyReviewer",
- "*:CalendarSharingFreeBusySimple"
- ],
- "Commandlet": "Get-SharingPolicy",
- "Control": "EXO 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Calendar details SHALL NOT be shared with all domains, although they MAY be shared with specific domains",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- "Anonymous:CalendarSharingFreeBusyReviewer",
- "*:CalendarSharingFreeBusySimple"
- ],
- "Commandlet": "Get-SharingPolicy",
- "Control": "EXO 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Contact folders SHALL NOT be shared with all domains, although they MAY be shared with specific domains",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- [
- {
- "domain": "tqhjy.onmicrosoft.com",
- "rdata": ""
- }
- ],
- [
-
- ]
- ],
- "Commandlet": "Get-DkimSigningConfig, Resolve-DnsName",
- "Control": "EXO 2.3",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "DKIM SHOULD be enabled for any custom domain",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- {
- "domain": "tqhjy.onmicrosoft.com",
- "rdata": ""
- }
- ],
- "Commandlet": "Resolve-DnsName",
- "Control": "EXO 2.4",
- "Criticality": "Shall",
- "ReportDetails": "1 of 1 agency domain(s) found in violation: tqhjy.onmicrosoft.com",
- "Requirement": "A DMARC policy SHALL be published for every second-level domain",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "domain": "tqhjy.onmicrosoft.com",
- "rdata": ""
- }
- ],
- "Commandlet": "Resolve-DnsName",
- "Control": "EXO 2.4",
- "Criticality": "Shall",
- "ReportDetails": "1 of 1 agency domain(s) found in violation: tqhjy.onmicrosoft.com",
- "Requirement": "An agency point of contact SHOULD be included for aggregate and/or failure reports",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "domain": "tqhjy.onmicrosoft.com",
- "rdata": ""
- }
- ],
- "Commandlet": "Resolve-DnsName",
- "Control": "EXO 2.4",
- "Criticality": "Shall",
- "ReportDetails": "1 of 1 agency domain(s) found in violation: tqhjy.onmicrosoft.com",
- "Requirement": "The DMARC message rejection option SHALL be \"p=reject\"",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "domain": "tqhjy.onmicrosoft.com",
- "rdata": ""
- }
- ],
- "Commandlet": "Resolve-DnsName",
- "Control": "EXO 2.4",
- "Criticality": "Shall",
- "ReportDetails": "1 of 1 agency domain(s) found in violation: tqhjy.onmicrosoft.com",
- "Requirement": "The DMARC point of contact for aggregate reports SHALL include reports@dmarc.cyber.dhs.gov",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": "Resolve-DnsName",
- "Control": "EXO 2.2",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "An SPF policy(s) that designates only these addresses as approved senders SHALL be published",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- "*"
- ],
- "Commandlet": "Get-RemoteDomain",
- "Control": "EXO 2.1",
- "Criticality": "Shall",
- "ReportDetails": "1 remote domain(s) that allows automatic forwarding: *",
- "Requirement": "Automatic forwarding to external domains SHALL be disabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "OneDrive 2.6",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Onedrive Secure Configuration Baseline policy 2.6 for instructions on manual check",
- "Requirement": "OneDrive Client Sync SHALL be restricted to the local domain",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "OneDrive 2.7",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Onedrive Secure Configuration Baseline policy 2.7 for instructions on manual check",
- "Requirement": "Legacy Authentication SHALL be blocked",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "OneDrive 2.1",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Anyone links SHOULD be disabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "OneDrive 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "An expiration date SHOULD be set for Anyone links",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "OneDrive 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Expiration date SHOULD be set to thirty days",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "OneDrive 2.3",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Anyone link permissions SHOULD be limited to View",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "OneDrive 2.4",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "OneDrive Client for Windows SHALL be restricted to agency-Defined Domain(s)",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "AllowedDomainList": [
-
- ],
- "BlockMacSync": false,
- "DisableReportProblemDialog": false,
- "ExcludedFileExtensions": [
- ""
- ],
- "OptOutOfGrooveBlock": false,
- "OptOutOfGrooveSoftBlock": false,
- "TenantRestrictionEnabled": false
- }
- ],
- "Commandlet": [
- "Get-SPOTenantSyncClientRestriction"
- ],
- "Control": "OneDrive 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "OneDrive Client Sync SHALL only be allowed only within the local domain",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Sharepoint 2.3",
- "Criticality": "Should/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Sharepoint Secure Configuration Baseline policy 2.3 for instructions on manual check",
- "Requirement": "Sharing settings for specific SharePoint sites SHOULD align to their sensitivity level",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Sharepoint 2.5",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently cannot be checked automatically. See Sharepoint Secure Configuration Baseline policy 2.5 for instructions on manual check",
- "Requirement": "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "Sharepoint 2.1",
- "Criticality": "Shall",
- "ReportDetails": "Requirement not met",
- "Requirement": "File and folder links default sharing setting SHALL be set to \"Specific People (Only the People the User Specifies)\"",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "Sharepoint 2.2",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "External sharing SHOULD be limited to approved domains and security groups per interagency collaboration needs",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "Sharepoint 2.4",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Expiration timers SHOULD be set to 30 days",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-SPOTenant"
- ],
- "Control": "Sharepoint 2.4",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Expiration timers for \u0027guest access to a site or OneDrive\u0027 and \u0027people who use a verification code\u0027 SHOULD be set",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- {
- "AllowDownloadingNonWebViewableFiles": false,
- "AllowEditing": true,
- "AllowSelfServiceUpgrade": true,
- "AnonymousLinkExpirationInDays": 0,
- "AuthenticationContextName": null,
- "BlockDownloadLinksFileType": 1,
- "BlockDownloadPolicy": false,
- "CommentsOnSitePagesDisabled": false,
- "CompatibilityLevel": 15,
- "ConditionalAccessPolicy": 0,
- "DefaultLinkPermission": 0,
- "DefaultLinkToExistingAccess": false,
- "DefaultShareLinkRole": 0,
- "DefaultShareLinkScope": 0,
- "DefaultSharingLinkType": 0,
- "DenyAddAndCustomizePages": 2,
- "DisableAppViews": 2,
- "DisableCompanyWideSharingLinks": 2,
- "DisableFlows": 2,
- "DisableSharingForNonOwnersStatus": null,
- "ExcludeBlockDownloadPolicySiteOwners": false,
- "ExcludedBlockDownloadGroupIds": [
-
- ],
- "ExternalUserExpirationInDays": 0,
- "GroupId": "00000000-0000-0000-0000-000000000000",
- "HubSiteId": "00000000-0000-0000-0000-000000000000",
- "InformationBarriersMode": "",
- "InformationSegment": [
-
- ],
- "IsHubSite": false,
- "IsTeamsChannelConnected": false,
- "IsTeamsConnected": false,
- "LastContentModifiedDate": "/Date(1669883125563)/",
- "LimitedAccessFileType": 1,
- "LocaleId": 1033,
- "LockIssue": null,
- "LockState": "Unlock",
- "LoopDefaultSharingLinkRole": 0,
- "LoopDefaultSharingLinkScope": -1,
- "LoopOverrideSharingCapability": false,
- "LoopSharingCapability": 2,
- "MediaTranscription": 0,
- "OverrideBlockUserInfoVisibility": 0,
- "OverrideSharingCapability": false,
- "OverrideTenantAnonymousLinkExpirationPolicy": false,
- "OverrideTenantExternalUserExpirationPolicy": false,
- "Owner": "efb52a3c-c813-4e58-855e-63e4bfb5a20e",
- "PWAEnabled": 1,
- "ReadOnlyForUnmanagedDevices": false,
- "RelatedGroupId": "00000000-0000-0000-0000-000000000000",
- "RequestFilesLinkEnabled": true,
- "RequestFilesLinkExpirationInDays": -1,
- "ResourceQuota": 300,
- "ResourceQuotaWarningLevel": 255,
- "ResourceUsageAverage": 0,
- "ResourceUsageCurrent": 0,
- "RestrictedAccessControl": false,
- "RestrictedToGeo": 3,
- "SandboxedCodeActivationCapability": 2,
- "SensitivityLabel": null,
- "SharingAllowedDomainList": "",
- "SharingBlockedDomainList": "",
- "SharingCapability": 2,
- "SharingDomainRestrictionMode": 0,
- "SharingLockDownCanBeCleared": true,
- "SharingLockDownEnabled": false,
- "ShowPeoplePickerSuggestionsForGuestUsers": false,
- "SiteDefinedSharingCapability": 2,
- "SocialBarOnSitePagesDisabled": false,
- "Status": "Active",
- "StorageQuota": 26214400,
- "StorageQuotaType": null,
- "StorageQuotaWarningLevel": 25574400,
- "StorageUsageCurrent": 1,
- "TeamsChannelType": 0,
- "Template": "SITEPAGEPUBLISHING#0",
- "Title": "Communication site",
- "Url": "https://tqhjy.sharepoint.com/",
- "WebsCount": 1
- }
- ],
- "Commandlet": [
- "Get-SPOSite"
- ],
- "Control": "Sharepoint 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Users SHALL be prevented from running custom scripts on self-service created sites",
- "RequirementMet": true
- },
- {
- "ActualValue": true,
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.9",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Cloud video recording SHOULD be disabled in the global (org-wide default) meeting policy",
- "RequirementMet": false
- },
- {
- "ActualValue": "AlwaysEnabled",
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.10",
- "Criticality": "Should",
- "ReportDetails": "Requirement not met",
- "Requirement": "Record an event SHOULD be set to Organizer can record",
- "RequirementMet": false
- },
- {
- "ActualValue": "EveryoneInCompany",
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.3",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Internal users SHOULD be admitted automatically",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.11",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "A DLP solution SHALL be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.11",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "The DLP solution SHALL protect Personally Identifiable Information (PII) and sensitive information, as defined by the agency. At a minimum, the sharing of credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) via email SHALL be restricted",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.11",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Agencies SHOULD use either the native DLP solution offered by Microsoft or a DLP solution that offers comparable services",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.12",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Attachments included with Teams messages SHOULD be scanned for malware",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.12",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Users SHOULD be prevented from opening or downloading files detected as malware",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.13",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "Direct download links SHOULD be scanned for malware",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.13",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "URL comparison with a block-list SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.13",
- "Criticality": "Should/3rd Party",
- "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
- "Requirement": "User click tracking SHOULD be enabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
-
- ],
- "Control": "Teams 2.8",
- "Criticality": "Shall/3rd Party",
- "ReportDetails": "Cannot be checked automatically. See Microsoft Teams Secure Configuration Baseline policy 2.8 for instructions on manual check",
- "Requirement": "Agencies SHALL establish policy dictating the app review and approval process to be used by the agency",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "EveryoneInCompany",
- false
- ],
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.3",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Anonymous users, including dial-in users, SHOULD NOT be admitted automatically",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- [
- "Global"
- ],
- "MicrosoftCommunicationsOnline/NOAM-ED6-A5"
- ],
- "Commandlet": [
- "Get-CsTeamsClientConfiguration"
- ],
- "Control": "Teams 2.7",
- "Criticality": "Shall",
- "ReportDetails": "1 Requirement not met: Email integration is enabled across domain: Global",
- "Requirement": "Teams email integration SHALL be disabled",
- "RequirementMet": false
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTeamsAppPermissionPolicy"
- ],
- "Control": "Teams 2.8",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Agencies SHOULD allow all apps published by Microsoft, but MAY block specific Microsoft apps as needed",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.1",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "External participants SHOULD NOT be enabled to request control of shared desktops or windows in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.2",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Anonymous users SHALL NOT be enabled to start meetings in the Global (Org-wide default) meeting policy or in custom meeting policies if any exist",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.4",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Anonymous users SHOULD be enabled to join meetings",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTeamsMeetingPolicy"
- ],
- "Control": "Teams 2.9",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "For all meeting polices that allow cloud recording, recordings SHOULD be stored inside the country of that agencyGs tenant",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTenantFederationConfiguration"
- ],
- "Control": "Teams 2.4",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "External access SHALL only be enabled on a per-domain basis",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTenantFederationConfiguration"
- ],
- "Control": "Teams 2.5",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Unmanaged users SHALL NOT be enabled to initiate contact with internal users",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTenantFederationConfiguration"
- ],
- "Control": "Teams 2.5",
- "Criticality": "Should",
- "ReportDetails": "Requirement met",
- "Requirement": "Internal users SHOULD NOT be enabled to initiate contact with unmanaged users",
- "RequirementMet": true
- },
- {
- "ActualValue": [
-
- ],
- "Commandlet": [
- "Get-CsTenantFederationConfiguration"
- ],
- "Control": "Teams 2.6",
- "Criticality": "Shall",
- "ReportDetails": "Requirement met",
- "Requirement": "Contact with Skype users SHALL be blocked",
- "RequirementMet": true
- },
- {
- "ActualValue": [
- "Global"
- ],
- "Commandlet": [
- "Get-CsTeamsAppPermissionPolicy"
- ],
- "Control": "Teams 2.8",
- "Criticality": "Should",
- "ReportDetails": "1 meeting policy(ies) found that allow custom apps by default: Global",
- "Requirement": "Agencies SHOULD NOT allow installation of all custom apps, but MAY allow specific apps as needed",
- "RequirementMet": false
- },
- {
- "ActualValue": [
- "Global"
- ],
- "Commandlet": [
- "Get-CsTeamsAppPermissionPolicy"
- ],
- "Control": "Teams 2.8",
- "Criticality": "Should",
- "ReportDetails": "1 meeting policy(ies) found that allow third-party apps by default: Global",
- "Requirement": "Agencies SHOULD NOT allow installation of all third-party apps, but MAY allow specific apps as needed",
- "RequirementMet": false
- }
-]
+ {
+ "ActualValue": "",
+ "Commandlet": [
+ "Get-MgSubscribedSku",
+ "Get-PrivilegedUser"
+ ],
+ "Criticality": "Shall",
+ "PolicyId": "MS.AAD.12.1v1",
+ "ReportDetails": "0 admin(s) that are not cloud-only found",
+ "RequirementMet": true
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.4.2v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.4.3v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.4.4v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.5.1v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.5.4v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Shall/Not-Implemented",
+ "PolicyId": "MS.AAD.8.1v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Should/Not-Implemented",
+ "PolicyId": "MS.AAD.18.2v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Should/Not-Implemented",
+ "PolicyId": "MS.AAD.2.2v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Should/Not-Implemented",
+ "PolicyId": "MS.AAD.5.2v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": [],
+ "Commandlet": [],
+ "Criticality": "Should/Not-Implemented",
+ "PolicyId": "MS.AAD.5.3v1",
+ "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": {
+ "all_allow_invite_values": [
+ {
+ "AllowInvitesFromValue": "everyone",
+ "PolicyId": "authorizationPolicy"
+ }
+ ]
+ },
+ "Commandlet": [
+ "Get-MgPolicyAuthorizationPolicy"
+ ],
+ "Criticality": "Should",
+ "PolicyId": "MS.AAD.18.1v1",
+ "ReportDetails": "Permission level set to \"everyone\" (authorizationPolicy)",
+ "RequirementMet": false
+ },
+ {
+ "ActualValue": {
+ "all_allowed_create_values": [
+ {
+ "DefaultUser_AllowedToCreateApps": true,
+ "PolicyId": "authorizationPolicy"
+ }
+ ]
+ },
+ "Commandlet": [
+ "Get-MgPolicyAuthorizationPolicy"
+ ],
+ "Criticality": "Shall",
+ "PolicyId": "MS.AAD.6.1v1",
+ "ReportDetails": "1 authorization policies found that allow non-admin users to register third-party applications:authorizationPolicy", + "RequirementMet": false + }, + { + "ActualValue": { + "all_consent_policies": [ + { + "IsEnabled": true, + "PolicyId": null + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAdminConsentRequestPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": { + "all_grant_policy_values": [ + { + "DefaultUser_DefaultGrantPolicy": [ + "ManagePermissionGrantsForSelf.microsoft-user-default-legacy" + ], + "PolicyId": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.1v1", + "ReportDetails": "1 authorization policies found that allow non-admin users to consent to third-party applications:
authorizationPolicy", + "RequirementMet": false + }, + { + "ActualValue": { + "all_roleid_values": [ + { + "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", + "GuestUserRoleIdString": "Limited access", + "Id": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.18.3v1", + "ReportDetails": "Permission level set to \"Limited access\" (authorizationPolicy)", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.9.1v1", + "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.17.1v1", + "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", + "RequirementMet": false + }, + { + "ActualValue": [ + "Addam Schroll", + "Andrew Huynh", + "Grant Dasher", + "Nanda Katikaneni", + "Shanti Satyapal", + "Ted Kolovos", + "Thomas Comeau" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedUser" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.11.1v1", + "ReportDetails": "7 global admin(s) found:
Addam Schroll, Andrew Huynh, Grant Dasher, Nanda Katikaneni, Shanti Satyapal, Ted Kolovos, Thomas Comeau", + "RequirementMet": false + }, + { + "ActualValue": [ + "Application Administrator", + "Cloud Application Administrator", + "Hybrid Identity Administrator", + "Privileged Role Administrator", + "SharePoint Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.15.1v1", + "ReportDetails": "5 role(s) that do not require approval to activate found:
Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Exchange Administrator", + "Global Administrator", + "Privileged Role Administrator", + "SharePoint Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.14.2v1", + "ReportDetails": "4 role(s) assigned to users outside of PIM:
Exchange Administrator, Global Administrator, Privileged Role Administrator, SharePoint Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global Administrator", + "SharePoint Administrator", + "User Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.14.1v1", + "ReportDetails": "3 role(s) configured to allow permanent active assignment or expiration period too long:
Global Administrator, SharePoint Administrator, User Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Live - Block legacy authentication" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.1.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Block legacy authentication. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - MFA Required for Everyone" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.4.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA Required for Everyone. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - MFA required for Highly Privileged Roles" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole", + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.13.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA required for Highly Privileged Roles. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.10.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Risky Sign Ins Block Access" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.3.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Sign Ins Block Access. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Risky Users Block Access" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.2.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Users Block Access. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Privileged Role Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.16.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "Privileged Role Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.16.3v1", + "ReportDetails": "1 role(s) without notification e-mail configured for role activations found:
Privileged Role Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Privileged Role Administrator", + "User Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.16.1v1", + "ReportDetails": "2 role(s) without notification e-mail configured for role assignments found:
Privileged Role Administrator, User Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + { + "Name": "EnableGroupSpecificConsent", + "SettingsGroup": "Consent Policy Settings", + "Value": "false" + } + ], + "Commandlet": [ + "Get-MgDirectorySetting" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: domain impersonation default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: user impersonation default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: user impersonation unusual characters default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.8v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHALL be enabled: \"?\" for unauthenticated senders for spoof default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHALL be enabled: \"via\" tag default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for phishing: default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for spam messages: default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.7v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.6v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": 7, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": 15, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.7v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "High confidence spam SHALL be moved to either the junk email folder or the quarantine folder: default policy", + "RequirementMet": true + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.3v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: domains default policy", + "RequirementMet": false + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: mailbox default policy", + "RequirementMet": false + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.6v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "Quarantine", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "High confidence phishing SHALL be quarantined: default policy", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.DEFENDER.10.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.DEFENDER.10.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.2.5v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.2.6v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.9.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: \"?\" for unauthenticated senders for spoof non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: \"via\" tag non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: domain impersonation non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: first contact non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: user impersonation non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: user impersonation unusual characters non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Mail classified as spoofed SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: domains non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: mailbox non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: users non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.1v1", + "ReportDetails": "No users are included for targeted user protection.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.2v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.3v1", + "ReportDetails": "The Custom Domains protection policies: Enabled, EnableTargetedDomainsProtection, and TargetedDomainsToProtect are not set correctly", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to OneDrive.", + "Requirement": "The custom policy SHOULD be applied in OneDrive", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to SharePoint.", + "Requirement": "The custom policy SHOULD be applied in SharePoint", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to Teams.", + "Requirement": "The custom policy SHOULD be applied in Teams", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.2v1", + "ReportDetails": "No policy found that applies to Exchange.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Control": "Defender 2.2", + "Criticality": "Shall", + "ReportDetails": "No matching rule found for Credit Card Number", + "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: Credit Card Number", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Control": "Defender 2.2", + "Criticality": "Shall", + "ReportDetails": "No matching rule found for U.S. Individual Taxpayer Identification Number (ITIN)", + "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Individual Taxpayer Identification Number (ITIN)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.2.1v1", + "ReportDetails": "No matching rule found for U.S. Social Security Number (SSN)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-EOPProtectionPolicyRule" + ], + "Control": "Defender 2.1", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Strict Preset security profiles SHOULD NOT be used", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-EOPProtectionPolicyRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.1.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Allowed senders MAY be added but allowed domains SHOULD NOT be added: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "High confidence phishing SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "High confidence spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Phishing SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam in quarantine SHOULD be retained for at least 30 days: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam safety tips SHOULD be turned on: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for Spam: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for phishing: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.8v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.3.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentPolicy", + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.8.2v1", + "ReportDetails": "No enabled policy found with action set to block that apply to all domains", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentPolicy", + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.8.3v1", + "ReportDetails": "No enabled policy found with action set to block and at least one contact specified", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.8.1v1", + "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.2v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.3v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.4v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.6v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.7v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.8v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.9v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.1v1", + "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", + "RequirementMet": false + }, + { + "ActualValue": [ + "A potentially malicious URL click was detected", + "Malware campaign detected after delivery", + "Messages have been delayed", + "Suspicious Email Forwarding Activity", + "Suspicious connector activity", + "Suspicious email sending patterns detected", + "Tenant restricted from sending unprovisioned email", + "Unusual increase in email reported as phish", + "User restricted from sending email" + ], + "Commandlet": [ + "Get-ProtectionAlert" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.9.1v1", + "ReportDetails": "9 disabled required alert(s) found: A potentially malicious URL click was detected, Malware campaign detected after delivery, Messages have been delayed, Suspicious Email Forwarding Activity, Suspicious connector activity, Suspicious email sending patterns detected, Tenant restricted from sending unprovisioned email, Unusual increase in email reported as phish, User restricted from sending email", + "RequirementMet": false + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Control": "Defender 2.3", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: cmd files", + "RequirementMet": true + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Control": "Defender 2.3", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: vbe files", + "RequirementMet": true + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.3.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "EnableATPForSPOTeamsODB": true, + "Identity": "Default" + } + ], + "Commandlet": [ + "Get-AtpPolicyForO365" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.8.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "Identity": "Admin Audit Log Settings", + "UnifiedAuditLogIngestionEnabled": true + } + ], + "Commandlet": [ + "Get-AdminAuditLogConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.10.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.10.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.10.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.16.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.8.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.8.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.9.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.9.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.EXO.2.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.10.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.16.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.9.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.4.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-TransportRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.7.1v1", + "ReportDetails": "No transport rule found that applies warnings to emails received from outside the organization", + "RequirementMet": false + }, + { + "ActualValue": [ + [], + [ + null + ] + ], + "Commandlet": [ + "Get-DkimSigningConfig", + "Get-ScubaDkimRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.3.1v1", + "ReportDetails": "1 of 1 agency domain(s) found in violation: alexwilber.myo365.site", + "RequirementMet": false + }, + { + "ActualValue": [ + { + "AddressBookPolicyRoutingEnabled": false, + "AdminDisplayName": "", + "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, + "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, + "AllowLegacyTLSClients": false, + "AnonymousSenderToRecipientRatePerHour": 1800, + "AttributionRejectBeforeMServRequest": false, + "AttributionRejectConsumerMessages": false, + "ClearCategories": true, + "ConvertDisclaimerWrapperToEml": false, + "ConvertReportToMessage": false, + "CurrentTransportSystemState": "Green", + "DSNConversionMode": "PreserveDSNBody", + "DiagnosticsAggregationServicePort": 9710, + "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableExternalHTTPMailDelivery": false, + "ExchangeObjectId": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ExternalDelayDsnEnabled": true, + "ExternalDsnDefaultLanguage": null, + "ExternalDsnLanguageDetectionEnabled": true, + "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "ExternalDsnReportingAuthority": null, + "ExternalDsnSendHtml": true, + "ExternalPostmasterAddress": null, + "GenerateCopyOfDSNFor": [], + "Guid": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", + "HeaderPromotionModeSetting": "NoCreate", + "HygieneSuite": "Premium", + "Id": "Transport Settings", + "Identity": "Transport Settings", + "InternalDelayDsnEnabled": true, + "InternalDsnDefaultLanguage": null, + "InternalDsnLanguageDetectionEnabled": true, + "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "InternalDsnReportingAuthority": null, + "InternalDsnSendHtml": true, + "InternalSMTPServers": [], + "IsValid": true, + "JournalArchivingEnabled": false, + "JournalMessageExpirationDays": 0, + "JournalReportDLMemberSubstitutionEnabled": false, + "JournalingReportNdrTo": "u003cu003e", + "LegacyArchiveJournalingEnabled": false, + "LegacyArchiveLiveJournalingEnabled": false, + "LegacyJournalingMigrationEnabled": false, + "MaxAllowedAgentGeneratedMessageDepth": 3, + "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, + "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", + "MaxDumpsterTime": "7.00:00:00", + "MaxReceiveSize": "Unlimited", + "MaxRecipientEnvelopeLimit": "Unlimited", + "MaxSendSize": "Unlimited", + "MessageExpiration": "1.00:00:00", + "MigrationEnabled": true, + "Name": "Transport Settings", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", + "ObjectClass": [ + "top", + "container", + "msExchTransportSettings" + ], + "ObjectState": "Unchanged", + "OpenDomainRoutingEnabled": false, + "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@y2zj1.onmicrosoft.com", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "OtherWellKnownObjects": [], + "PreserveReportBodypart": true, + "QueueDiagnosticsAggregationInterval": "00:01:00", + "RedirectDLMessagesForLegacyArchiveJournaling": false, + "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, + "ReplyAllStormBlockDurationHours": 6, + "ReplyAllStormDetectionMinimumRecipients": 2500, + "ReplyAllStormDetectionMinimumReplies": 10, + "ReplyAllStormProtectionEnabled": true, + "Rfc2231EncodingEnabled": false, + "SafetyNetHoldTime": "7.00:00:00", + "SmtpClientAuthenticationDisabled": true, + "SupervisionTags": [ + "Reject", + "Allow" + ], + "TLSReceiveDomainSecureList": [], + "TLSSendDomainSecureList": [], + "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", + "TransportRuleCollectionAddedRecipientsLimit": 100, + "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", + "TransportRuleConfig": [ + "TransportRuleMinProductVersion:14.0.0.0", + "TransportRuleRegexValidationTimeout:00:00:00.3000000", + "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", + "TransportRuleSizeLimit:8 KB (8,192 bytes)", + "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", + "TransportRuleLimit:300", + "TransportRuleCollectionAddedRecipientsLimit:100" + ], + "TransportRuleLimit": 300, + "TransportRuleMinProductVersion": { + "Build": 0, + "Major": 14, + "MajorRevision": 0, + "Minor": 0, + "MinorRevision": 0, + "Revision": 0 + }, + "TransportRuleRegexValidationTimeout": "00:00:00.3000000", + "TransportRuleSizeLimit": "8 KB (8,192 bytes)", + "TransportSystemState": "", + "VerifySecureSubmitEnabled": false, + "VoicemailJournalingEnabled": true, + "WhenChanged": "/Date(1643184486000)/", + "WhenChangedUTC": "/Date(1643184486000)/", + "WhenCreated": "/Date(1643059670000)/", + "WhenCreatedUTC": "/Date(1643059670000)/", + "Xexch50Enabled": true + } + ], + "Commandlet": [ + "Get-TransportConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.5.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "Default": true, + "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "Domains": [ + "Anonymous:CalendarSharingFreeBusyReviewer", + "*:CalendarSharingFreeBusySimple" + ], + "Enabled": true, + "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "Id": "Default Sharing Policy", + "Identity": "Default Sharing Policy", + "IsValid": true, + "Name": "Default Sharing Policy", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", + "ObjectClass": [ + "top", + "msExchSharingPolicy" + ], + "ObjectState": "Changed", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650761000)/", + "WhenChangedUTC": "/Date(1645650761000)/", + "WhenCreated": "/Date(1645650752000)/", + "WhenCreatedUTC": "/Date(1645650752000)/" + } + ], + "Commandlet": [ + "Get-SharingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.6.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "Default": true, + "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "Domains": [ + "Anonymous:CalendarSharingFreeBusyReviewer", + "*:CalendarSharingFreeBusySimple" + ], + "Enabled": true, + "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "Id": "Default Sharing Policy", + "Identity": "Default Sharing Policy", + "IsValid": true, + "Name": "Default Sharing Policy", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", + "ObjectClass": [ + "top", + "msExchSharingPolicy" + ], + "ObjectState": "Changed", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650761000)/", + "WhenChangedUTC": "/Date(1645650761000)/", + "WhenCreated": "/Date(1645650752000)/", + "WhenCreatedUTC": "/Date(1645650752000)/" + } + ], + "Commandlet": [ + "Get-SharingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.6.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "DirectoryBasedEdgeBlockMode": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableSafeList": false, + "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "IPAllowList": [], + "IPBlockList": [], + "Id": "Default", + "Identity": "Default", + "IsDefault": true, + "IsValid": true, + "Name": "Default", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", + "ObjectClass": [ + "top", + "msExchHostedConnectionFilterPolicy" + ], + "ObjectState": "Unchanged", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650833000)/", + "WhenChangedUTC": "/Date(1645650833000)/", + "WhenCreated": "/Date(1645650828000)/", + "WhenCreatedUTC": "/Date(1645650828000)/" + } + ], + "Commandlet": [ + "Get-HostedConnectionFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.12.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "DirectoryBasedEdgeBlockMode": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableSafeList": false, + "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "IPAllowList": [], + "IPBlockList": [], + "Id": "Default", + "Identity": "Default", + "IsDefault": true, + "IsValid": true, + "Name": "Default", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", + "ObjectClass": [ + "top", + "msExchHostedConnectionFilterPolicy" + ], + "ObjectState": "Unchanged", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650833000)/", + "WhenChangedUTC": "/Date(1645650833000)/", + "WhenCreated": "/Date(1645650828000)/", + "WhenCreatedUTC": "/Date(1645650828000)/" + } + ], + "Commandlet": [ + "Get-HostedConnectionFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.12.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AuditDisabled": false, + "DisplayName": "y2zj1", + "Name": "y2zj1.onmicrosoft.com" + } + ], + "Commandlet": [ + "Get-OrganizationConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.13.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaSpfRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.2.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "*" + ], + "Commandlet": [ + "Get-RemoteDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.1.1v1", + "ReportDetails": "1 remote domain(s) that allows automatic forwarding: *", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.POWERPLATFORM.2.2v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-PowerAppTenantIsolationPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.3.1v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-TenantSettings" + ], + "Control": "Power Platform 2.1", + "Criticality": "Shall", + "ReportDetails": "PowerShell Error", + "Requirement": "The ability to create trial environments SHALL be restricted to admins", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-TenantSettings" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.1.1v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell error", + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.POWERPLATFORM.2.3v1", + "ReportDetails": "PowerShell error", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.4.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.3.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.3.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.2.1v1", + "ReportDetails": "No policy found that applies to default environment", + "RequirementMet": false + }, + { + "ActualValue": 1, + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Should", + "PolicyId": "MS.SHAREPOINT.1.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": 2, + "Commandlet": [ + "Get-SPOSite", + "Get-PnPTenantSite" + ], + "Control": "Sharepoint 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Users SHALL be prevented from running custom scripts on self-service created sites", + "RequirementMet": true + }, + { + "ActualValue": 2, + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Shall", + "PolicyId": "MS.SHAREPOINT.1.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Control": "Sharepoint 2.5", + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.TBD", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "Requirement": "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.1.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.2.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [ + 1, + true, + 29 + ], + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Control": "Sharepoint 2.4", + "Criticality": "Should", + "ReportDetails": "Requirement not met: Expiration timer for 'People who use a verification code' NOT set to 30 days", + "Requirement": "Expiration timer for 'People who use a verification code' should be set to 30 days", + "RequirementMet": false + }, + { + "ActualValue": [ + 1, + true, + 31 + ], + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Should", + "PolicyId": "MS.SHAREPOINT.3.1v1", + "ReportDetails": "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days", + "RequirementMet": false + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.9.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "AlwaysEnabled", + "Commandlet": [ + "Get-CsTeamsMeetingBroadcastPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.10.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "EveryoneInCompany", + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.3.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.11.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.11.4v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.8.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.11.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.12.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.12.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [ + "EveryoneInCompany", + false + ], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.3.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + [], + "MicrosoftCommunicationsOnline/NOAM-ED6-A7" + ], + "Commandlet": [ + "Get-CsTeamsClientConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.7.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Control": "Teams 2.4", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Anonymous users SHOULD be enabled to join meetings", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.2.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.1.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.9.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.6.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.2av1", + "ReportDetails": "1 meeting policy(ies) found that allow custom apps by default: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.2v1", + "ReportDetails": "1 meeting policy(ies) found that allow third-party apps by default: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.5.1v1", + "ReportDetails": "1 Configuration allowed unmanaged users to initiate contact with internal user across domains: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.5.2v1", + "ReportDetails": "1 Internal users are enabled to initiate contact with unmanaged users across domains: Global", + "RequirementMet": false + } +] \ No newline at end of file diff --git a/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 b/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 new file mode 100644 index 0000000000..73414e4ce7 --- /dev/null +++ b/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 @@ -0,0 +1,69 @@ +$CreateReportModulePath = Join-Path -Path $PSScriptRoot -ChildPath "../../../../PowerShell/ScubaGear/Modules/CreateReport/CreateReport.psm1" +Import-Module $CreateReportModulePath -Force + +InModuleScope CreateReport { + + Describe -tag "Markdown" -name 'Check Secure Baseline Markdown document for
authorizationPolicy", - "RequirementMet": false - }, - { - "ActualValue": { - "all_consent_policies": [ - { - "IsEnabled": true, - "PolicyId": null - } - ] - }, - "Commandlet": [ - "Get-MgPolicyAdminConsentRequestPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.7.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": { - "all_grant_policy_values": [ - { - "DefaultUser_DefaultGrantPolicy": [ - "ManagePermissionGrantsForSelf.microsoft-user-default-legacy" - ], - "PolicyId": "authorizationPolicy" - } - ] - }, - "Commandlet": [ - "Get-MgPolicyAuthorizationPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.7.1v1", - "ReportDetails": "1 authorization policies found that allow non-admin users to consent to third-party applications:
authorizationPolicy", - "RequirementMet": false - }, - { - "ActualValue": { - "all_roleid_values": [ - { - "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", - "GuestUserRoleIdString": "Limited access", - "Id": "authorizationPolicy" - } - ] - }, - "Commandlet": [ - "Get-MgPolicyAuthorizationPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.AAD.18.3v1", - "ReportDetails": "Permission level set to \"Limited access\" (authorizationPolicy)", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.9.1v1", - "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.AAD.17.1v1", - "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", - "RequirementMet": false - }, - { - "ActualValue": [ - "Addam Schroll", - "Andrew Huynh", - "Grant Dasher", - "Nanda Katikaneni", - "Shanti Satyapal", - "Ted Kolovos", - "Thomas Comeau" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedUser" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.11.1v1", - "ReportDetails": "7 global admin(s) found:
Addam Schroll, Andrew Huynh, Grant Dasher, Nanda Katikaneni, Shanti Satyapal, Ted Kolovos, Thomas Comeau", - "RequirementMet": false - }, - { - "ActualValue": [ - "Application Administrator", - "Cloud Application Administrator", - "Hybrid Identity Administrator", - "Privileged Role Administrator", - "SharePoint Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Should", - "PolicyId": "MS.AAD.15.1v1", - "ReportDetails": "5 role(s) that do not require approval to activate found:
Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator", - "RequirementMet": false - }, - { - "ActualValue": [ - "Exchange Administrator", - "Global Administrator", - "Privileged Role Administrator", - "SharePoint Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.14.2v1", - "ReportDetails": "4 role(s) assigned to users outside of PIM:
Exchange Administrator, Global Administrator, Privileged Role Administrator, SharePoint Administrator", - "RequirementMet": false - }, - { - "ActualValue": [ - "Global Administrator", - "SharePoint Administrator", - "User Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.14.1v1", - "ReportDetails": "3 role(s) configured to allow permanent active assignment or expiration period too long:
Global Administrator, SharePoint Administrator, User Administrator", - "RequirementMet": false - }, - { - "ActualValue": [ - "Live - Block legacy authentication" - ], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.1.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Block legacy authentication. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Live - MFA Required for Everyone" - ], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.4.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA Required for Everyone. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Live - MFA required for Highly Privileged Roles" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole", - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.13.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA required for Highly Privileged Roles. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency" - ], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.10.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Live - Risky Sign Ins Block Access" - ], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.3.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Sign Ins Block Access. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Live - Risky Users Block Access" - ], - "Commandlet": [ - "Get-MgIdentityConditionalAccessPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.2.1v1", - "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Users Block Access. View all CA policies.", - "RequirementMet": true - }, - { - "ActualValue": [ - "Privileged Role Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.16.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - "Privileged Role Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Should", - "PolicyId": "MS.AAD.16.3v1", - "ReportDetails": "1 role(s) without notification e-mail configured for role activations found:
Privileged Role Administrator", - "RequirementMet": false - }, - { - "ActualValue": [ - "Privileged Role Administrator", - "User Administrator" - ], - "Commandlet": [ - "Get-MgSubscribedSku", - "Get-PrivilegedRole" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.16.1v1", - "ReportDetails": "2 role(s) without notification e-mail configured for role assignments found:
Privileged Role Administrator, User Administrator", - "RequirementMet": false - }, - { - "ActualValue": [ - { - "Name": "EnableGroupSpecificConsent", - "SettingsGroup": "Consent Policy Settings", - "Value": "false" - } - ], - "Commandlet": [ - "Get-MgDirectorySetting" - ], - "Criticality": "Shall", - "PolicyId": "MS.AAD.7.3v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": false, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement not met", - "Requirement": "All safety tips SHALL be enabled: domain impersonation default policy", - "RequirementMet": false - }, - { - "ActualValue": false, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement not met", - "Requirement": "All safety tips SHALL be enabled: user impersonation default policy", - "RequirementMet": false - }, - { - "ActualValue": false, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement not met", - "Requirement": "All safety tips SHALL be enabled: user impersonation unusual characters default policy", - "RequirementMet": false - }, - { - "ActualValue": false, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.5.8v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHALL be enabled: \"?\" for unauthenticated senders for spoof default policy", - "RequirementMet": true - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHALL be enabled: \"via\" tag default policy", - "RequirementMet": true - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for phishing: default policy", - "RequirementMet": true - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for spam messages: default policy", - "RequirementMet": true - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.6.7v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.6.6v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": 7, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.6.1v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": 15, - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.6.5v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "MoveToJmf", - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.5.7v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "MoveToJmf", - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "High confidence spam SHALL be moved to either the junk email folder or the quarantine folder: default policy", - "RequirementMet": true - }, - { - "ActualValue": "MoveToJmf", - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.6.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": "MoveToJmf", - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.6.3v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "MoveToJmf", - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.6.4v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": "NoAction", - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement not met", - "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: domains default policy", - "RequirementMet": false - }, - { - "ActualValue": "NoAction", - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement not met", - "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: mailbox default policy", - "RequirementMet": false - }, - { - "ActualValue": "NoAction", - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.5.6v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "Quarantine", - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "High confidence phishing SHALL be quarantined: default policy", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.DEFENDER.10.2v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.DEFENDER.10.3v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.DEFENDER.2.5v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.DEFENDER.2.6v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.DEFENDER.9.2v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: \"?\" for unauthenticated senders for spoof non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: \"via\" tag non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: domain impersonation non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: first contact non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: user impersonation non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "All safety tips SHOULD be enabled: user impersonation unusual characters non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Mail classified as spoofed SHOULD be quarantined: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: domains non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: mailbox non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Control": "Defender 2.5", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: users non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.5.1v1", - "ReportDetails": "No users are included for targeted user protection.", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.5.2v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.5.3v1", - "ReportDetails": "The Custom Domains protection policies: Enabled, EnableTargetedDomainsProtection, and TargetedDomainsToProtect are not set correctly", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-AntiPhishPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.5.5v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DLPCompliancePolicy" - ], - "Control": "Defender 2.2", - "Criticality": "Should", - "ReportDetails": "No policy found that applies to OneDrive.", - "Requirement": "The custom policy SHOULD be applied in OneDrive", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DLPCompliancePolicy" - ], - "Control": "Defender 2.2", - "Criticality": "Should", - "ReportDetails": "No policy found that applies to SharePoint.", - "Requirement": "The custom policy SHOULD be applied in SharePoint", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DLPCompliancePolicy" - ], - "Control": "Defender 2.2", - "Criticality": "Should", - "ReportDetails": "No policy found that applies to Teams.", - "Requirement": "The custom policy SHOULD be applied in Teams", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DLPCompliancePolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.2.2v1", - "ReportDetails": "No policy found that applies to Exchange.", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpComplianceRule" - ], - "Control": "Defender 2.2", - "Criticality": "Shall", - "ReportDetails": "No matching rule found for Credit Card Number", - "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: Credit Card Number", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpComplianceRule" - ], - "Control": "Defender 2.2", - "Criticality": "Shall", - "ReportDetails": "No matching rule found for U.S. Individual Taxpayer Identification Number (ITIN)", - "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Individual Taxpayer Identification Number (ITIN)", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpComplianceRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.2.1v1", - "ReportDetails": "No matching rule found for U.S. Social Security Number (SSN)", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpComplianceRule" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.2.3v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpComplianceRule" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.2.4v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-EOPProtectionPolicyRule" - ], - "Control": "Defender 2.1", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Strict Preset security profiles SHOULD NOT be used", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-EOPProtectionPolicyRule" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.1.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Allowed senders MAY be added but allowed domains SHOULD NOT be added: non-default", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "High confidence phishing SHOULD be quarantined: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "High confidence spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Phishing SHOULD be quarantined: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Spam in quarantine SHOULD be retained for at least 30 days: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Spam safety tips SHOULD be turned on: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: non-default policies", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for Spam: non-default", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for phishing: non-default", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Control": "Defender 2.6", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled: non-default", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-HostedContentFilterPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.6.8v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-MalwareFilterPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.3.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-MalwareFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.4.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeAttachmentPolicy", - "Get-SafeAttachmentRule", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.8.2v1", - "ReportDetails": "No enabled policy found with action set to block that apply to all domains", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeAttachmentPolicy", - "Get-SafeAttachmentRule", - "Get-AcceptedDomain" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.8.3v1", - "ReportDetails": "No enabled policy found with action set to block and at least one contact specified", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeAttachmentRule", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.8.1v1", - "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.2v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.3v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.4v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.5v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.6v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.7v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.8v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksPolicy", - "Get-SafeLinksRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.9v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-SafeLinksRule", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.7.1v1", - "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", - "RequirementMet": false - }, - { - "ActualValue": [ - "A potentially malicious URL click was detected", - "Malware campaign detected after delivery", - "Messages have been delayed", - "Suspicious Email Forwarding Activity", - "Suspicious connector activity", - "Suspicious email sending patterns detected", - "Tenant restricted from sending unprovisioned email", - "Unusual increase in email reported as phish", - "User restricted from sending email" - ], - "Commandlet": [ - "Get-ProtectionAlert" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.9.1v1", - "ReportDetails": "9 disabled required alert(s) found: A potentially malicious URL click was detected, Malware campaign detected after delivery, Messages have been delayed, Suspicious Email Forwarding Activity, Suspicious connector activity, Suspicious email sending patterns detected, Tenant restricted from sending unprovisioned email, Unusual increase in email reported as phish, User restricted from sending email", - "RequirementMet": false - }, - { - "ActualValue": [ - "Default" - ], - "Commandlet": [ - "Get-MalwareFilterPolicy" - ], - "Control": "Defender 2.3", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: cmd files", - "RequirementMet": true - }, - { - "ActualValue": [ - "Default" - ], - "Commandlet": [ - "Get-MalwareFilterPolicy" - ], - "Control": "Defender 2.3", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: vbe files", - "RequirementMet": true - }, - { - "ActualValue": [ - "Default" - ], - "Commandlet": [ - "Get-MalwareFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.3.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "EnableATPForSPOTeamsODB": true, - "Identity": "Default" - } - ], - "Commandlet": [ - "Get-AtpPolicyForO365" - ], - "Criticality": "Should", - "PolicyId": "MS.DEFENDER.8.4v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "Identity": "Admin Audit Log Settings", - "UnifiedAuditLogIngestionEnabled": true - } - ], - "Commandlet": [ - "Get-AdminAuditLogConfig" - ], - "Criticality": "Shall", - "PolicyId": "MS.DEFENDER.10.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.10.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.10.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.14.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.14.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.14.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.16.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.17.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.17.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.17.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.8.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.8.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.9.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.EXO.9.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.EXO.2.1v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.10.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.11.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.11.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.11.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.15.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.15.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.15.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.16.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.EXO.9.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-ScubaDmarcRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.4.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-ScubaDmarcRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.4.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-ScubaDmarcRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.4.3v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-ScubaDmarcRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Should", - "PolicyId": "MS.EXO.4.4v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-TransportRule" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.7.1v1", - "ReportDetails": "No transport rule found that applies warnings to emails received from outside the organization", - "RequirementMet": false - }, - { - "ActualValue": [ - [], - [ - null - ] - ], - "Commandlet": [ - "Get-DkimSigningConfig", - "Get-ScubaDkimRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Should", - "PolicyId": "MS.EXO.3.1v1", - "ReportDetails": "1 of 1 agency domain(s) found in violation: alexwilber.myo365.site", - "RequirementMet": false - }, - { - "ActualValue": [ - { - "AddressBookPolicyRoutingEnabled": false, - "AdminDisplayName": "", - "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, - "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, - "AllowLegacyTLSClients": false, - "AnonymousSenderToRecipientRatePerHour": 1800, - "AttributionRejectBeforeMServRequest": false, - "AttributionRejectConsumerMessages": false, - "ClearCategories": true, - "ConvertDisclaimerWrapperToEml": false, - "ConvertReportToMessage": false, - "CurrentTransportSystemState": "Green", - "DSNConversionMode": "PreserveDSNBody", - "DiagnosticsAggregationServicePort": 9710, - "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", - "EnableExternalHTTPMailDelivery": false, - "ExchangeObjectId": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", - "ExchangeVersion": "0.1 (8.0.535.0)", - "ExternalDelayDsnEnabled": true, - "ExternalDsnDefaultLanguage": null, - "ExternalDsnLanguageDetectionEnabled": true, - "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", - "ExternalDsnReportingAuthority": null, - "ExternalDsnSendHtml": true, - "ExternalPostmasterAddress": null, - "GenerateCopyOfDSNFor": [], - "Guid": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", - "HeaderPromotionModeSetting": "NoCreate", - "HygieneSuite": "Premium", - "Id": "Transport Settings", - "Identity": "Transport Settings", - "InternalDelayDsnEnabled": true, - "InternalDsnDefaultLanguage": null, - "InternalDsnLanguageDetectionEnabled": true, - "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", - "InternalDsnReportingAuthority": null, - "InternalDsnSendHtml": true, - "InternalSMTPServers": [], - "IsValid": true, - "JournalArchivingEnabled": false, - "JournalMessageExpirationDays": 0, - "JournalReportDLMemberSubstitutionEnabled": false, - "JournalingReportNdrTo": "u003cu003e", - "LegacyArchiveJournalingEnabled": false, - "LegacyArchiveLiveJournalingEnabled": false, - "LegacyJournalingMigrationEnabled": false, - "MaxAllowedAgentGeneratedMessageDepth": 3, - "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, - "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", - "MaxDumpsterTime": "7.00:00:00", - "MaxReceiveSize": "Unlimited", - "MaxRecipientEnvelopeLimit": "Unlimited", - "MaxSendSize": "Unlimited", - "MessageExpiration": "1.00:00:00", - "MigrationEnabled": true, - "Name": "Transport Settings", - "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", - "ObjectClass": [ - "top", - "container", - "msExchTransportSettings" - ], - "ObjectState": "Unchanged", - "OpenDomainRoutingEnabled": false, - "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@y2zj1.onmicrosoft.com", - "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", - "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", - "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", - "OtherWellKnownObjects": [], - "PreserveReportBodypart": true, - "QueueDiagnosticsAggregationInterval": "00:01:00", - "RedirectDLMessagesForLegacyArchiveJournaling": false, - "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, - "ReplyAllStormBlockDurationHours": 6, - "ReplyAllStormDetectionMinimumRecipients": 2500, - "ReplyAllStormDetectionMinimumReplies": 10, - "ReplyAllStormProtectionEnabled": true, - "Rfc2231EncodingEnabled": false, - "SafetyNetHoldTime": "7.00:00:00", - "SmtpClientAuthenticationDisabled": true, - "SupervisionTags": [ - "Reject", - "Allow" - ], - "TLSReceiveDomainSecureList": [], - "TLSSendDomainSecureList": [], - "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", - "TransportRuleCollectionAddedRecipientsLimit": 100, - "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", - "TransportRuleConfig": [ - "TransportRuleMinProductVersion:14.0.0.0", - "TransportRuleRegexValidationTimeout:00:00:00.3000000", - "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", - "TransportRuleSizeLimit:8 KB (8,192 bytes)", - "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", - "TransportRuleLimit:300", - "TransportRuleCollectionAddedRecipientsLimit:100" - ], - "TransportRuleLimit": 300, - "TransportRuleMinProductVersion": { - "Build": 0, - "Major": 14, - "MajorRevision": 0, - "Minor": 0, - "MinorRevision": 0, - "Revision": 0 - }, - "TransportRuleRegexValidationTimeout": "00:00:00.3000000", - "TransportRuleSizeLimit": "8 KB (8,192 bytes)", - "TransportSystemState": "", - "VerifySecureSubmitEnabled": false, - "VoicemailJournalingEnabled": true, - "WhenChanged": "/Date(1643184486000)/", - "WhenChangedUTC": "/Date(1643184486000)/", - "WhenCreated": "/Date(1643059670000)/", - "WhenCreatedUTC": "/Date(1643059670000)/", - "Xexch50Enabled": true - } - ], - "Commandlet": [ - "Get-TransportConfig" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.5.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "AdminDisplayName": "", - "Default": true, - "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", - "Domains": [ - "Anonymous:CalendarSharingFreeBusyReviewer", - "*:CalendarSharingFreeBusySimple" - ], - "Enabled": true, - "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", - "ExchangeVersion": "0.10 (14.0.100.0)", - "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", - "Id": "Default Sharing Policy", - "Identity": "Default Sharing Policy", - "IsValid": true, - "Name": "Default Sharing Policy", - "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", - "ObjectClass": [ - "top", - "msExchSharingPolicy" - ], - "ObjectState": "Changed", - "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", - "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", - "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", - "WhenChanged": "/Date(1645650761000)/", - "WhenChangedUTC": "/Date(1645650761000)/", - "WhenCreated": "/Date(1645650752000)/", - "WhenCreatedUTC": "/Date(1645650752000)/" - } - ], - "Commandlet": [ - "Get-SharingPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.6.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "AdminDisplayName": "", - "Default": true, - "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", - "Domains": [ - "Anonymous:CalendarSharingFreeBusyReviewer", - "*:CalendarSharingFreeBusySimple" - ], - "Enabled": true, - "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", - "ExchangeVersion": "0.10 (14.0.100.0)", - "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", - "Id": "Default Sharing Policy", - "Identity": "Default Sharing Policy", - "IsValid": true, - "Name": "Default Sharing Policy", - "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", - "ObjectClass": [ - "top", - "msExchSharingPolicy" - ], - "ObjectState": "Changed", - "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", - "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", - "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", - "WhenChanged": "/Date(1645650761000)/", - "WhenChangedUTC": "/Date(1645650761000)/", - "WhenCreated": "/Date(1645650752000)/", - "WhenCreatedUTC": "/Date(1645650752000)/" - } - ], - "Commandlet": [ - "Get-SharingPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.6.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "AdminDisplayName": "", - "DirectoryBasedEdgeBlockMode": "Default", - "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", - "EnableSafeList": false, - "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", - "IPAllowList": [], - "IPBlockList": [], - "Id": "Default", - "Identity": "Default", - "IsDefault": true, - "IsValid": true, - "Name": "Default", - "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", - "ObjectClass": [ - "top", - "msExchHostedConnectionFilterPolicy" - ], - "ObjectState": "Unchanged", - "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", - "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", - "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", - "WhenChanged": "/Date(1645650833000)/", - "WhenChangedUTC": "/Date(1645650833000)/", - "WhenCreated": "/Date(1645650828000)/", - "WhenCreatedUTC": "/Date(1645650828000)/" - } - ], - "Commandlet": [ - "Get-HostedConnectionFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.EXO.12.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "AdminDisplayName": "", - "DirectoryBasedEdgeBlockMode": "Default", - "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", - "EnableSafeList": false, - "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", - "ExchangeVersion": "0.20 (15.0.0.0)", - "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", - "IPAllowList": [], - "IPBlockList": [], - "Id": "Default", - "Identity": "Default", - "IsDefault": true, - "IsValid": true, - "Name": "Default", - "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", - "ObjectClass": [ - "top", - "msExchHostedConnectionFilterPolicy" - ], - "ObjectState": "Unchanged", - "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", - "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", - "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", - "WhenChanged": "/Date(1645650833000)/", - "WhenChangedUTC": "/Date(1645650833000)/", - "WhenCreated": "/Date(1645650828000)/", - "WhenCreatedUTC": "/Date(1645650828000)/" - } - ], - "Commandlet": [ - "Get-HostedConnectionFilterPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.EXO.12.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - { - "AuditDisabled": false, - "DisplayName": "y2zj1", - "Name": "y2zj1.onmicrosoft.com" - } - ], - "Commandlet": [ - "Get-OrganizationConfig" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.13.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-ScubaSpfRecords", - "Get-AcceptedDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.2.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - "*" - ], - "Commandlet": [ - "Get-RemoteDomain" - ], - "Criticality": "Shall", - "PolicyId": "MS.EXO.1.1v1", - "ReportDetails": "1 remote domain(s) that allows automatic forwarding: *", - "RequirementMet": false - }, - { - "ActualValue": "PowerShell Error", - "Commandlet": [ - "Get-DlpPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.POWERPLATFORM.2.2v1", - "ReportDetails": "PowerShell Error", - "RequirementMet": false - }, - { - "ActualValue": "PowerShell Error", - "Commandlet": [ - "Get-PowerAppTenantIsolationPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.POWERPLATFORM.3.1v1", - "ReportDetails": "PowerShell Error", - "RequirementMet": false - }, - { - "ActualValue": "PowerShell Error", - "Commandlet": [ - "Get-TenantSettings" - ], - "Control": "Power Platform 2.1", - "Criticality": "Shall", - "ReportDetails": "PowerShell Error", - "Requirement": "The ability to create trial environments SHALL be restricted to admins", - "RequirementMet": false - }, - { - "ActualValue": "PowerShell Error", - "Commandlet": [ - "Get-TenantSettings" - ], - "Criticality": "Shall", - "PolicyId": "MS.POWERPLATFORM.1.1v1", - "ReportDetails": "PowerShell Error", - "RequirementMet": false - }, - { - "ActualValue": "PowerShell error", - "Commandlet": [ - "Get-DlpPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.POWERPLATFORM.2.3v1", - "ReportDetails": "PowerShell error", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.POWERPLATFORM.4.1v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.POWERPLATFORM.3.2v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.POWERPLATFORM.3.3v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-DlpPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.POWERPLATFORM.2.1v1", - "ReportDetails": "No policy found that applies to default environment", - "RequirementMet": false - }, - { - "ActualValue": 1, - "Commandlet": [ - "Get-SPOTenant", - "Get-PnPTenant" - ], - "Criticality": "Should", - "PolicyId": "MS.SHAREPOINT.1.3v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": 2, - "Commandlet": [ - "Get-SPOSite", - "Get-PnPTenantSite" - ], - "Control": "Sharepoint 2.5", - "Criticality": "Shall", - "ReportDetails": "Requirement met", - "Requirement": "Users SHALL be prevented from running custom scripts on self-service created sites", - "RequirementMet": true - }, - { - "ActualValue": 2, - "Commandlet": [ - "Get-SPOTenant", - "Get-PnPTenant" - ], - "Criticality": "Shall", - "PolicyId": "MS.SHAREPOINT.1.1v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Control": "Sharepoint 2.5", - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.SHAREPOINT.TBD", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "Requirement": "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/Not-Implemented", - "PolicyId": "MS.SHAREPOINT.1.2v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/Not-Implemented", - "PolicyId": "MS.SHAREPOINT.2.1v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [ - 1, - true, - 29 - ], - "Commandlet": [ - "Get-SPOTenant", - "Get-PnPTenant" - ], - "Control": "Sharepoint 2.4", - "Criticality": "Should", - "ReportDetails": "Requirement not met: Expiration timer for 'People who use a verification code' NOT set to 30 days", - "Requirement": "Expiration timer for 'People who use a verification code' should be set to 30 days", - "RequirementMet": false - }, - { - "ActualValue": [ - 1, - true, - 31 - ], - "Commandlet": [ - "Get-SPOTenant", - "Get-PnPTenant" - ], - "Criticality": "Should", - "PolicyId": "MS.SHAREPOINT.3.1v1", - "ReportDetails": "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days", - "RequirementMet": false - }, - { - "ActualValue": true, - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.9.1v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "AlwaysEnabled", - "Commandlet": [ - "Get-CsTeamsMeetingBroadcastPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.10.1v1", - "ReportDetails": "Requirement not met", - "RequirementMet": false - }, - { - "ActualValue": "EveryoneInCompany", - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.3.2v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.TEAMS.11.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.TEAMS.11.4v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Shall/3rd Party", - "PolicyId": "MS.TEAMS.8.3v1", - "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.11.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.12.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.12.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.13.1v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.13.2v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [], - "Commandlet": [], - "Criticality": "Should/3rd Party", - "PolicyId": "MS.TEAMS.13.3v1", - "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", - "RequirementMet": false - }, - { - "ActualValue": [ - "EveryoneInCompany", - false - ], - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.3.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - [], - "MicrosoftCommunicationsOnline/NOAM-ED6-A7" - ], - "Commandlet": [ - "Get-CsTeamsClientConfiguration" - ], - "Criticality": "Shall", - "PolicyId": "MS.TEAMS.7.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTeamsAppPermissionPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.8.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Control": "Teams 2.4", - "Criticality": "Should", - "ReportDetails": "Requirement met", - "Requirement": "Anonymous users SHOULD be enabled to join meetings", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Shall", - "PolicyId": "MS.TEAMS.2.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.1.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTeamsMeetingPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.9.3v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTenantFederationConfiguration" - ], - "Criticality": "Shall", - "PolicyId": "MS.TEAMS.4.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [], - "Commandlet": [ - "Get-CsTenantFederationConfiguration" - ], - "Criticality": "Shall", - "PolicyId": "MS.TEAMS.6.1v1", - "ReportDetails": "Requirement met", - "RequirementMet": true - }, - { - "ActualValue": [ - "Global" - ], - "Commandlet": [ - "Get-CsTeamsAppPermissionPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.8.2av1", - "ReportDetails": "1 meeting policy(ies) found that allow custom apps by default: Global", - "RequirementMet": false - }, - { - "ActualValue": [ - "Global" - ], - "Commandlet": [ - "Get-CsTeamsAppPermissionPolicy" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.8.2v1", - "ReportDetails": "1 meeting policy(ies) found that allow third-party apps by default: Global", - "RequirementMet": false - }, - { - "ActualValue": [ - "Global" - ], - "Commandlet": [ - "Get-CsTenantFederationConfiguration" - ], - "Criticality": "Shall", - "PolicyId": "MS.TEAMS.5.1v1", - "ReportDetails": "1 Configuration allowed unmanaged users to initiate contact with internal user across domains: Global", - "RequirementMet": false - }, - { - "ActualValue": [ - "Global" - ], - "Commandlet": [ - "Get-CsTenantFederationConfiguration" - ], - "Criticality": "Should", - "PolicyId": "MS.TEAMS.5.2v1", - "ReportDetails": "1 Internal users are enabled to initiate contact with unmanaged users across domains: Global", - "RequirementMet": false - } + { + "ActualValue": "", + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedUser" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.12.1v1", + "ReportDetails": "0 admin(s) that are not cloud-only found", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.4.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.4.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.4.4v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.5.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.5.4v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.AAD.8.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.AAD.18.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.AAD.2.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.AAD.5.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.AAD.5.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": { + "all_allow_invite_values": [ + { + "AllowInvitesFromValue": "everyone", + "PolicyId": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.18.1v1", + "ReportDetails": "Permission level set to \"everyone\" (authorizationPolicy)", + "RequirementMet": false + }, + { + "ActualValue": { + "all_allowed_create_values": [ + { + "DefaultUser_AllowedToCreateApps": true, + "PolicyId": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.6.1v1", + "ReportDetails": "1 authorization policies found that allow non-admin users to register third-party applications:
authorizationPolicy", + "RequirementMet": false + }, + { + "ActualValue": { + "all_consent_policies": [ + { + "IsEnabled": true, + "PolicyId": null + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAdminConsentRequestPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": { + "all_grant_policy_values": [ + { + "DefaultUser_DefaultGrantPolicy": [ + "ManagePermissionGrantsForSelf.microsoft-user-default-legacy" + ], + "PolicyId": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.1v1", + "ReportDetails": "1 authorization policies found that allow non-admin users to consent to third-party applications:
authorizationPolicy", + "RequirementMet": false + }, + { + "ActualValue": { + "all_roleid_values": [ + { + "GuestUserRoleId": "10dae51f-b6af-4016-8d66-8c2a99b929b3", + "GuestUserRoleIdString": "Limited access", + "Id": "authorizationPolicy" + } + ] + }, + "Commandlet": [ + "Get-MgPolicyAuthorizationPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.18.3v1", + "ReportDetails": "Permission level set to \"Limited access\" (authorizationPolicy)", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.9.1v1", + "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.17.1v1", + "ReportDetails": "0 conditional access policy(s) found that meet(s) all requirements. View all CA policies.", + "RequirementMet": false + }, + { + "ActualValue": [ + "Addam Schroll", + "Andrew Huynh", + "Grant Dasher", + "Nanda Katikaneni", + "Shanti Satyapal", + "Ted Kolovos", + "Thomas Comeau" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedUser" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.11.1v1", + "ReportDetails": "7 global admin(s) found:
Addam Schroll, Andrew Huynh, Grant Dasher, Nanda Katikaneni, Shanti Satyapal, Ted Kolovos, Thomas Comeau", + "RequirementMet": false + }, + { + "ActualValue": [ + "Application Administrator", + "Cloud Application Administrator", + "Hybrid Identity Administrator", + "Privileged Role Administrator", + "SharePoint Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.15.1v1", + "ReportDetails": "5 role(s) that do not require approval to activate found:
Application Administrator, Cloud Application Administrator, Hybrid Identity Administrator, Privileged Role Administrator, SharePoint Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Exchange Administrator", + "Global Administrator", + "Privileged Role Administrator", + "SharePoint Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.14.2v1", + "ReportDetails": "4 role(s) assigned to users outside of PIM:
Exchange Administrator, Global Administrator, Privileged Role Administrator, SharePoint Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global Administrator", + "SharePoint Administrator", + "User Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.14.1v1", + "ReportDetails": "3 role(s) configured to allow permanent active assignment or expiration period too long:
Global Administrator, SharePoint Administrator, User Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Live - Block legacy authentication" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.1.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Block legacy authentication. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - MFA Required for Everyone" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.4.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA Required for Everyone. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - MFA required for Highly Privileged Roles" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole", + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.13.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - MFA required for Highly Privileged Roles. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.10.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Prevent Persistent Sessions u0026 Enforce Sign-in Frequency. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Risky Sign Ins Block Access" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.3.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Sign Ins Block Access. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Live - Risky Users Block Access" + ], + "Commandlet": [ + "Get-MgIdentityConditionalAccessPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.2.1v1", + "ReportDetails": "1 conditional access policy(s) found that meet(s) all requirements:
Live - Risky Users Block Access. View all CA policies.", + "RequirementMet": true + }, + { + "ActualValue": [ + "Privileged Role Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.16.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "Privileged Role Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Should", + "PolicyId": "MS.AAD.16.3v1", + "ReportDetails": "1 role(s) without notification e-mail configured for role activations found:
Privileged Role Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + "Privileged Role Administrator", + "User Administrator" + ], + "Commandlet": [ + "Get-MgSubscribedSku", + "Get-PrivilegedRole" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.16.1v1", + "ReportDetails": "2 role(s) without notification e-mail configured for role assignments found:
Privileged Role Administrator, User Administrator", + "RequirementMet": false + }, + { + "ActualValue": [ + { + "Name": "EnableGroupSpecificConsent", + "SettingsGroup": "Consent Policy Settings", + "Value": "false" + } + ], + "Commandlet": [ + "Get-MgDirectorySetting" + ], + "Criticality": "Shall", + "PolicyId": "MS.AAD.7.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: domain impersonation default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: user impersonation default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "All safety tips SHALL be enabled: user impersonation unusual characters default policy", + "RequirementMet": false + }, + { + "ActualValue": false, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.8v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHALL be enabled: \"?\" for unauthenticated senders for spoof default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHALL be enabled: \"via\" tag default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for phishing: default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHALL be enabled for spam messages: default policy", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.7v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.6v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": 7, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": 15, + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.7v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "High confidence spam SHALL be moved to either the junk email folder or the quarantine folder: default policy", + "RequirementMet": true + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.3v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "MoveToJmf", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.6.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: domains default policy", + "RequirementMet": false + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement not met", + "Requirement": "Message action SHALL be set to quarantine if the message is detected as impersonated: mailbox default policy", + "RequirementMet": false + }, + { + "ActualValue": "NoAction", + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.5.6v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "Quarantine", + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "High confidence phishing SHALL be quarantined: default policy", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.DEFENDER.10.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.DEFENDER.10.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.2.5v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.2.6v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.DEFENDER.9.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: \"?\" for unauthenticated senders for spoof non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: \"via\" tag non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: domain impersonation non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: first contact non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: user impersonation non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "All safety tips SHOULD be enabled: user impersonation unusual characters non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Mail classified as spoofed SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: domains non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: mailbox non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Control": "Defender 2.5", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Message action SHOULD be set to quarantine if the message is detected as impersonated: users non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.1v1", + "ReportDetails": "No users are included for targeted user protection.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.2v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.3v1", + "ReportDetails": "The Custom Domains protection policies: Enabled, EnableTargetedDomainsProtection, and TargetedDomainsToProtect are not set correctly", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-AntiPhishPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.5.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to OneDrive.", + "Requirement": "The custom policy SHOULD be applied in OneDrive", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to SharePoint.", + "Requirement": "The custom policy SHOULD be applied in SharePoint", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Control": "Defender 2.2", + "Criticality": "Should", + "ReportDetails": "No policy found that applies to Teams.", + "Requirement": "The custom policy SHOULD be applied in Teams", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DLPCompliancePolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.2v1", + "ReportDetails": "No policy found that applies to Exchange.", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Control": "Defender 2.2", + "Criticality": "Shall", + "ReportDetails": "No matching rule found for Credit Card Number", + "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: Credit Card Number", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Control": "Defender 2.2", + "Criticality": "Shall", + "ReportDetails": "No matching rule found for U.S. Individual Taxpayer Identification Number (ITIN)", + "Requirement": "A custom policy SHALL be configured to protect PII and sensitive information, as defined by the agency: U.S. Individual Taxpayer Identification Number (ITIN)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.2.1v1", + "ReportDetails": "No matching rule found for U.S. Social Security Number (SSN)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpComplianceRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.2.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-EOPProtectionPolicyRule" + ], + "Control": "Defender 2.1", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Strict Preset security profiles SHOULD NOT be used", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-EOPProtectionPolicyRule" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.1.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Allowed senders MAY be added but allowed domains SHOULD NOT be added: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Bulk email SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "High confidence phishing SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "High confidence spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Phishing SHOULD be quarantined: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam SHOULD be moved to either the junk email folder or the quarantine folder: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam in quarantine SHOULD be retained for at least 30 days: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Spam safety tips SHOULD be turned on: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "The bulk complaint level (BCL) threshold SHOULD be set to six or lower: non-default policies", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for Spam: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled for phishing: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Control": "Defender 2.6", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Zero-hour auto purge (ZAP) SHOULD be enabled: non-default", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-HostedContentFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.6.8v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.3.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentPolicy", + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.8.2v1", + "ReportDetails": "No enabled policy found with action set to block that apply to all domains", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentPolicy", + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.8.3v1", + "ReportDetails": "No enabled policy found with action set to block and at least one contact specified", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeAttachmentRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.8.1v1", + "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.2v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.3v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.4v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.5v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.6v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.7v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.8v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksPolicy", + "Get-SafeLinksRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.9v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-SafeLinksRule", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.7.1v1", + "ReportDetails": "No policy found that applies to all domains: alexwilber.myo365.site, y2zj1.onmicrosoft.com", + "RequirementMet": false + }, + { + "ActualValue": [ + "A potentially malicious URL click was detected", + "Malware campaign detected after delivery", + "Messages have been delayed", + "Suspicious Email Forwarding Activity", + "Suspicious connector activity", + "Suspicious email sending patterns detected", + "Tenant restricted from sending unprovisioned email", + "Unusual increase in email reported as phish", + "User restricted from sending email" + ], + "Commandlet": [ + "Get-ProtectionAlert" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.9.1v1", + "ReportDetails": "9 disabled required alert(s) found: A potentially malicious URL click was detected, Malware campaign detected after delivery, Messages have been delayed, Suspicious Email Forwarding Activity, Suspicious connector activity, Suspicious email sending patterns detected, Tenant restricted from sending unprovisioned email, Unusual increase in email reported as phish, User restricted from sending email", + "RequirementMet": false + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Control": "Defender 2.3", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: cmd files", + "RequirementMet": true + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Control": "Defender 2.3", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Disallowed file types SHALL be determined and set. At a minimum, click-to-run files SHOULD be blocked: vbe files", + "RequirementMet": true + }, + { + "ActualValue": [ + "Default" + ], + "Commandlet": [ + "Get-MalwareFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.3.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "EnableATPForSPOTeamsODB": true, + "Identity": "Default" + } + ], + "Commandlet": [ + "Get-AtpPolicyForO365" + ], + "Criticality": "Should", + "PolicyId": "MS.DEFENDER.8.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "Identity": "Admin Audit Log Settings", + "UnifiedAuditLogIngestionEnabled": true + } + ], + "Commandlet": [ + "Get-AdminAuditLogConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.DEFENDER.10.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.10.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.10.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.14.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.16.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.17.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.8.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.8.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.9.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.EXO.9.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.EXO.2.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.10.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.11.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.15.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.16.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.EXO.9.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.4.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaDmarcRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.4.4v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-TransportRule" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.7.1v1", + "ReportDetails": "No transport rule found that applies warnings to emails received from outside the organization", + "RequirementMet": false + }, + { + "ActualValue": [ + [], + [ + null + ] + ], + "Commandlet": [ + "Get-DkimSigningConfig", + "Get-ScubaDkimRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.3.1v1", + "ReportDetails": "1 of 1 agency domain(s) found in violation: alexwilber.myo365.site", + "RequirementMet": false + }, + { + "ActualValue": [ + { + "AddressBookPolicyRoutingEnabled": false, + "AdminDisplayName": "", + "AgentGeneratedMessageLoopDetectionInSmtpEnabled": true, + "AgentGeneratedMessageLoopDetectionInSubmissionEnabled": true, + "AllowLegacyTLSClients": false, + "AnonymousSenderToRecipientRatePerHour": 1800, + "AttributionRejectBeforeMServRequest": false, + "AttributionRejectConsumerMessages": false, + "ClearCategories": true, + "ConvertDisclaimerWrapperToEml": false, + "ConvertReportToMessage": false, + "CurrentTransportSystemState": "Green", + "DSNConversionMode": "PreserveDSNBody", + "DiagnosticsAggregationServicePort": 9710, + "DistinguishedName": "CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableExternalHTTPMailDelivery": false, + "ExchangeObjectId": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", + "ExchangeVersion": "0.1 (8.0.535.0)", + "ExternalDelayDsnEnabled": true, + "ExternalDsnDefaultLanguage": null, + "ExternalDsnLanguageDetectionEnabled": true, + "ExternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "ExternalDsnReportingAuthority": null, + "ExternalDsnSendHtml": true, + "ExternalPostmasterAddress": null, + "GenerateCopyOfDSNFor": [], + "Guid": "b4f29764-fa61-4718-ac8d-29e1ad3007b9", + "HeaderPromotionModeSetting": "NoCreate", + "HygieneSuite": "Premium", + "Id": "Transport Settings", + "Identity": "Transport Settings", + "InternalDelayDsnEnabled": true, + "InternalDsnDefaultLanguage": null, + "InternalDsnLanguageDetectionEnabled": true, + "InternalDsnMaxMessageAttachSize": "10 MB (10,485,760 bytes)", + "InternalDsnReportingAuthority": null, + "InternalDsnSendHtml": true, + "InternalSMTPServers": [], + "IsValid": true, + "JournalArchivingEnabled": false, + "JournalMessageExpirationDays": 0, + "JournalReportDLMemberSubstitutionEnabled": false, + "JournalingReportNdrTo": "u003cu003e", + "LegacyArchiveJournalingEnabled": false, + "LegacyArchiveLiveJournalingEnabled": false, + "LegacyJournalingMigrationEnabled": false, + "MaxAllowedAgentGeneratedMessageDepth": 3, + "MaxAllowedAgentGeneratedMessageDepthPerAgent": 2, + "MaxDumpsterSizePerDatabase": "18 MB (18,874,368 bytes)", + "MaxDumpsterTime": "7.00:00:00", + "MaxReceiveSize": "Unlimited", + "MaxRecipientEnvelopeLimit": "Unlimited", + "MaxSendSize": "Unlimited", + "MessageExpiration": "1.00:00:00", + "MigrationEnabled": true, + "Name": "Transport Settings", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Transport-Settings", + "ObjectClass": [ + "top", + "container", + "msExchTransportSettings" + ], + "ObjectState": "Unchanged", + "OpenDomainRoutingEnabled": false, + "OrganizationFederatedMailbox": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@y2zj1.onmicrosoft.com", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "OtherWellKnownObjects": [], + "PreserveReportBodypart": true, + "QueueDiagnosticsAggregationInterval": "00:01:00", + "RedirectDLMessagesForLegacyArchiveJournaling": false, + "RedirectUnprovisionedUserMessagesForLegacyArchiveJournaling": false, + "ReplyAllStormBlockDurationHours": 6, + "ReplyAllStormDetectionMinimumRecipients": 2500, + "ReplyAllStormDetectionMinimumReplies": 10, + "ReplyAllStormProtectionEnabled": true, + "Rfc2231EncodingEnabled": false, + "SafetyNetHoldTime": "7.00:00:00", + "SmtpClientAuthenticationDisabled": true, + "SupervisionTags": [ + "Reject", + "Allow" + ], + "TLSReceiveDomainSecureList": [], + "TLSSendDomainSecureList": [], + "TransportRuleAttachmentTextScanLimit": "1 MB (1,048,576 bytes)", + "TransportRuleCollectionAddedRecipientsLimit": 100, + "TransportRuleCollectionRegexCharsLimit": "20 KB (20,480 bytes)", + "TransportRuleConfig": [ + "TransportRuleMinProductVersion:14.0.0.0", + "TransportRuleRegexValidationTimeout:00:00:00.3000000", + "TransportRuleAttachmentTextScanLimit:1 MB (1,048,576 bytes)", + "TransportRuleSizeLimit:8 KB (8,192 bytes)", + "TransportRuleCollectionRegexCharsLimit:20 KB (20,480 bytes)", + "TransportRuleLimit:300", + "TransportRuleCollectionAddedRecipientsLimit:100" + ], + "TransportRuleLimit": 300, + "TransportRuleMinProductVersion": { + "Build": 0, + "Major": 14, + "MajorRevision": 0, + "Minor": 0, + "MinorRevision": 0, + "Revision": 0 + }, + "TransportRuleRegexValidationTimeout": "00:00:00.3000000", + "TransportRuleSizeLimit": "8 KB (8,192 bytes)", + "TransportSystemState": "", + "VerifySecureSubmitEnabled": false, + "VoicemailJournalingEnabled": true, + "WhenChanged": "/Date(1643184486000)/", + "WhenChangedUTC": "/Date(1643184486000)/", + "WhenCreated": "/Date(1643059670000)/", + "WhenCreatedUTC": "/Date(1643059670000)/", + "Xexch50Enabled": true + } + ], + "Commandlet": [ + "Get-TransportConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.5.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "Default": true, + "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "Domains": [ + "Anonymous:CalendarSharingFreeBusyReviewer", + "*:CalendarSharingFreeBusySimple" + ], + "Enabled": true, + "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "Id": "Default Sharing Policy", + "Identity": "Default Sharing Policy", + "IsValid": true, + "Name": "Default Sharing Policy", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", + "ObjectClass": [ + "top", + "msExchSharingPolicy" + ], + "ObjectState": "Changed", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650761000)/", + "WhenChangedUTC": "/Date(1645650761000)/", + "WhenCreated": "/Date(1645650752000)/", + "WhenCreatedUTC": "/Date(1645650752000)/" + } + ], + "Commandlet": [ + "Get-SharingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.6.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "Default": true, + "DistinguishedName": "CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "Domains": [ + "Anonymous:CalendarSharingFreeBusyReviewer", + "*:CalendarSharingFreeBusySimple" + ], + "Enabled": true, + "ExchangeObjectId": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "ExchangeVersion": "0.10 (14.0.100.0)", + "Guid": "2f1ca8cf-5ba5-45e3-b73a-1405ff552a2e", + "Id": "Default Sharing Policy", + "Identity": "Default Sharing Policy", + "IsValid": true, + "Name": "Default Sharing Policy", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy", + "ObjectClass": [ + "top", + "msExchSharingPolicy" + ], + "ObjectState": "Changed", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650761000)/", + "WhenChangedUTC": "/Date(1645650761000)/", + "WhenCreated": "/Date(1645650752000)/", + "WhenCreatedUTC": "/Date(1645650752000)/" + } + ], + "Commandlet": [ + "Get-SharingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.6.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "DirectoryBasedEdgeBlockMode": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableSafeList": false, + "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "IPAllowList": [], + "IPBlockList": [], + "Id": "Default", + "Identity": "Default", + "IsDefault": true, + "IsValid": true, + "Name": "Default", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", + "ObjectClass": [ + "top", + "msExchHostedConnectionFilterPolicy" + ], + "ObjectState": "Unchanged", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650833000)/", + "WhenChangedUTC": "/Date(1645650833000)/", + "WhenCreated": "/Date(1645650828000)/", + "WhenCreatedUTC": "/Date(1645650828000)/" + } + ], + "Commandlet": [ + "Get-HostedConnectionFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.12.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AdminDisplayName": "", + "DirectoryBasedEdgeBlockMode": "Default", + "DistinguishedName": "CN=Default,CN=Hosted Connection Filter,CN=Transport Settings,CN=Configuration,CN=y2zj1.onmicrosoft.com,CN=ConfigurationUnits,DC=NAMPR10A008,DC=PROD,DC=OUTLOOK,DC=COM", + "EnableSafeList": false, + "ExchangeObjectId": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "ExchangeVersion": "0.20 (15.0.0.0)", + "Guid": "3843aef3-f3bd-49c1-a674-4d6741ac11b6", + "IPAllowList": [], + "IPBlockList": [], + "Id": "Default", + "Identity": "Default", + "IsDefault": true, + "IsValid": true, + "Name": "Default", + "ObjectCategory": "NAMPR10A008.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Hosted-Connection-Filter-Policy", + "ObjectClass": [ + "top", + "msExchHostedConnectionFilterPolicy" + ], + "ObjectState": "Unchanged", + "OrganizationId": "NAMPR10A008.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/y2zj1.onmicrosoft.com - NAMPR10A008.PROD.OUTLOOK.COM/ConfigurationUnits/y2zj1.onmicrosoft.com/Configuration", + "OrganizationalUnitRoot": "y2zj1.onmicrosoft.com", + "OriginatingServer": "DM5PR10A08DC002.NAMPR10A008.PROD.OUTLOOK.COM", + "WhenChanged": "/Date(1645650833000)/", + "WhenChangedUTC": "/Date(1645650833000)/", + "WhenCreated": "/Date(1645650828000)/", + "WhenCreatedUTC": "/Date(1645650828000)/" + } + ], + "Commandlet": [ + "Get-HostedConnectionFilterPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.EXO.12.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + { + "AuditDisabled": false, + "DisplayName": "y2zj1", + "Name": "y2zj1.onmicrosoft.com" + } + ], + "Commandlet": [ + "Get-OrganizationConfig" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.13.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-ScubaSpfRecords", + "Get-AcceptedDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.2.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "*" + ], + "Commandlet": [ + "Get-RemoteDomain" + ], + "Criticality": "Shall", + "PolicyId": "MS.EXO.1.1v1", + "ReportDetails": "1 remote domain(s) that allows automatic forwarding: *", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.POWERPLATFORM.2.2v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-PowerAppTenantIsolationPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.3.1v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-TenantSettings" + ], + "Control": "Power Platform 2.1", + "Criticality": "Shall", + "ReportDetails": "PowerShell Error", + "Requirement": "The ability to create trial environments SHALL be restricted to admins", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell Error", + "Commandlet": [ + "Get-TenantSettings" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.1.1v1", + "ReportDetails": "PowerShell Error", + "RequirementMet": false + }, + { + "ActualValue": "PowerShell error", + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.POWERPLATFORM.2.3v1", + "ReportDetails": "PowerShell error", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.4.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.3.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.POWERPLATFORM.3.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-DlpPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.POWERPLATFORM.2.1v1", + "ReportDetails": "No policy found that applies to default environment", + "RequirementMet": false + }, + { + "ActualValue": 1, + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Should", + "PolicyId": "MS.SHAREPOINT.1.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": 2, + "Commandlet": [ + "Get-SPOSite", + "Get-PnPTenantSite" + ], + "Control": "Sharepoint 2.5", + "Criticality": "Shall", + "ReportDetails": "Requirement met", + "Requirement": "Users SHALL be prevented from running custom scripts on self-service created sites", + "RequirementMet": true + }, + { + "ActualValue": 2, + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Shall", + "PolicyId": "MS.SHAREPOINT.1.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Control": "Sharepoint 2.5", + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.TBD", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "Requirement": "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.1.2v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/Not-Implemented", + "PolicyId": "MS.SHAREPOINT.2.1v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [ + 1, + true, + 29 + ], + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Control": "Sharepoint 2.4", + "Criticality": "Should", + "ReportDetails": "Requirement not met: Expiration timer for 'People who use a verification code' NOT set to 30 days", + "Requirement": "Expiration timer for 'People who use a verification code' should be set to 30 days", + "RequirementMet": false + }, + { + "ActualValue": [ + 1, + true, + 31 + ], + "Commandlet": [ + "Get-SPOTenant", + "Get-PnPTenant" + ], + "Criticality": "Should", + "PolicyId": "MS.SHAREPOINT.3.1v1", + "ReportDetails": "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days", + "RequirementMet": false + }, + { + "ActualValue": true, + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.9.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "AlwaysEnabled", + "Commandlet": [ + "Get-CsTeamsMeetingBroadcastPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.10.1v1", + "ReportDetails": "Requirement not met", + "RequirementMet": false + }, + { + "ActualValue": "EveryoneInCompany", + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.3.2v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.11.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.11.4v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Shall/3rd Party", + "PolicyId": "MS.TEAMS.8.3v1", + "ReportDetails": "Not currently checked automatically. See Secure Configuration Baseline policy for instructions on manual check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.11.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.12.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.12.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.1v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.2v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [], + "Commandlet": [], + "Criticality": "Should/3rd Party", + "PolicyId": "MS.TEAMS.13.3v1", + "ReportDetails": "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check", + "RequirementMet": false + }, + { + "ActualValue": [ + "EveryoneInCompany", + false + ], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.3.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + [], + "MicrosoftCommunicationsOnline/NOAM-ED6-A7" + ], + "Commandlet": [ + "Get-CsTeamsClientConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.7.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Control": "Teams 2.4", + "Criticality": "Should", + "ReportDetails": "Requirement met", + "Requirement": "Anonymous users SHOULD be enabled to join meetings", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.2.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.1.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTeamsMeetingPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.9.3v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.4.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.6.1v1", + "ReportDetails": "Requirement met", + "RequirementMet": true + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.2av1", + "ReportDetails": "1 meeting policy(ies) found that allow custom apps by default: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTeamsAppPermissionPolicy" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.8.2v1", + "ReportDetails": "1 meeting policy(ies) found that allow third-party apps by default: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Shall", + "PolicyId": "MS.TEAMS.5.1v1", + "ReportDetails": "1 Configuration allowed unmanaged users to initiate contact with internal user across domains: Global", + "RequirementMet": false + }, + { + "ActualValue": [ + "Global" + ], + "Commandlet": [ + "Get-CsTenantFederationConfiguration" + ], + "Criticality": "Should", + "PolicyId": "MS.TEAMS.5.2v1", + "ReportDetails": "1 Internal users are enabled to initiate contact with unmanaged users across domains: Global", + "RequirementMet": false + } ] \ No newline at end of file diff --git a/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 b/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 index 73414e4ce7..d425047ab1 100644 --- a/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 +++ b/Testing/Unit/PowerShell/CreateReport/Import-SecureBaseline.Tests.ps1 @@ -39,7 +39,7 @@ InModuleScope CreateReport { @{Product = "onedrive"; GroupCount = 7; PolicyCount = 8} @{Product = "powerbi"; GroupCount = 10; PolicyCount = 12} @{Product = "powerplatform"; GroupCount = 4; PolicyCount = 8} - @{Product = "sharepoint"; GroupCount = 5; PolicyCount = 6} + @{Product = "sharepoint"; GroupCount = 5; PolicyCount = 10} @{Product = "teams"; GroupCount = 13; PolicyCount = 28} ){ {$Baselines.$Product} | Should -Not -Throw diff --git a/Testing/Unit/PowerShell/CreateReport/New-Report.Tests.ps1 b/Testing/Unit/PowerShell/CreateReport/New-Report.Tests.ps1 index b39fd24f98..64758d5a28 100644 --- a/Testing/Unit/PowerShell/CreateReport/New-Report.Tests.ps1 +++ b/Testing/Unit/PowerShell/CreateReport/New-Report.Tests.ps1 @@ -46,7 +46,7 @@ InModuleScope CreateReport { @{Product = 'exo'; ErrorCount = 2}, @{Product = 'onedrive'; ErrorCount = 8}, @{Product = 'powerplatform'; ErrorCount = 0}, - @{Product = 'sharepoint'; ErrorCount = 3}, + @{Product = 'sharepoint'; ErrorCount = 5}, @{Product = 'teams'; ErrorCount = 5} ){ $CreateReportParams += @{ diff --git a/Testing/Unit/Rego/Sharepoint/SharepointConfig_01_test.rego b/Testing/Unit/Rego/Sharepoint/SharepointConfig_01_test.rego index ba1b014859..41fca58d22 100644 --- a/Testing/Unit/Rego/Sharepoint/SharepointConfig_01_test.rego +++ b/Testing/Unit/Rego/Sharepoint/SharepointConfig_01_test.rego @@ -1,17 +1,18 @@ package sharepoint import future.keywords +import data.report.utils.NotCheckedDetails # -# Policy 1 +# MS.SHAREPOINT.1.1v1 #-- -test_DefaultSharingLinkType_Correct if { +test_SharingCapability_Correct_V1 if { PolicyId := "MS.SHAREPOINT.1.1v1" Output := tests with input as { "SPO_tenant": [ { - "DefaultSharingLinkType" : 1 + "SharingCapability" : 0 } ] } @@ -23,13 +24,145 @@ test_DefaultSharingLinkType_Correct if { RuleOutput[0].ReportDetails == "Requirement met" } -test_DefaultSharingLinkType_Incorrect if { +test_SharingCapability_Correct_V2 if { PolicyId := "MS.SHAREPOINT.1.1v1" Output := tests with input as { "SPO_tenant": [ { - "DefaultSharingLinkType" : 2 + "SharingCapability" : 3 + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement met" +} + +test_SharingCapability_Incorrect_V1 if { + PolicyId := "MS.SHAREPOINT.1.1v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "SharingCapability" : 1 + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + not RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement not met" +} + +test_SharingCapability_Incorrect_V2 if { + PolicyId := "MS.SHAREPOINT.1.1v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "SharingCapability" : 2 + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + not RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement not met" +} +#-- + +# +# MS.SHAREPOINT.1.2v1 +#-- +test_SharingDomainRestrictionMode_Correct if { + PolicyId := "MS.SHAREPOINT.1.2v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "SharingDomainRestrictionMode" : 1 + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement met" +} + +test_SharingDomainRestrictionMode_Incorrect if { + PolicyId := "MS.SHAREPOINT.1.2v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "SharingDomainRestrictionMode" : 0 + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + not RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement not met" +} +#-- + +# +# MS.SHAREPOINT.1.3v1 +#-- +test_NotImplemented_Correct if { + PolicyId := "MS.SHAREPOINT.1.3v1" + + Output := tests with input as { } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + not RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == NotCheckedDetails(PolicyId) +} +#-- + +# +# MS.SHAREPOINT.1.4v1 +#-- +test_RequireAcceptingAccountMatchInvitedAccount_Correct if { + PolicyId := "MS.SHAREPOINT.1.4v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "RequireAcceptingAccountMatchInvitedAccount" : true + } + ] + } + + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] + + count(RuleOutput) == 1 + RuleOutput[0].RequirementMet + RuleOutput[0].ReportDetails == "Requirement met" +} + +test_RequireAcceptingAccountMatchInvitedAccount_Incorrect if { + PolicyId := "MS.SHAREPOINT.1.4v1" + + Output := tests with input as { + "SPO_tenant": [ + { + "RequireAcceptingAccountMatchInvitedAccount" : false } ] } @@ -40,3 +173,4 @@ test_DefaultSharingLinkType_Incorrect if { not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement not met" } +#-- \ No newline at end of file diff --git a/Testing/Unit/Rego/Sharepoint/SharepointConfig_02_test.rego b/Testing/Unit/Rego/Sharepoint/SharepointConfig_02_test.rego index 1953086f7d..2529ee0a43 100644 --- a/Testing/Unit/Rego/Sharepoint/SharepointConfig_02_test.rego +++ b/Testing/Unit/Rego/Sharepoint/SharepointConfig_02_test.rego @@ -3,33 +3,15 @@ import future.keywords # -# Policy 1 +# MS.SHAREPOINT.2.1v1 #-- -test_SharingCapability_Correct_V1 if { - PolicyId := "MS.SHAREPOINT.1.3v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 1 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V2 if { - PolicyId := "MS.SHAREPOINT.1.3v1" +test_DefaultSharingLinkType_Correct if { + PolicyId := "MS.SHAREPOINT.2.1v1" Output := tests with input as { "SPO_tenant": [ { - "SharingCapability" : 0 + "DefaultSharingLinkType" : 1 } ] } @@ -41,13 +23,13 @@ test_SharingCapability_Correct_V2 if { RuleOutput[0].ReportDetails == "Requirement met" } -test_SharingCapability_Incorrect if { - PolicyId := "MS.SHAREPOINT.1.3v1" +test_DefaultSharingLinkType_Incorrect if { + PolicyId := "MS.SHAREPOINT.2.1v1" Output := tests with input as { "SPO_tenant": [ { - "SharingCapability" : 2 + "DefaultSharingLinkType" : 2 } ] } @@ -57,4 +39,5 @@ test_SharingCapability_Incorrect if { count(RuleOutput) == 1 not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement not met" -} \ No newline at end of file +} +#-- \ No newline at end of file diff --git a/Testing/Unit/Rego/Sharepoint/SharepointConfig_03_test.rego b/Testing/Unit/Rego/Sharepoint/SharepointConfig_03_test.rego index c63204f413..04820f45cb 100644 --- a/Testing/Unit/Rego/Sharepoint/SharepointConfig_03_test.rego +++ b/Testing/Unit/Rego/Sharepoint/SharepointConfig_03_test.rego @@ -2,12 +2,13 @@ package sharepoint import future.keywords import data.report.utils.NotCheckedDetails + # -# Policy 1 +# MS.SHAREPOINT.3.1v1 #-- test_NotImplemented_Correct if { - PolicyId := "MS.SHAREPOINT.2.1v1" - + PolicyId := "MS.SHAREPOINT.3.1v1" + Output := tests with input as { } RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] @@ -15,4 +16,5 @@ test_NotImplemented_Correct if { count(RuleOutput) == 1 not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == NotCheckedDetails(PolicyId) -} \ No newline at end of file +} +#-- \ No newline at end of file diff --git a/Testing/Unit/Rego/Sharepoint/SharepointConfig_04_test.rego b/Testing/Unit/Rego/Sharepoint/SharepointConfig_04_test.rego index 89406e7263..2c83c359b6 100644 --- a/Testing/Unit/Rego/Sharepoint/SharepointConfig_04_test.rego +++ b/Testing/Unit/Rego/Sharepoint/SharepointConfig_04_test.rego @@ -3,17 +3,17 @@ import future.keywords # -# Policy 1 +# MS.SHAREPOINT.4.1v1 #-- test_SharingCapability_Correct_V1 if { - PolicyId := "MS.SHAREPOINT.3.1v1" + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 0, "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 30 + "ExternalUserExpireInDays": 30 } ] } @@ -26,74 +26,14 @@ test_SharingCapability_Correct_V1 if { } test_SharingCapability_Correct_V2 if { - PolicyId := "MS.SHAREPOINT.3.1v1" + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { - "SharingCapability" : 0, - "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 30 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V3 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 29 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V4 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, + "SharingCapability" : 1, "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 31 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V5 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 29 + "ExternalUserExpireInDays": 30 } ] } @@ -105,35 +45,15 @@ test_SharingCapability_Correct_V5 if { RuleOutput[0].ReportDetails == "Requirement met" } -test_SharingCapability_Correct_V6 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 31 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_Multi_Correct if { - PolicyId := "MS.SHAREPOINT.3.1v1" +test_ExternalUserExpireInDays_Correct if { + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 30 + "ExternalUserExpireInDays": 29 } ] } @@ -145,15 +65,15 @@ test_Multi_Correct if { RuleOutput[0].ReportDetails == "Requirement met" } -test_ExternalUserExpirationRequired_Incorrect if { - PolicyId := "MS.SHAREPOINT.3.1v1" +test_Multi_Incorrect_V1 if { + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 30 + "ExternalUserExpireInDays": 31 } ] } @@ -162,58 +82,18 @@ test_ExternalUserExpirationRequired_Incorrect if { count(RuleOutput) == 1 not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT enabled" + RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT enabled and set to greater 30 days" } -test_ExternalUserExpireInDays_Incorrect_V1 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 1, - "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 29 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days" -} - -test_ExternalUserExpireInDays_Incorrect_V2 if { - PolicyId := "MS.SHAREPOINT.3.1v1" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 1, - "ExternalUserExpirationRequired" : true, - "ExternalUserExpireInDays" : 31 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] - - count(RuleOutput) == 1 - not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days" -} - -test_Multi_Incorrect_V1 if { - PolicyId := "MS.SHAREPOINT.3.1v1" +test_ExternalUserExpirationRequired_Incorrect_V2 if { + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 29 + "ExternalUserExpireInDays": 29 } ] } @@ -222,18 +102,18 @@ test_Multi_Incorrect_V1 if { count(RuleOutput) == 1 not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met" + RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT enabled" } -test_Multi_Incorrect_V2 if { - PolicyId := "MS.SHAREPOINT.3.1v1" +test_ExternalUserExpireInDays_Incorrect_V3 if { + PolicyId := "MS.SHAREPOINT.4.1v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, - "ExternalUserExpirationRequired" : false, - "ExternalUserExpireInDays" : 31 + "ExternalUserExpirationRequired" : true, + "ExternalUserExpireInDays": 31 } ] } @@ -242,69 +122,27 @@ test_Multi_Incorrect_V2 if { count(RuleOutput) == 1 not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met" + RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'Guest access to a site or OneDrive' NOT set to 30 days or less" } +#-- # -# Policy 2 +# MS.SHAREPOINT.4.2v1 #-- -test_SharingCapability_Correct_V1 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 30 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V2 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 30 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - test_SharingCapability_Correct_V3 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 0, "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 29 + "EmailAttestationReAuthDays": 30 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 RuleOutput[0].RequirementMet @@ -312,190 +150,102 @@ test_SharingCapability_Correct_V3 if { } test_SharingCapability_Correct_V4 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { - "SharingCapability" : 0, + "SharingCapability" : 1, "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 31 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V5 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 29 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement met" -} - -test_SharingCapability_Correct_V6 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 0, - "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 31 + "EmailAttestationReAuthDays": 30 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement met" } -test_Multi_Correct if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" +test_EmailAttestationReAuthDays_Correct if { + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 30 + "EmailAttestationReAuthDays": 29 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement met" } -test_EmailAttestationRequired_Incorrect if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" +test_Multi_Incorrect_V1 if { + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 30 + "EmailAttestationReAuthDays": 31 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'People who use a verification code' NOT enabled" + RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'People who use a verification code' NOT enabled and set to greater 30 days" } -test_EmailAttestationReAuthDays_Incorrect_V1 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" +test_EmailAttestationRequired_Incorrect_V2 if { + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, - "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 29 + "EmailAttestationRequired" : false, + "EmailAttestationReAuthDays": 29 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'People who use a verification code' NOT set to 30 days" + RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'People who use a verification code' NOT enabled" } -test_EmailAttestationReAuthDays_Incorrect_V2 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" +test_EmailAttestationReAuthDays_Incorrect_V3 if { + PolicyId := "MS.SHAREPOINT.4.2v1" Output := tests with input as { "SPO_tenant": [ { "SharingCapability" : 1, "EmailAttestationRequired" : true, - "EmailAttestationReAuthDays" : 31 + "EmailAttestationReAuthDays": 31 } ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement not met: Expiration timer for 'People who use a verification code' NOT set to 30 days" } - -test_Multi_Incorrect_V1 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 1, - "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 29 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met" -} - -test_Multi_Incorrect_V2 if { - ControlNumber := "Sharepoint 2.4" - Requirement := "Expiration timer for 'People who use a verification code' should be set to 30 days" - - Output := tests with input as { - "SPO_tenant": [ - { - "SharingCapability" : 1, - "EmailAttestationRequired" : false, - "EmailAttestationReAuthDays" : 31 - } - ] - } - - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] - - count(RuleOutput) == 1 - not RuleOutput[0].RequirementMet - RuleOutput[0].ReportDetails == "Requirement not met" -} \ No newline at end of file +#-- \ No newline at end of file diff --git a/Testing/Unit/Rego/Sharepoint/SharepointConfig_05_test.rego b/Testing/Unit/Rego/Sharepoint/SharepointConfig_05_test.rego index 450c50cdf9..1b0fa9e478 100644 --- a/Testing/Unit/Rego/Sharepoint/SharepointConfig_05_test.rego +++ b/Testing/Unit/Rego/Sharepoint/SharepointConfig_05_test.rego @@ -2,39 +2,38 @@ package sharepoint import future.keywords import data.report.utils.NotCheckedDetails + # -# Policy 1 +# MS.SHAREPOINT.5.1v1 #-- test_NotImplemented_Correct if { - ControlNumber := "Sharepoint 2.5" - PolicyId := "MS.SHAREPOINT.TBD" - Requirement := "Users SHALL be prevented from running custom scripts on personal sites (OneDrive)" + PolicyId := "MS.SHAREPOINT.5.1v1" Output := tests with input as { } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == NotCheckedDetails(PolicyId) } +#-- # -# Policy 2 +# MS.SHAREPOINT.5.2v1 #-- test_DenyAddAndCustomizePages_Correct if { - ControlNumber := "Sharepoint 2.5" - Requirement := "Users SHALL be prevented from running custom scripts on self-service created sites" + PolicyId := "MS.SHAREPOINT.5.2v1" Output := tests with input as { "SPO_site": [ { "DenyAddAndCustomizePages" : 2 } - ] + ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 RuleOutput[0].RequirementMet @@ -42,8 +41,7 @@ test_DenyAddAndCustomizePages_Correct if { } test_DenyAddAndCustomizePages_Incorrect if { - ControlNumber := "Sharepoint 2.5" - Requirement := "Users SHALL be prevented from running custom scripts on self-service created sites" + PolicyId := "MS.SHAREPOINT.5.2v1" Output := tests with input as { "SPO_site": [ @@ -53,9 +51,10 @@ test_DenyAddAndCustomizePages_Incorrect if { ] } - RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement] + RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId] count(RuleOutput) == 1 not RuleOutput[0].RequirementMet RuleOutput[0].ReportDetails == "Requirement not met" } +#-- \ No newline at end of file diff --git a/baselines/sharepoint.md b/baselines/sharepoint.md index b153f02bc2..aebd9431ab 100644 --- a/baselines/sharepoint.md +++ b/baselines/sharepoint.md @@ -66,39 +66,7 @@ listed. # Baselines -## 1. File and Folder Links Default Sharing Settings - -This policy ensures that when sharing files in SharePoint, there are -several possible scopes, including agency-wide or “anyone with the -link.” - -### Policies - -#### MS.SHAREPOINT.1.1v1 -File and folder links default sharing setting SHALL be set to Specific People (Only the People the User Specifies). -- _Rationale:_ TODO -- _Last modified:_ June 2023 - -### Resources - -- [File and folder links \| Microsoft - Documents](https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#file-and-folder-links) - -### License Requirements - -- N/A - -### Implementation - -In the **SharePoint admin** **center**: - -1. In the left-hand navigation bar, click **Policies** -\> **Sharing** - to display sharing settings. - -2. Under **File and folder links**, ensure that the default link type - is set to **Specific people (only the people the user specifies)**. - -## 2. External Sharing +## 1. External Sharing SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security @@ -109,7 +77,7 @@ groups per interagency collaboration needs. for OneDrive and Teams to the same, selected level. OneDrive and Teams can be less permissive (not more permissive) than SharePoint Online. -Adding approved domains and/or security groups will also be reflected in +Adding approved domains and security groups will also be reflected in OneDrive external sharing settings. External access may be granted on a per-domain basis. This may be @@ -119,8 +87,24 @@ Program](https://community.max.gov/display/Egov/Interagency+Collaboration+Progra OMB Max Site for a list of .gov domains for sharing). ### Policies -#### MS.SHAREPOINT.2.1v1 -External sharing SHOULD be limited to approved domains and security groups per interagency collaboration needs. +#### MS.SHAREPOINT.1.1v1 +External sharing SHOULD be limited to Existing Guests or the more restrictive setting, Only People in your Organization. +- _Rationale:_ TODO +- _Last modified:_ June 2023 +- _Note:_ Same implementation in MS.ONEDRIVE.1.1v1 + +#### MS.SHAREPOINT.1.2v1 +External sharing SHOULD be limited to approved domains per interagency collaboration needs. +- _Rationale:_ TODO +- _Last modified:_ June 2023 + +#### MS.SHAREPOINT.1.3v1 +External sharing SHOULD be limited to approved security groups per interagency collaboration needs. +- _Rationale:_ TODO +- _Last modified:_ June 2023 + +#### MS.SHAREPOINT.1.4v1 +Guest access SHOULD be limited to the email the invitation was sent. - _Rationale:_ TODO - _Last modified:_ June 2023 @@ -133,39 +117,96 @@ External sharing SHOULD be limited to approved domains and security groups per i - N/A -### Implementation +### Implementation + +MS.SHAREPOINT.1.1v1, in the **SharePoint admin center**: + +1. Select **Policies** -\> **Sharing** + +2. Adjust external sharing slider to **Existing Guests** or **Only people in your organization** + +3. Select **Save** + +MS.SHAREPOINT.1.2v1, in the **SharePoint admin center**: + +1. Select **Policies** -\> **Sharing** + +2. Expand **More external sharing settings** + +3. Select **Limit external sharing by domain** + +4. Select **Add domains** + +5. Add approved external domains + +6. Select **Save** -To adjust sharing settings, in the **SharePoint admin center**: +MS.SHAREPOINT.1.3v1, in the **SharePoint admin center**: -1. Select **Policies** -\> **Sharing**. +1. Select **Policies** -\> **Sharing** -2. Adjust external sharing slider to **New and Existing Guests.** +2. Expand **More external sharing settings** -3. Expand **More external sharing settings.** +3. Select **Allow only users in specific security groups to share + externally** -4. Select **Limit external sharing by domain**. +4. Select **Manage security groups** -5. Select **Add domains.** +5. Add approved security groups -6. Add domains. +6. Select **Save** -7. Select **Save.** +MS.SHAREPOINT.1.4v1, in the **SharePoint admin center**: -8. Select **Allow only users in specific security groups to share - externally**. +1. Select **Policies** -\> **Sharing** -9. Select **Manage security groups.** +2. Expand **More external sharing settings** -10. Add security groups. +3. Select **Guests must sign in using the same account to which sharing invitations are sent** -11. Select **Save.** +4. Select **Save** -## 3. Sensitivity Levels +## 2. File and Folder Links Default Sharing Settings + +This policy ensures that when sharing files in SharePoint, there are +several possible scopes, including agency-wide or “anyone with the +link.” + +### Policies + +#### MS.SHAREPOINT.2.1v1 +File and folder links default sharing setting SHALL be set to Specific People (only the people the user specifies). +- _Rationale:_ TODO +- _Last modified:_ June 2023 +_Note:_ Similar implementation in MS.ONEDRIVE.3.1v1 + +### Resources + +- [File and folder links \| Microsoft + Documents](https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off#file-and-folder-links) + +### License Requirements + +- N/A + +### Implementation + +MS.SHAREPOINT.2.1v1, in the **SharePoint admin center**: + +1. In the left-hand navigation bar, click **Policies** -\> **Sharing** + to display sharing settings + +2. Under **File and folder links**, ensure that the default link type + is set to **Specific people (only the people the user specifies)** + +3. Select **Save** + +## 3. Sensitivity Levels SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security -risk. This working group recommends outside of the default -organizational settings agencies should evaluate each created site and +risk. This baseline policy recommends, outside of the default +organizational settings, agencies evaluate each created site and adjust sharing settings best aligned to their respective sensitivity level. @@ -184,26 +225,24 @@ Sharing settings for specific SharePoint sites SHOULD align to their sensitivity - N/A -### Implementation - -To limit external sharing by domain, in the **SharePoint admin center**: +### Implementation -1. Select **Sites.** +MS.SHAREPOINT.3.1v1, in the **SharePoint admin center**: -2. Select **Active sites.** +1. Select **Sites** -3. Select **Site name.** +2. Select **Active sites** -4. Select **Add domains.** +3. Select **Site name** -5. Select **Policies.** +4. Select **Settings** -6. Under **external sharing**, select **Edit**. +5. Select **More sharing settings** -7. Select permissions aligning to the risk posture associated with the - sensitivity of the SharePoint site. +6. Select permissions aligning to the risk posture associated with the + sensitivity of the SharePoint site -8. Select **Save.** +7. Select **Save** ## 4. Guest Access to a Site or OneDrive @@ -217,12 +256,12 @@ for OneDrive and Teams to the same, specified expiration times. ### Policies #### MS.SHAREPOINT.4.1v1 -Expiration timers for guest access to a site or OneDrive and people who use a verification code SHOULD be set. +Expiration timers for guest access to a site or OneDrive SHOULD be set to 30 days or less. - _Rationale:_ TODO - _Last modified:_ June 2023 #### MS.SHAREPOINT.4.2v1 -Expiration timers SHOULD be set to 30 days. +Expiration timers for people who use a verification code SHOULD be set to 30 days or less. - _Rationale:_ TODO - _Last modified:_ June 2023 @@ -234,34 +273,53 @@ Expiration timers SHOULD be set to 30 days. - [Managing SharePoint Online Security: A Team Effort \| Microsoft Build](https://docs.microsoft.com/en-us/microsoft-365/community/sharepoint-security-a-team-effort) +- [Secure external sharing recipient experience \| Microsoft + Build](https://learn.microsoft.com/en-us/sharepoint/what-s-new-in-sharing-in-targeted-release) -### Implementation +### Implementation -To limit external sharing by domain, in the **SharePoint admin center**: +MS.SHAREPOINT.4.1v1, in the **SharePoint admin center**: -1. Select **Policies** -\> **Sharing**. +1. Select **Policies** -\> **Sharing** -2. Expand **More external sharing settings.** +2. Expand **More external sharing settings** 3. Select **Guest access to a site or OneDrive will expire - automatically after this many days.** + automatically after this many days** -4. Enter “30” days. +4. Enter “30” days or less -5. Select **People who use a verification code must reauthenticate - after this many days**. +5. Select **Save** -6. Enter “30 days”. +MS.SHAREPOINT.4.2v1, in the **SharePoint admin center**: + +1. Select **Policies** -\> **Sharing** + +2. Expand **More external sharing settings** + +3. Select **People who use a verification code must reauthenticate + after this many days** + +4. Enter “30 days” or less + +5. Select **Save** ## 5. Custom Scripts Allowing users to run custom scripts can potentially allow malicious -scripts to run in a trusted environment. For this reason, running custom -scripts should not be allowed. +scripts to run in a trusted environment. Microsoft provides settings to +mitigate this risk by preventing users from running custom scripts. ### Policy #### MS.SHAREPOINT.5.1v1 -Users SHALL be prevented from running custom scripts. +Users SHALL be prevented from running custom scripts on personal sites. +- _Rationale:_ TODO +- _Last modified:_ June 2023 + +#### MS.SHAREPOINT.5.2v1 +Users SHALL be prevented from running custom scripts on self-service created sites. +- _Rationale:_ TODO +- _Last modified:_ June 2023 ### Resources @@ -274,15 +332,30 @@ Users SHALL be prevented from running custom scripts. ### Implementation -In the **SharePoint Classic admin center**: +MS.SHAREPOINT.5.1v1, in the **SharePoint admin center**: + +1. Select **Settings** + +2. Scroll down to select **classic settings page** + +3. Scroll to the **Custom Script** setting + +4. Select **Prevent users from running custom script on personal sites** + +5. Select **Ok** + +MS.SHAREPOINT.5.1v1, in the **SharePoint admin center**: + +1. Select **Settings** + +2. Scroll down to select **classic settings page** -1. Scroll to the **Custom Script** setting and select both of the - following: +3. Scroll to the **Custom Script** setting -2. **Prevent users from running custom script on personal sites.** +4. Select **Prevent users from running custom script on self-service created + sites** -3. **Prevent users from running custom script on self-service created - sites.** +5. Select **Ok** # Acknowledgements @@ -333,4 +406,4 @@ Matthew Snitchler (Sandia), Darryl Purdy (USCB), Brandon Frankens Dr. Mukesh Rohatgi (MITRE), Lee Szilagyi (MITRE), Nanda Katikaneni (MITRE), Ted Kolovos (MITRE), Thomas Comeau (MITRE), Karen Caraway (MITRE), Jackie Whieldon (MITRE), Jeanne Firey (MITRE), Kenneth Myers -(General Services Administration). +(General Services Administration). \ No newline at end of file From f7a6e75e8f43034a015a49c1acd982643c408b59 Mon Sep 17 00:00:00 2001 From: Addam Schroll <108814318+schrolla@users.noreply.github.com> Date: Thu, 8 Jun 2023 10:36:43 -0500 Subject: [PATCH 06/33] Fix test location file path (#367) --- .github/workflows/run_markdown_check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/run_markdown_check.yaml b/.github/workflows/run_markdown_check.yaml index 2870b90b11..f18cf5d5ec 100644 --- a/.github/workflows/run_markdown_check.yaml +++ b/.github/workflows/run_markdown_check.yaml @@ -29,4 +29,4 @@ jobs: - name: Execute markdown checks run: | $PSVersionTable - Invoke-Pester Testing\Unit\Pester\CreateReport -Output Detailed \ No newline at end of file + Invoke-Pester Testing\Unit\PowerShell\CreateReport -Output Detailed \ No newline at end of file From 5ad473bab79cd034fc9e450d9b7dfed0688d2146 Mon Sep 17 00:00:00 2001 From: Richard Crutchfield
-Figure 1: Options for Weak MFA, Stronger MFA Options, and Strongest MFA
+Figure 1: Depiction of MFA methods from weakest to strongest. _Adapted from [MS Build Page](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods)_
### Policies
-#### MS.AAD.4.1v1
-MFA SHALL be required for all users.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-#### MS.AAD.4.2v1
-Phishing-resistant MFA SHALL be used for all users.
+#### MS.AAD.3.1v1
+Phishing-resistant MFA SHALL be enforced for all users.
- - Phishing-resistant methods:
+**Preferred phishing-resistant methods**
- - Federal PIV card (Azure AD Certificate-Based authentication
- \[CBA\])
+The methods **AAD Certificate-Based Authentication (CBA)**, **FIDO2 Security Key** and **Windows Hello for Business** are the recommended options since they offer forms of MFA with the least potential weaknesses. AAD CBA supports Federal PIV cards when they authenticate directly to Azure AD and is likely the most appropriate option for agencies to authenticate their users.
- - FIDO2 Security Key
+**Non-preferred phishing-resistant methods**
- - Windows Hello for Business
+The option **Federal PIV card (federated from agency on-premises Active Directory Federation Services or other identity provider)**, although technically phishing-resistant presents significant risks if the on-premises authentication infrastructure (e.g. ADFS) is compromised. Therefore federated PIV is not a preferred option and agencies should migrate to the options listed in the preferred section above. If an agency does use an on-premises PIV authentication and federate to AAD, reference the [guidance at this link](https://playbooks.idmanagement.gov/piv/network/group/) to enforce PIV logon via AD group policy.
- - Federal Personal Identity Verification (PIV) card (Federated from
- agency Active Directory or other identity provider)
-- _Rationale:_ TODO
+- _Rationale:_ The security risk of allowing weaker forms of MFA is that they do not protect against sophisticated phishing attacks. By enforcing methods which are resistant to phishing those risks are minimized.
- _Last modified:_ June 2023
-#### MS.AAD.4.3v1
-If phishing-resistant MFA cannot be used, an MFA method from the list
- below SHALL be used in the interim:
-
- - Microsoft Authenticator (Push Notifications)
-
- - Microsoft Authenticator (Phone Sign-in) (Also referred to as
- Passwordless Sign-in)
-
- - When using Microsoft Authenticator:
-
- - Number Matching SHALL be enabled.
-
- - Additional Context SHALL be enabled.
-
- - Software Tokens One-Time Password (OTP) – This option is commonly implemented using mobile phone authenticator apps
+#### MS.AAD.3.2v1
+If Phishing-resistant MFA has not been enforced yet, then an alternative MFA method SHALL be enforced for all users.
- - Hardware tokens OTP
-- _Rationale:_ TODO
+- _Rationale:_ This is a backup security policy to help protect the tenant in the event that phishing-resistant MFA has not been enforced yet. This policy requires that MFA is enforced and thus reduces the risks of single form authentication.
- _Last modified:_ June 2023
+- _Note:_ If a conditional access policy has been created that enforces phishing-resistant MFA, then this policy is not necessary. This policy does not dictate the specific MFA method.
-#### MS.AAD.4.4v1
-SMS or Voice as the MFA method SHALL NOT be used.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-### Resources
-
-- [What authentication and verification methods are available in Azure
- Active
- Directory?](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods)
-
-- [Use number matching in multifactor authentication (MFA) notifications
- (Preview) - Azure Active Directory - Microsoft Entra \| Microsoft
- Docs](https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match#enable-number-matching-in-the-portal)
+#### MS.AAD.3.3v1
+If Phishing-resistant MFA has not been enforced yet and Microsoft Authenticator is enabled, it SHALL be configured to show login context information.
-- [Use additional context in Microsoft Authenticator notifications
- (Preview) - Azure Active Directory - Microsoft Entra \| Microsoft
- Docs](https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context#enable-additional-context-in-the-portal)
-
-- [M-22-09 Federal Zero Trust
- Strategy](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)
-
-### License Requirements
+- _Rationale:_ This is a backup security policy to help protect the tenant in the event that phishing-resistant MFA has not been enforced yet and Microsoft Authenticator is being used. This policy helps improve the security of Microsoft Authenticator by showing the user context information which helps reduce MFA phishing compromises.
+- _Last modified:_ June 2023
-- N/A
+#### MS.AAD.3.4v1
+The Authentication Methods Manage Migration feature SHALL be set to Migration Complete.
-### Implementation
+- _Rationale:_ By configuring the Manage Migration feature to Migration Complete, we ensure that the tenant has disabled the legacy authentication methods screen. The MFA and SSPR authentication methods are both managed from a central admin page thereby reducing administrative complexity and
+reducing the chances of security misconfigurations.
+- _Last modified:_ June 2023
-**Policy \#1:**
-
-1. Follow [these
- instructions](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa)
- to create a conditional access policy that requires all users to
- authenticate with MFA.
-
-**Policy \#2:**
-
-Use the following instructions to configure a phishing-resistant MFA
-method for users with highly privileged roles. If the agency is
-configuring a phishing-resistant MFA method for all users, then the
-instructions in this section also apply, but set the **Target** to **All
-Users** instead of a specific group in the respective configuration
-screens.
-
-CISA recommends placing highly privileged users into an Azure AD group
-named “Highly Privileged Admins” or an equivalent and then referencing
-the group in the MFA configuration. Newly created, highly privileged
-users should be added to the group so they can register a
-phishing-resistant method. CISA does not recommend assigning MFA methods
-directly to individual users.
-
-Select one of the following phishing-resistant MFA methods to configure:
-
-**FIDO2 Security Key**
-
-1. Follow the instructions at [this
- link](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key#enable-fido2-security-key-method)
- to configure FIDO2.
-2. For **Enable**, select **Yes.**
-3. For **Target**, select the **Highly Privileged Admins** group or an
- equivalent.
-
-**Certificate Based Authentication (CBA)**
-
-
-1. Follow the instructions at [this
- link](https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication#steps-to-configure-and-test-azure-ad-cba)
- to configure CBA.
-2. On the tenant, in the instructions section named [**Enable CBA on
- the
- tenant**](https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-certificate-based-authentication#step-4-enable-cba-on-the-tenant)
- , under **Target**, select the **Highly Privileged Admins** group or
- an equivalent.
-
-**Windows Hello for Business**
-
-1. Follow the instructions at [this
- link](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-deployment-guide)
- to configure Windows Hello for Business.
-
-**Policy \#3:**
-
-If the agency is implementing a phishing-resistant MFA method for all
-users, follow the instructions in the previous section. Otherwise use
-the following instructions to configure a non-phishing resistant MFA
-method for users that are not in highly privileged roles.
-
-**Microsoft Authenticator (Phone Sign-in) (Also referred to as
-Passwordless Sign-in) or Microsoft Authenticator (Push Notifications)**
-
-1. In the Azure Portal navigate to **Azure Active Directory.**
-2. Select **Security.**
-3. Select **Manage** -\> **MFA.**
-4. Under **Configure,** select **Additional cloud-based MFA settings.**
-5. Under **verification options**, select **Notification through mobile
- app.**
-6. If desired, to enforce Microsoft Authenticator app usage and disable
- third party authenticator apps usage, make sure that **Verification
- code from mobile app** or **hardware token** is not selected.
-7. Click **Save.**
-8. Go back to the **Azure Active Directory** home tab and select
- **Security**.
-9. Select **Authentication Methods**.
-10. In the **Policies** window, select **Microsoft Authenticator**.
-11. For **Enable**, select **Yes**.
-12. For **Target**, select **All users**.
-13. In the row for the **All users**, click the … -\> **Configure**.
-14. If configuring Phone Sign-in (aka Passwordless Sign-in), for
- **Authentication mode**, select **Passwordless**. If configuring
- Push Notifications, for **Authentication mode**, select **Push**. If
- configuring the usage of both, for **Authentication mode**, select
- **Any**.
-15. For **Require number matching**, select **Enabled**.
-16. For **Show additional context in notifications**, select
- **Enabled**.
-17. Select **Done**.
-18. Click **Save**.
-
-**Software Tokens OTP or Hardware Tokens OTP**
-
-1. In the **Azure Portal**, navigate to **Azure Active Directory**.
-2. Select **Security**.
-3. Select **Manage** -\> **MFA**.
-4. Under **Configure**, select **Additional cloud-based MFA settings**.
-5. Under **verification options**, select **Verification code from
- mobile app** or **hardware token**.
-6. If configuring Hardware Tokens OTP, follow the additional steps at
- [this link](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens#oath-hardware-tokens-preview)
- when provisioning a user.
-
-**Policy \#4:**
-
-1. In the **Azure Portal,** navigate to **Azure Active Directory**.
-2. Select **Security**.
-3. Select **Manage** -\> **MFA**.
-4. Under **Configure**, select **Additional cloud-based MFA settings**.
-5. Under **verification options**, make sure that **Text message to
- phone** and **Call to phone** are **disabled**.
-
-## 5. Azure AD logs
-
-Configure Azure AD to send critical logs to the agency’s centralized
-SIEM and to CISA’s central analysis system so that they can be audited
-and queried. Configure Azure AD to send logs to a storage account and
-retain them for when incident response is needed.
+#### MS.AAD.3.5v1
+The authentication methods SMS, Voice Call and Email OTP SHALL be disabled.
-### Policies
-#### MS.AAD.5.1v1
-The following critical logs SHALL be sent at a minimum: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents.
-- _Rationale:_ TODO
+- _Rationale:_ This policy helps reduce the possibility for users to register and authenticate with the weakest authenticators. Thus users are forced to use stronger MFA methods.
- _Last modified:_ June 2023
+- _Note:_ This policy is only applicable if the tenant has their Manage Migration feature set to Migration Complete because that is required to manage the respective configuration options from the combined MFA / SSPR authentication methods page.
-
+#### MS.AAD.3.6v1
+Phishing-resistant MFA SHALL be required for Highly Privileged Roles.
-#### MS.AAD.5.2v1
-If managed identities are used for Azure resources, logs SHALL include the ManagedIdentitySignInLogs log type.
-- _Rationale:_ TODO
+- _Rationale:_ This is a backup security policy to help protect privileged access to the tenant in the event that the conditional access policy which requires MFA for all users is disabled or misconfigured.
- _Last modified:_ June 2023
+- _Note:_ Refer to the Highly Privileged Roles section at the top of this document for a reference list of roles considered highly privileged.
-#### MS.AAD.5.3v1
-If the Azure AD Provisioning Service is used to provision users to SaaS apps or other systems, also include the ProvisioningLogs log type.
-- _Rationale:_ TODO
+#### MS.AAD.3.7v1
+Managed devices SHOULD be required for authentication.
+
+- _Rationale:_ The security risk of an adversary authenticating to the tenant from their own device is reduced by requiring a managed device to authenticate. Managed devices are under the provisioning and control of the agency. OMB-22-09 specifically states "When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user".
- _Last modified:_ June 2023
-
+#### MS.AAD.3.8v1
+Managed Devices SHOULD be required to register MFA.
-#### MS.AAD.5.4v1
-The logs SHALL be sent to the agency's SOC for monitoring.
-- _Rationale:_ TODO
+- _Rationale:_ The security risk of an adversary using stolen user credentials and then registering their own MFA devices to access the tenant is reduced by requiring a managed device to perform registration actions. Thus the adversary cannot perform the registration from their own unmanaged device. Managed devices are under the provisioning and control of the agency.
- _Last modified:_ June 2023
### Resources
-- [Everything you wanted to know about Security and Audit Logging in
- Office
- 365](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/)
-
-- [Sign-in logs in Azure Active Directory -
- preview](https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins)
-
-- [National Cybersecurity Protection System-Cloud Interface Reference
- Architecture Volume
- 1](https://www.cisa.gov/sites/default/files/publications/NCPS%20Cloud%20Interface%20RA%20Volume%20One%20%282021-05-14%29.pdf)
+- [What authentication and verification methods are available in Azure Active Directory?](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods)
-- [National Cybersecurity Protection System - Cloud Interface Reference
- Architecture Volume
- 2](https://www.cisa.gov/sites/default/files/publications/NCPS%20Cloud%20Interface%20RA%20Volume%20Two%202021-06-11%20%28508%20COMPLIANT%29.pdf)
-
-### License Requirements
-
-- N/A
+- [How to use additional context in Microsoft Authenticator notifications Authentication methods policy](https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context#enable-additional-context-in-the-portal)
-### Implementation
-
-[Follow these instructions](https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-azure-monitor-route-logs-to-storage-account)
-to configure sending the logs to a storage account:
-
-1. From the **Diagnostic settings** page, click **Add diagnostic**
- setting.
-
-2. Select the specific logs mentioned in the previous policy section.
-
-3. Under **Destination Details,** select the **Archive to a storage
- account** check box and select the storage account that was
- specifically created to host security logs.
-
-4. In the **Retention** field enter “365” days.
-
-## 6. Register Third-Party Applications
-
-Ensure that only administrators can register third-party applications
-that can access the tenant.
+- [M-22-09 Federal Zero Trust Strategy](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)
-### Policies
-#### MS.AAD.6.1v1
-Only administrators SHALL be allowed to register third-party applications.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+- [Configure hybrid Azure AD join](https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join)
-### Resources
+- [Azure AD joined devices](https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join)
-- [Restrict Application Registration for Non-Privileged
- Users](https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/users-can-register-applications.html)
+- [Set up enrollment for Windows devices (for Intune)](https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enroll)
### License Requirements
-- N/A
+- Microsoft Intune (if implementing the authentication policies for the device to be managed).
### Implementation
-1. In the **Azure Portal**, navigate to **Azure Active Directory.**
+#### MS.AAD.3.1v1, instructions:
-
+1. Create a conditional access policy that enforces phishing-resistant MFA for all users.
-2. Under **Manage**, select **Users**.
+Follow the conditional access policy template below:
-3. Select **User settings**.
+ Users > Include > All users
-4. Under **App Registrations** -\> **Users can register applications**,
- select **No.**
+ Target resources > Cloud apps > All cloud apps
+
+ Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA
-5. Click **Save**.
+#### MS.AAD.3.2v1, instructions:
-## 7. Consenting to Third-Party Applications
+1. If Phishing-resistant MFA has not been enforced for all users yet, create a conditional access policy that enforces MFA but does not dictate the MFA method.
-Ensure that only administrators can consent to third-party applications
-and only administrators can control which permissions are granted. An
-admin consent workflow can be configured in Azure AD, otherwise users
-will be blocked when they try to access an application that requires
-permissions to access organizational data. Develop a process for
-approving and managing third-party applications.
+Follow the conditional access policy template below.
-### Policies
-#### MS.AAD.7.1v1
-Only administrators SHALL be allowed to consent to third-party
- applications.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+ Users > Include > All users
-#### MS.AAD.7.2v1
-An admin consent workflow SHALL be configured.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+ Target resources > Cloud apps > All cloud apps
+
+ Access controls > Grant > Grant Access > Require multifactor authentication
-#### MS.AAD.7.3v1
-Group owners SHALL NOT be allowed to consent to third-party applications.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+#### MS.AAD.3.3v1, instructions:
+If Phishing-resistant MFA has not been deployed yet and Microsoft Authenticator is in use, configure Authenticator to display context information to users when they login.
-### Resources
+1. In **Azure Active Directory**, click **Security > Authentication methods > Microsoft Authenticator**.
+2. Click the **Configure** tab.
+3. For **Allow use of Microsoft Authenticator OTP** select *No*.
+4. Under **Show application name in push and passwordless notifications** select **Status > Enabled** and **Target > Include > All users**.
+5. Under **Show geographic location in push and passwordless notifications** select **Status > Enabled** and **Target > Include > All users**.
+6. Select **Save**
-- [Enforce Administrators to Provide Consent for Apps Before
- Use](https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/users-can-consent-to-apps-accessing-company-data-on-their-behalf.html)
-- [Configure the admin consent
- workflow](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow)
+#### MS.AAD.3.4v1, instructions:
+1. Go through the process of migrating from the legacy AAD MFA and Self-Service Password Reset (SSPR) administration pages to the new unified Authentication Methods policy page. Follow [these instructions ](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-authentication-methods-manage).
+2. Once ready to finish the migration, follow [these instructions ](https://learn.microsoft.com/en-us/azure/active-directory/authentication/how-to-authentication-methods-manage#finish-the-migration) and set the **Manage Migration** option to **Migration Complete**.
-### License Requirements
+#### MS.AAD.3.5v1, instructions:
+1. In **Azure Active Directory**, click **Security > Authentication methods**
+2. Click on the **SMS**, **Voice Call**, and **Email OTP** authentication methods and disable each of them. Their statuses should be **Enabled > No** on the **Authentication methods > Policies** page.
-- N/A
+#### MS.AAD.3.6v1, instructions:
-### Implementation
+1. Create a conditional access policy that enforces phishing-resistant MFA for highly privileged roles.
-1. In the **Azure Portal**, navigate to **Azure Active Directory.**
+Follow the conditional access policy template below:
-
+ Users > Include > Select users and groups > Directory roles > select each of the roles listed in the Highly Privileged Roles section at the top of this document
-2. Create a new Azure AD Group that contains admin users responsible
- for reviewing and adjudicating app requests.
+ Target resources > Cloud apps > All cloud apps
+
+ Access controls > Grant > Grant Access > Require authentication strength > Phishing-resistant MFA
-3. Under **Manage**, select **Enterprise Applications.**
+#### MS.AAD.3.7v1, instructions:
-4. Under **Security**, select **Consent and permissions.**
+1. Create a conditional access policy that requires a user's device to be
+either hybrid Azure AD joined or compliant during authentication.
-5. Under **User consent for applications**, select **Do not allow user
- consent.**
+Follow the conditional access policy template below.
-6. Under **Group owner consent for apps accessing data**, select **Do
- not allow group owner consent.**
+ Users > Include > All users
-7. In the menu, navigate back to **Enterprise Applications**.
+ Target resources > Cloud apps > All cloud apps
+
+ Access controls > Grant > Grant Access > "Require device to be marked as compliant" and "Require Hybrid Azure AD joined device" > Require one of the selected controls
-8. Under **Manage**, select **User Settings**.
+#### MS.AAD.3.8v1, instructions:
-9. Under **Admin consent requests** -\> **Users can request admin
- consent to apps they are unable to consent to**, select **Yes.**
+1. Create a conditional access policy that requires a user to be on a managed device when registering for MFA.
-10. Under **Who can review admin consent requests**, select the group
- created in step two that is responsible for reviewing and
- adjudicating app requests.
+Follow the conditional access policy template below.
-11. Click **Save**
+ Users > Include > All users
-## 8. Passwords
+ Target resources > User actions > Register security information
+
+ Access controls > Grant > Grant Access > "Require device to be marked as compliant" and "Require Hybrid Azure AD joined device" > Require one of the selected controls
-Ensure that user passwords do not expire. Both the National Institute of
-Standards and Technology (NIST) and Microsoft emphasize MFA because they
-indicate that mandated password changes make user accounts less secure.
+## 4. Centralized Log Collection
+
+This section provides policies that help reduce security risks related to the lack of security logs which hampers security visibility.
### Policies
-#### MS.AAD.8.1v1
-User passwords SHALL NOT expire.
-- _Rationale:_ TODO
+#### MS.AAD.4.1v1
+Security logs SHALL be sent to the agency's Security Operations Center for monitoring.
+
+- _Rationale:_ The security risk of not having visibility into cyber attacks is reduced by collecting the logs into the agency's centralized security detection infrastructure. Thus security events can be audited, queried and available for incident response.
- _Last modified:_ June 2023
+- _Scope:_ The following logs (configured in Azure AD diagnostic settings), are required: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents, EnrichedOffice365AuditLogs, MicrosoftGraphActivityLogs. If managed identities are used for Azure resources, also send the ManagedIdentitySignInLogs log type. If the Azure AD Provisioning Service is used to provision users to SaaS apps or other systems, also send the ProvisioningLogs log type.
+- _Federal Agencies:_ It is also recommended to send the logs to the CISA CLAW system so that agencies can benefit from the security detection capabilities offered there. Contact CISA to request integration instructions.
### Resources
-- [Password policy recommendations - Microsoft 365 admin \| Microsoft
- Docs](https://docs.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide#password-expiration-requirements-for-users)
+- [Everything you wanted to know about Security and Audit Logging in
+ Office 365](https://thecloudtechnologist.com/2021/10/15/everything-you-wanted-to-know-about-security-and-audit-logging-in-office-365/)
-- [Eliminate bad passwords using Azure Active Directory Password
- Protection](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad)
+- [Sign-in logs in Azure Active Directory -
+ preview](https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins)
-- [NIST Special Publication 800-63B - Digital Identity
- Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html)
+- [National Cybersecurity Protection System-Cloud Interface Reference
+ Architecture Volume
+ 1](https://www.cisa.gov/sites/default/files/publications/NCPS%20Cloud%20Interface%20RA%20Volume%20One%20%282021-05-14%29.pdf)
### License Requirements
-- N/A
+- An Azure subscription is required to send the logs to an external system such as the agency's SIEM.
### Implementation
-[Follow the instructions at this
-link](https://docs.microsoft.com/en-us/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-worldwide#set-password-expiration-policy)
-to configure the password expiration policy.
-
-## 9. Session Length
-
-To reduce the risk of credential theft during user sessions, configure
-the sign-in frequency to a limited period of time.
-
-### Policies
-#### MS.AAD.9.1v1
-Sign-in frequency SHALL be configured to 12 hours.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-### Resources
-
-- [Configure authentication session management with Conditional
- Access](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime)
-
-- [NIST Special Publication 800-63B - Digital Identity
- Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html)
-
-### License Requirements
-
-- N/A
+#### MS.AAD.4.1v1, instructions:
-### Implementation
+[Follow these instructions](https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/quickstart-azure-monitor-route-logs-to-storage-account)
+to configure sending the logs to a storage account:
-[Follow the instructions at this
-link](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime#policy-1-sign-in-frequency-control)
-to implement the conditional access policy that configures the sign-in
-frequency,
+1. From the **Diagnostic settings** page, click **Add diagnostic**
+ setting.
-1. Set the **Users** or **workload identities** to include **All
- users.**
+2. Select the specific logs mentioned in the previous policy section.
-2. Set the **Cloud apps or actions** to include **All cloud apps.**
+3. Under **Destination Details,** select the **Archive to a storage
+ account** check box and select the storage account that was
+ specifically created to host security logs.
-3. Set the **Access Controls** -\> **Session** -\> **Sign-in
- frequency** to a value of “12 hours”.
+4. In the **Retention** field enter “365” days.
-## 10. Browser Sessions
+## 5. Application Registration and Consent
-To reduce the risk of credential theft during user sessions, disallow
-persistent browser sessions.
+This section provides policies that help reduce security risks related to non privileged users adding malicious applications or service principals to the tenant. Malicious applications can perform many of the same operations as interactive users and can access data "on behalf of" compromised users. These policies apply to custom-developed applications and applications published by third-party vendors.
### Policies
-#### MS.AAD.10.1v1
-Browser sessions SHALL not be persistent.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-### Resources
-
-- [Configure authentication session management with Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime)
-
-- [NIST Special Publication 800-63B - Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html)
-
-### License Requirements
-
-- N/A
-
-### Implementation
+#### MS.AAD.5.1v1
+Only administrators SHALL be allowed to register applications.
-[Follow the instructions at this link](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime#policy-2-persistent-browser-session)
-to implement the conditional access policy that prevents persistent
-browser sessions.
+- _Rationale:_ Application access to the tenant presents a hightened security risk compared to interactive user access because applications are typically not subject to critical security protections such as MFA policies and others. Ensuring that only specific privileged users can register applications reduces the risks of unauthorized users installing malicious applications into the tenant.
+- _Last modified:_ June 2023
-1. Set the **Users or workload identities** to **include All users.**
+#### MS.AAD.5.2v1
+Only administrators SHALL be allowed to consent to applications.
-2. Set the **Cloud apps or actions** to include **All cloud apps.**
+- _Rationale:_ Ensuring that only specific privileged users can consent to applications reduces the risks of users giving insecure applications access to their data via [consent grant attacks](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide).
+- _Last modified:_ June 2023
-3. Set the **Access Controls -**\> **Session** -\> **Persistent browser
- session** to **Never persistent.**
+#### MS.AAD.5.3v1
+An admin consent workflow SHALL be configured for applications.
-## 11. Global Administrators
+- _Rationale:_ Configuring an admin consent workflow helps support the risk reduction of the previous policy by setting up a process for users to securely request access to applications necessary for business purposes. Administrators get the opportunity to review the permissions requested by new applications and approve or deny access based on a risk assessment.
+- _Last modified:_ June 2023
-Global Administrator is the highest privileged role in Azure AD because
-it provides unfettered access to the tenant. Therefore, if a user’s
-credential with these permissions were to be compromised, it would
-present grave risks to the security of the tenant. Limit the number of
-users that are assigned the role of Global Administrator. Assign users
-to finer-grained administrative roles that they need to perform their
-duties instead of being assigned the Global Administrator role.
+#### MS.AAD.5.4v1
+Group owners SHALL NOT be allowed to consent to applications.
-### Policies
-#### MS.AAD.11.1v1
-A minimum of two users and a maximum of four users SHALL be provisioned with the Global Administrator role.
-- _Rationale:_ TODO
+- _Rationale:_ In M365 group and team owners can consent to applications accessing data in the tenant, thus by preventing this and requiring consent requests to go through an approval consent workflow, the risks of exposure to malicious applications is reduced.
- _Last modified:_ June 2023
### Resources
-- [Best practices for Azure AD roles (Limit number of Global
- Administrators to less than 5)](https://docs.microsoft.com/en-us/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5)
+- [Restrict Application Registration for Non-Privileged
+ Users](https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/users-can-register-applications.html)
-- [About admin roles](https://docs.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide)
+- [Enforce Administrators to Provide Consent for Apps Before
+ Use](https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActiveDirectory/users-can-consent-to-apps-accessing-company-data-on-their-behalf.html)
+
+- [Configure the admin consent
+ workflow](https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow)
### License Requirements
@@ -741,132 +424,72 @@ A minimum of two users and a maximum of four users SHALL be provisioned with the
### Implementation
-**Policy bullet \#1:**
-
-1. In the **Azure Portal**, navigate to **Azure Active Directory.**
+#### MS.AAD.5.1v1, instructions:
-
+1. In **Azure Active Directory**, under **Manage**, select **Users**.
-2. Select **Roles and administrators.**
+2. Select **User settings**.
-3. Select the **Global administrator role.**
+3. For **Users can register applications**, select **No.**
-4. Under **Manage**, select **Assignments.**
+4. Click **Save**.
-5. Validate that between two to four users are listed.
+#### MS.AAD.5.2v1, instructions:
-
+1. In **Azure Active Directory** under **Manage**, select **Enterprise Applications.**
-6. For those who have Azure AD PIM, they will need to check both the
- **Eligible assignments** and **Active assignments** tabs. There
- should be a total of two to four users across both of these tabs
- (not individually).
+2. Under **Security**, select **Consent and permissions.**
-7. If any groups are listed, need to check how many users are members
- of each group and include that in the total count.
+3. Under **User consent for applications**, select **Do not allow user consent.**
-**Policy bullet \#2:**
+4. Click **Save**.
-1. In the **Azure Portal**, navigate to **Azure Active Directory.**
+#### MS.AAD.5.3v1, instructions:
-
+1. In **Azure Active Directory** create a new Azure AD Group that contains admin users responsible for reviewing and adjudicating application consent requests. Users in this group will be notified when users request consent for new applications.
-2. Select **Security.**
+2. Then in **Azure Active Directory** under **Manage**, select **Enterprise Applications.**
-3. Under **Manage**, select **Identity Secure Score.**
+3. Select **Admin consent settings**.
-4. Click the **Columns** button and ensure that all the available
- columns are selected to display and click **Apply.**
+4. Under **Admin consent requests** > **Users can request admin consent to apps they are unable to consent to**, select **Yes**.
-5. Review the score for the action named **Use limited administrative
- roles.**
+5. Under **Who can review admin consent requests**, select the group created in step 1 that is responsible for reviewing and adjudicating app requests.
-6. Ensure that the maximum score was achieved, and that the status is
- **Completed.**
+6. Click **Save**.
-7. If the maximum score was not achieved, click the improvement action
- and Microsoft provides a pop-up page with detailed instructions on
- how to address the weakness. In short, to address the weakness,
- assign users to finer grained roles (e.g., SharePoint Administrator,
- Exchange Administrator) instead of Global Administrator. Only the
- minimum number of users necessary should be assigned to Global
- Administrator. Once the roles are reassigned according to the
- guidance, check the score again after 48 hours to ensure compliance.
-
-## 12. Highly Privileged User Accounts
-
-Assign users that need to perform highly privileged tasks to cloud-only
-Azure AD accounts to minimize the collateral damage of an on-premises
-identity compromise.[^1]
-
-### Policies
-#### MS.AAD.12.1v1
-Users that need to be assigned to highly privileged Azure AD roles SHALL be provisioned cloud-only accounts that are separate from the on-premises directory or other federated identity providers.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+#### MS.AAD.5.4v1, instructions:
-#### MS.AAD.12.2v1
-The following built-in Azure AD roles are considered highly privileged at a minimum. Additional built-in roles that are considered highly privileged in the agency's environment can be added to this list:
+1. In **Azure Active Directory** under **Manage**, select **Enterprise Applications.**
- - Global Administrator
+2. Under **Security**, select **Consent and permissions.**
- - Privileged Role Administrator
+3. Under **Group owner consent for apps accessing data**, select **Do not allow group owner consent.**
- - User Administrator
+4. Click **Save**.
- - SharePoint Administrator
+## 6. Passwords
- - Exchange Administrator
+This section provides policies that help reduce security risks associated with legacy password practices that are no longer supported by research.
- - Hybrid Identity Administrator
+### Policies
+#### MS.AAD.6.1v1
+User passwords SHALL NOT expire.
- - Application Administrator
+- _Rationale:_ At a minimum, NIST, OMB and Microsoft have published guidance indicating that mandated periodic password changes make user accounts less secure. OMB-22-09 specifically states "Password policies must not require use of special characters or regular rotation".
- - Cloud Application Administrator.
-- _Rationale:_ TODO
- _Last modified:_ June 2023
### Resources
-- [Securing privileged access for hybrid and cloud deployments in Azure AD](https://docs.microsoft.com/en-us/azure/active-directory/roles/security-planning#ensure-separate-user-accounts-and-mail-forwarding-for-global-administrator-accounts)
-
-### License Requirements
-
-- N/A
-
-### Implementation
-
-Review [these](https://docs.microsoft.com/en-us/azure/active-directory/roles/view-assignments)
-instructions to identify users assigned to highly privileged roles and
-verify the account does not exist outside Azure AD.
-
-## 13. Multifactor Authentication for Highly Privileged Roles
-
-Require users to perform MFA to access highly privileged roles. This
-configuration provides a backup policy to enforce MFA for highly
-privileged users in case the main conditional access policy—which
-requires MFA for all users—is disabled or misconfigured.
-
-### Policies
-#### MS.AAD.13.1v1
-MFA SHALL be required for user access to highly privileged roles.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-
-
-- Refer to the baseline statement [Highly Privileged User Accounts SHALL
- be Cloud-Only](#2.12.1 Policy)
- for a recommended minimum list of Azure AD built-in roles that are
- considered highly privileged. It is also possible to designate
- additional built-in roles that are considered highly privileged in the
- agency’s environment based on its risk tolerance.
-
-### Resources
+- [Password policy recommendations - Microsoft 365 admin \| Microsoft
+ Docs](https://docs.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide#password-expiration-requirements-for-users)
-- [Five steps to securing your identity infrastructure](https://docs.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity)
+- [Eliminate bad passwords using Azure Active Directory Password
+ Protection](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad)
-- [M-22-09 Federal Zero Trust Strategy](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)
+- [NIST Special Publication 800-63B - Digital Identity
+ Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html)
### License Requirements
@@ -874,462 +497,282 @@ MFA SHALL be required for user access to highly privileged roles.
### Implementation
-[Follow these instructions](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa)
-to create a conditional access policy requiring MFA for access, but
-under **Assignments,** use the following tailored steps to scope the
-policy to privileged roles.
+#### MS.AAD.6.1v1, instructions:
-1. Under **Assignments**, select **Users and groups.**
+1. [Follow the instructions at this link](https://docs.microsoft.com/en-us/microsoft-365/admin/manage/set-password-expiration-policy?view=o365-worldwide#set-password-expiration-policy) and configure the **Password expiration policy** to **Set passwords to never expire**.
-
+## 7. Highly Privileged User Access
-2. Under **Include**, choose **Select users and groups**, then click
- the **Directory roles** checkbox. Select each of the roles listed in
- the baseline statement, [Highly Privileged User Accounts SHALL be Cloud-Only](Policy MS.AAD.12.1v1).
+This section provides policies that help reduce security risks related to the usage of highly privileged AAD built-in roles. Privileged administrative users have access to operations that can undermine the security of the tenant by changing configurations and security policies, thus special protections are necessary to secure this level of access.
-3. Under **Exclude**, follow Microsoft’s guidance from the previously
- provided instructions link.
+- _Note:_ Refer to the Highly Privileged Roles section at the top of this document for a reference list of roles considered highly privileged.
-## 14. Permanent Permissions
-
-Do not assign users to highly privileged roles using permanent active
-role assignments. Instead, assign users to eligible role assignments in
-a PAM system and provide an expiration period for active assignments
-requiring privileged users to reactivate their highly privileged roles
-upon expiration.
-
-**Note**: Although Azure AD PIM is referenced in the implementation
-instructions, an equivalent third-party PAM service may be used instead.
+- _Implementation Alternatives:_ Some of the policy implementations in this section reference specific features of the AAD Privileged Identity Management (PIM) service which provides “Privileged Access Management (PAM)” capabilities. As an alternative to AAD PIM, there are third-party products and services with equivalent PAM capabilities that can be leveraged if an agency chooses to do so.
### Policies
-#### MS.AAD.14.1v1
-Permanent active role assignments SHALL NOT be allowed for highly privileged roles. Active assignments SHALL have an expiration period.
-- Refer to the baseline statement, [Highly Privileged User Accounts SHALL be Cloud-Only](#2121-Policy), for a recommended minimum list of Azure AD built-in roles that are considered highly privileged. It is also possible to designate additional built-in roles that are considered highly privileged in the agency’s environment based on its risk tolerance.
-- _Rationale:_ TODO
+#### MS.AAD.7.1v1
+A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
+- _Rationale:_ The Global Administrator role provides unfettered access to the tenant. Therefore, reducing the number of users with this access makes it more challenging for an adversary to compromise a tenant. Microsoft recommends fewer than five users and CISA decided on fewer than eight based on the data from federal agency pilots.
- _Last modified:_ June 2023
-
-#### MS.AAD.14.2v1
-Provisioning of users to highly privileged roles SHALL NOT occur outside of a PAM system, such as the Azure AD PIM service, because this bypasses the controls the PAM system provides.
-- _Rationale:_ TODO
+#### MS.AAD.7.2v1
+Privileged users SHALL be provisioned with finer-grained roles instead Global Administrator.
+- _Rationale:_ Many privileged administrative users do not need unfettered access to the tenant to perform their duties. By assigning them to roles based on least privilege, the risks associated with having their accounts compromised are reduced.
- _Last modified:_ June 2023
-### Resources
-
-- [Assign Azure AD roles in Privileged Identity Management](https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user)
-
-### License Requirements
+#### MS.AAD.7.3v1
+Privileged users SHALL be provisioned cloud-only accounts that are separate from an on-premises directory or other federated identity providers.
+- _Rationale:_ By provisioning cloud-only AAD user accounts to privileged users, the risks associated with a compromise of on-premises federation infrastructure are reduced. It is more challenging for the adversary to pivot from the compromised environment to the cloud with privileged access.
+- _Last modified:_ June 2023
-- Use of an Azure AD PIM or an equivalent third-party PAM service.
+#### MS.AAD.7.4v1
+Permanent active role assignments SHALL NOT be allowed for highly privileged roles except for emergency and service accounts.
-- Azure AD PIM requires an AAD P2 license
+- _Rationale:_ Instead of giving users permanent assignments to privileged roles, provisioning access "just in time" lessens the exposure period if those accounts become compromised. In AAD PIM or an alternative PAM system, just in time access can be provisioned by assigning users to roles as "eligible" instead of perpetually "active".
+- _Last modified:_ June 2023
+- _Note:_ There are a couple of exceptions to this policy. Emergency access accounts need perpetual access to the tenant in the rare event of system degredation or other scenarios. Some types of service accounts require a user account with privileged roles and since those are software they cannot perform role activation.
-### Implementation
+#### MS.AAD.7.5v1
+Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system, because this bypasses critical controls the PAM system provides.
+- _Rationale:_ By provisioning users to privileged roles within a PAM system, numerous privileged access policies and monitoring can be enforced. If privileged users are assigned directly to roles in the M365 admin center or via Powershell outside of the context of a PAM system, a significant set of critical security capabilities are bypassed.
+- _Last modified:_ June 2023
-Note: Any parts of the following implementation instructions that
-reference the Azure AD PIM service will vary if using a third-party PAM
-system.
+#### MS.AAD.7.6v1
+Activation of the Global Administrator role SHALL require approval.
-1. In the **Azure Portal**, navigate to **Azure AD Privileged Identity
- Management (PIM).**
+- _Rationale:_ Requiring approval for a user to activate Global Administrator which provided unfettered access, makes it more challenging for an attacker to compromise the tenant with stolen credentials and it provides visibility of activities that may indicate a compromise is taking place.
+- _Last modified:_ June 2023
-
+#### MS.AAD.7.7v1
+Eligible and Active highly privileged role assignments SHALL trigger an alert.
-2. Under **Manage**, select **Azure AD roles**.
+- _Rationale:_ It is imperative to closely monitor the assignment of the highest privileged roles for signs of compromise. Sending alerts when these assignments occur provides the security monitoring team a chance to detect potential compromises in action.
+- _Last modified:_ June 2023
-3. Under **Manage**, select **Roles**. This should bring up a list of
- all the Azure AD roles managed by the PIM service.
+#### MS.AAD.7.8v1
+User activation of the Global Administrator role SHALL trigger an alert.
-4. **Note**: This step is specific to the first policy bullet.
- Repeat this step and step 5 for each highly privileged role
- referenced in the policy section. The role “Global Administrator” is
- used as an example in these instructions.
+- _Rationale:_ The rationale for this policy is identical to the previous one, except that this policy applies to user activations. "Activation" occurs when a user that is assigned as eligible, "turns on" their access for a specific period of time. Monitoring this action closely for Global Administrator helps to detect events with significant security implications in action.
+- _Last modified:_ June 2023
+- _Note:_ It is recommended to prioritize user activation of Global Administrator as one of the most important events to monitor and respond to.
-
- 1. Click the **Global Administrator** role in the list.
- 2. Click **Settings**.
- 3. Click **Edit.**
- 4. Select the **Assignment** tab.
- 5. De-select the option named **Allow permanent active assignment.**
- 6. Under **Expire active assignments after**, select **15 days**.
- 7. Click **Update.**
-
-
-
-5. Note: This step is specific to the second policy bullet.
-
-
-
- 1. While on the **Assignments** page for the role, select the **Active
- Assignments** tab.
- 2. Review the assignments list. If any of the assignments show a
- **Start time** of “-” (i.e., empty start time) and of **End time**
- of **Permanent**, then those role assignments were made outside of
- the PIM service and therefore are out of compliance with the policy.
- 3. Delete the non-compliant role assignments and then recreate them
- using the PIM service.
-
-
-
-6. In addition to checking for permanent assignments using the PIM
- Assignments page in step \#5, PIM also provides a report that lists
- all role assignments that were performed outside of PIM so that
- those assignments can be deleted and properly recreated using PIM.
-
-
-
- 1. From the **PIM landing page**, under **Manage**, select **Azure AD
- roles.**
- 2. Under **Manage**, select **Alerts.**
- 3. Click the **Scan** button and wait for the scan to complete.
- 4. If there were any roles assigned outside of PIM, the report will
- display an alert named, **Roles are being assigned outside of
- Privileged Identity Management**; Click that alert.
- 5. PIM displays a list of users, their associated roles, and the
- date/time that they were assigned a role outside of PIM: Delete the
- non-compliant role assignments and then recreate them using the PIM
- service.
-
-## 15. Activation of Highly Privileged Roles
-
-Require approval for a user to activate a highly privileged role, such
-as Global Administrator. This makes it more challenging for an attacker
-to leverage the stolen credentials of highly privileged users and
-ensures that privileged access is monitored closely.
-
-**Note**: Although Azure AD PIM is referenced in the implementation
-instructions, an equivalent third-party PAM service may be used instead.
+#### MS.AAD.7.9v1
+User activation of other highly privileged roles SHOULD trigger an alert.
-### Policies
-#### MS.AAD.15.1v1
-Activation of highly privileged roles SHOULD require approval.
-- _Rationale:_ TODO
+- _Rationale:_ The rationale for this policy is identical to the previous one, except that this policy applies to user activations of privileged roles that are not Global Administrator (i.e. the other privileged roles). CISA separated this policy from the previous one and designated it as a "SHOULD" item because in some environments activation of privileged roles can generate a significant number of alerts.
- _Last modified:_ June 2023
-
+### Resources
-- Refer to the baseline statement [Highly Privileged User Accounts SHALL be Cloud-Only](#2121-Policy)
- for a list of Azure AD built-in roles that are considered highly
- privileged. It is also possible to configure additional built-in roles
- that are considered highly privileged in the agency’s environment
- based on its risk tolerance.
+- [Best practices for Azure AD roles (Limit number of Global Administrators to less than 5)](https://docs.microsoft.com/en-us/azure/active-directory/roles/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5)
-### Resources
+- [Implement Privilege Access Management](https://learn.microsoft.com/en-us/azure/security/fundamentals/steps-secure-identity#implement-privilege-access-management)
+
+- [Assign Azure AD roles in Privileged Identity Management](https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user)
- [Approve or deny requests for Azure AD roles in Privileged Identity Management](https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/azure-ad-pim-approval-workflow)
+- [Configure security alerts for Azure AD roles in Privileged Identity Management](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts)
+
### License Requirements
-- Use an Azure AD PIM or an equivalent third-party PAM service
+- Azure AD PIM or an equivalent third-party PAM service.
- Azure AD PIM requires an AAD P2 license
### Implementation
-**Note**: Any parts of the following implementation instructions that
-reference the Azure AD PIM service will vary if using a third-party PAM
-system.
+- _Note:_ Steps in the following implementation instructions that reference the AAD PIM service will vary if using a third-party PAM system instead.
-1. In the **Azure Portal**, navigate to **Azure AD** and create a new
- group named “Privileged Escalation Approvers.” This group will
- contain users that will receive role activation approval requests
- and approve or deny them. Users in this group must, at least, have
- the permissions provided to the Privileged Role Administrators role
- to adjudicate requests.
+- _Future revisions:_ Some of the implementation instructions associated with this group of policies may be revised in the next release to incorporate functionality provided by the the AAD PIM for Groups feature.
-2. In the **Azure Portal**, navigate to **Azure AD Privileged Identity
- Management (PIM).**
+#### MS.AAD.7.1v1, instructions:
-
+1. In **Azure Active Directory** select **Roles and administrators.**
-3. Under **Manage**, select **Azure AD roles**.
-
-4. Under **Manage**, select **Roles**. This should bring up a list of
- all the Azure AD roles managed by the PIM service.
-
-5. Repeat this step for the Privileged Role Administrator role, User
- Administrator role, and other roles that the agency has designated
- as highly privileged.
-
-
-
- 1. Click the **Global Administrator** role in the list.
- 2. Click **Settings.**
- 3. Click **Edit**.
- 4. Select the **Require approval to activate** option.
- 5. Click **Select approver**s, select the group **Privileged Escalation
- Approvers**, and then click **Select**.
- 6. Click **Update**.
-
-## 16. Highly Privileged Role Assignment and Activation
-
-Since many cyber attacks leverage privileged access, it is imperative to
-closely monitor the assignment and activation of the highest privileged
-roles for signs of compromise. Create alerts to trigger when a highly
-privileged role is assigned to a user and when a user activates a highly
-privileged role.
-
-Note: Although Azure AD PIM is referenced in the implementation
-instructions, an equivalent third-party PAM service may be used instead.
-
-### Policies
-#### MS.AAD.16.1v1
-Eligible and Active highly privileged role assignments SHALL trigger an alert.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-
-
- - Refer to the baseline statement [Highly Privileged User Accounts SHALL be Cloud-Only](#2121-Policy)
- for a recommended minimum list of Azure AD built-in roles that are
- considered highly privileged. It is also possible to designate
- additional built-in roles that are considered highly privileged in the
- agency’s environment based on its risk tolerance.
-
-
-
-#### MS.AAD.16.2v1
-User activation of the Global Administrator role SHALL trigger an
- alert.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-
-#### MS.AAD.16.3v1
-User activation of other highly privileged roles SHOULD trigger an alert.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+2. Select the **Global administrator role.**
-
+3. Under **Manage**, select **Assignments.**
- - Note: Alerts can be configured for user activation of other highly
- privileged roles as well but note that if users activate these other
- roles frequently, it can prompt a significant number of alerts.
- Therefore, for those other roles, it might be prudent to set up a
- separate monitoring mailbox from the one configured for the alerts
- associated with the Global Administrator role. This separate mailbox
- would be designed to store alerts for “review as necessary” purposes
- versus the mailbox configured for the Global Administrator role, which
- should be monitored closely since that role is sensitive.
+4. Validate that between two to eight users are listed.
-### Resources
+5. If you have AAD PIM, count the number of users in both the **Eligible assignments** and **Active assignments** tabs. There should be a total of two to eight users across both of these tabs (not individually). Do not count the same username twice. If any groups are listed, count the number of users that are members of the group and include it in the total count.
-- [Assign Azure AD roles in Privileged Identity Management](https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user)
+#### MS.AAD.7.2v1, instructions:
-### License Requirements
+1. In **Azure Active Directory** select **Security.**
-- Use an Azure AD PIM or an equivalent third-party PAM service.
+2. Under **Manage**, select **Identity Secure Score.**
-- Azure AD PIM requires an AAD P2 license
+3. Click the **Columns** button and select all the available columns and click **Apply.**
-### Implementation
+4. Review the score for the action named **Use least privileged administrative roles.**
-Note: Any parts of the following implementation instructions that
-reference the Azure AD PIM service will vary if using a third-party PAM
-system.
+5. Review the **current score** value and compare it to the **max score**.
+If the current score is not the maximum value and the status is not **Completed**, you must perform the improvement actions. If that is the case, follow the detailed action steps and then check the score again after 48 hours to ensure compliance.
-1. In the **Azure Portal**, navigate to **Azure AD Privileged Identity
- Management (PIM).**
+#### MS.AAD.7.3v1, instructions:
+Note: Performing a manual review of highly privileged users to determine which ones are not cloud-only is labor intensive so we recommend running the ScubaGear tool instead. ScubaGear will provide a list of the highly privileged users that are not cloud-only.
-
+1. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.
-2. Under **Manage**, select A**zure AD roles.**
+2. In **Azure Active Directory** select **Roles and administrators.**
-3. Under **Manage**, select **Roles**. This should bring up a list of
- all the Azure AD roles managed by the PIM service.
+3. Select the **Global administrator role.**
-4. Click the **Global Administrator** role.
+4. Under **Manage**, select **Assignments.** If you have AAD PIM, repeat the steps below for both the **Eligible** and the **Active** assignments. If a group is listed, you will need to determine the members of the group and perform the steps for each group member.
-5. Click **Settings** and then click **Edit.**
+5. For each highly privileged user, execute the Powershell code below but replace the **username@somedomain.com** sample data value with the principal name of the user that is specific to your environment. You can get the data value from the **Principal name** field displayed in the Azure Active Directory portal.
-6. Click the **Notification** tab.
+```
+Connect-MgGraph
+Select-Mgprofile beta
+Get-MgUser -Filter "userPrincipalName eq 'username@somedomain.com'" | FL
+```
-7. Under **Send notifications when members are assigned as eligible to
- this role**, in the **Role assignment alert** -\> **Additional
- recipients** textbox, enter the email address of the mailbox
- configured to receive the alerts for this role.
+6. Review the output field named **OnPremisesImmutableId**. If this field has a data value, it means that this specific user is not cloud-only. If the user is not cloud-only, create a cloud-only account for that user, assign the user to their respective roles and then remove the account that is not cloud-only from AAD.
-8. Under S**end notifications when members are assigned as active to
- this role**, in the **Role assignment alert** -\> **Additional
- recipients** textbox, enter the email address of the mailbox
- configured to receive the alerts for this role.
+#### MS.AAD.7.4v1, instructions:
-9. Under **Send notifications when eligible members activate this
- role**, in the **Role activation alert** -\> **Additional
- recipients** textbox, enter the email address of the mailbox
- configured to receive the alerts for this role.
+1. In **Azure Active Directory** select **Roles and administrators**. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.
-10. Click **Update**.
+2. Select the **Global administrator role.**
-11. Repeat steps 4 through 10 for each of the other highly privileged
- roles referenced in the policy section above, with one modification:
+3. Under **Manage**, select **Assignments** and click the **Active assignments** tab.
-
+4. Verify that there are no users or groups with a value of **Permanent** in the **End time** column. If there are any, recreate those assignments to have an expiration date using AAD PIM or an alternative PAM system. The only exception to this policy are emergency access accounts and service accounts that require perpetual active assignments. See policy for details.
- 1. When configuring the **Send notifications when eligible members
- activate this role** for these other roles, enter an email address
- of a mailbox that is different from the one used to monitor Global
- Administrator activations.
+#### MS.AAD.7.5v1, instructions:
+
+1. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.
-## 17. Managed Devices
+2. In **Azure Active Directory** select **Roles and administrators.**
-Require that users connect to M365 from a device that is managed using
-conditional access. Agencies that are implementing a hybrid Azure AD
-environment will likely use the conditional access control option named
-**Hybrid Azure AD joined**, whereas agencies that are using devices that
-connect directly to the cloud and do not join an on-premises AD will use
-the conditional access control option named, **Require device to be
-marked as compliant**.
+3. Select the **Global administrator role.**
-**Guest user access note**: This conditional access policy will impact
-guest access to the tenant because guest users will be required to
-authenticate from a managed device similar to regular Azure AD users.
-For guest users, the organization that manages their home tenant is
-responsible for managing their devices and the resource tenant must be
-configured to trust the device claims from the home tenant, otherwise
-guest users will be blocked by the policy. [This link](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/authentication-conditional-access) describes the
-detailed authentication flow for guest users and how conditional access
-related to devices is applied.
-The implementation section describes the cross-tenant settings that must
-be configured in both the home and the resource tenants to facilitate
-guest access with managed devices.
+4. Under **Manage**, select **Assignments.** Repeat the steps below for both the **Eligible** and the **Active** AAD PIM assignments.
-### Policies
-#### MS.AAD.17.1v1
-Managed devices SHOULD be required for authentication.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
+5. For each user or group listed, examine the value in the **Start time** column. If it contains a value of **-**, this indicates that the respective user / group was assigned to that role outside of AAD PIM. If the role was assigned outside of AAD PIM, delete the assignment and recreate it using AAD PIM.
-### Resources
-- [Configure hybrid Azure AD join](https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-hybrid-azure-ad-join)
+#### MS.AAD.7.6v1, instructions:
-- [Azure AD joined devices](https://docs.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-join)
+1. In **Azure Active Directory** create a new group named **Privileged Escalation Approvers**. This group will contain users that will receive role activation approval requests and approve or deny them.
-- [Set up enrollment for Windows devices (for Intune)](https://docs.microsoft.com/en-us/mem/intune/enrollment/windows-enroll)
+2. Assign this new group to the AAD role **Privileged Role Administrators**. This permission is required so that users in this group can adjudicate role activation approval requests.
-### License Requirements
+3. Assign the users responsible for reviewing approval requests to the new **Privileged Escalation Approvers** group via the [PIM for Groups feature](https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/concept-pim-for-groups).
-- Use Microsoft Intune (if implementing the requirement for the device
- to be compliant).
+4. In **AAD Privileged Identity Management (PIM)**, under **Manage**, select **Azure AD roles**.
-### Implementation
+5. Under **Manage**, select **Roles**.
-[Follow these instructions](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device#create-a-conditional-access-policy)
-to create a conditional access policy that requires the device to be
-either hybrid Azure AD joined or compliant during authentication.
+ 1. Select the **Global Administrator** role in the list.
+ 2. Click **Settings**.
+ 3. Click **Edit**.
+ 4. Select the **Require approval to activate** option.
+ 5. Click **Select approvers** and select the group **Privileged Escalation Approvers**, and then click **Select**.
+ 6. Click **Update**.
-Use the following instructions to facilitate guest access with managed
-devices. Although the agency implementing this baseline only controls
-the resource tenant and does not have control over the home tenant, CISA
-provides our recommended security configuration for the home tenant in
-this section.
+#### MS.AAD.7.7v1, instructions:
-Reference [this link](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/cross-tenant-access-overview)
-for a general description of cross-tenant access settings to become
-familiar with the terminology and configurations.
+1. In **AAD Privileged Identity Management (PIM)**, under **Manage**, select **Azure AD roles.**
-For the resource tenant, use the following steps (for demonstration
-purposes, the home tenant domain is named “home.onmicrosoft.com” —
-replace this name with the actual name of the tenant):
+2. Under **Manage**, select **Roles**. Perform the steps below for each highly privileged role. We reference the Global Administrator role as an example.
-
+3. Click the **Global Administrator** role.
-1. Navigate to **Azure AD** -\> **External Identities** -\>
- **Cross-tenant access settings.**
+4. Click **Settings** and then click **Edit.**
-
+5. Click the **Notification** tab.
-2. In **Organizational Settings**, add a new organization –
- “home.onmicrosoft.com”.
+6. Under **Send notifications when members are assigned as eligible to this role**, in the **Role assignment alert > Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.
-3. Open the **Inbound access** settings for the newly added
- organization.
+7. Under **Send notifications when members are assigned as active to this role**, in the **Role assignment alert > Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive privileged role assignment alerts.
-4. Click the **B2B collaboration** tab. Under **External users and
- Groups** -\> **Access status**, select **Allow access.**
+8. Click **Update**.
-5. Under **External users and Groups** -\> **Applies to**, select **All
- external users and groups.**
+#### MS.AAD.7.8v1, instructions:
-6. Click the **Trust settings** tab. Under **Customize settings** -\>
- select **Trust multi-factor authentication from Azure AD tenants**,
- **Trust compliant devices,** and **Trust hybrid Azure AD joined
- devices**
+1. In **AAD Privileged Identity Management (PIM)**, under **Manage**, select **Azure AD roles.**
-
+2. Under **Manage**, select **Roles**.
-For the home tenant, use the following steps (for demonstration
-purposes the resource tenant domain is named
-“resource.onmicrosoft.com” — replace this name with the actual name
-of the tenant):
+3. Click the **Global Administrator** role.
-
+4. Click **Settings** and then click **Edit.**
-1. Navigate to **Azure AD** -\> **External Identities** -\>
- **Cross-tenant access settings.**
+5. Click the **Notification** tab.
-
+6. Under **Send notifications when eligible members activate this role**, in the **Role activation alert > Additional recipients** textbox, enter the email address of the security monitoring mailbox configured to receive Global Administrator activation alerts.
-2. In **Organizational Settings**, Add a new organization –
- “resource.onmicrosoft.com”.
+7. Click **Update**.
-3. Open the **Outbound access** settings for the newly added
- organization.
+#### MS.AAD.7.9v1, instructions:
+
+ 1. Follow the same instructions as MS.AAD.7.8v1 for each of the highly privileged roles (other than Global Administrator) but enter a security monitoring mailbox that is different from the one used to monitor Global Administrator activations.
-4. Click the **B2B collaboration** tab. Under **Users and Groups** -\>
- **Access status**, select **Allow access.**
+## 8. Guest User Access
-5. Under **Users and Groups** -\> **Applies to**, select **All users.**
+This section provides policies that help reduce security risks related to the integration of M365 guest users. A guest user is a specific type of external user that belongs to a separate organization but can access files, meetings, teams and other data in the target tenant. It is common to invite guest users to a tenant for cross-agency collaboration purposes.
-## 18. Guest User Access
+#### MS.AAD.8.1v1
+Guest users SHOULD have limited or restricted access to Azure AD directory objects.
-Ensure that only users with specific privileges can invite guest users
-to the tenant and that invites can only be sent to specific external
-domains. Also ensure that guest users have limited access to Azure AD
-directory objects.
+- _Rationale:_ By limiting the amount of information about objects in the tenant that is available to guest users, this reduces the malicious reconnaissance exposure if a guest account is compromised or created by an adversary.
+- _Last modified:_ June 2023
-#### MS.AAD.18.1v1
+#### MS.AAD.8.2v1
Only users with the Guest Inviter role SHOULD be able to invite guest users.
-- _Rationale:_ TODO
+
+- _Rationale:_ By only allowing an authorized groups of individuals to invite guest users to create accounts in the tenant, this helps an agency enforce a guest user account approval process which reduces the risk of unauthorized accounts being created.
- _Last modified:_ June 2023
-#### MS.AAD.18.2v1
+#### MS.AAD.8.3v1
Guest invites SHOULD only be allowed to specific external domains that have been authorized by the agency for legitimate business purposes.
-- _Rationale:_ TODO
-- _Last modified:_ June 2023
-#### MS.AAD.18.3v1
-Guest users SHOULD have limited access to Azure AD directory objects.
-- _Rationale:_ TODO
+- _Rationale:_ Limiting which domains can be invited to create guest accounts in the tenant helps reduce the risk of users from unauthorized external organizations getting access.
- _Last modified:_ June 2023
### Resources
- [Configure external collaboration settings](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure)
+- [Compare member and guest default permissions](https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions#compare-member-and-guest-default-permissions)
+
### License Requirements
- N/A
### Implementation
-[Follow these instructions](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/external-collaboration-settings-configure#configure-settings-in-the-portal)
-to configure the Azure AD **External collaboration settings**.
+#### MS.AAD.8.1v1, instructions:
+
+1. In **Azure Active Directory** select **External Identities > External collaboration settings**.
+
+2. Under **Guest user access**, select either **Guest users have limited access to properties and memberships of directory objects** or **Guest user access is restricted to properties and memberships of their own directory objects (most restrictive)**.
+
+3. Click **Save**.
+
+#### MS.AAD.8.2v1, instructions:
+
+1. In **Azure Active Directory** select **External Identities > External collaboration settings**.
+
+2. Under **Guest invite settings**, select **Only users assigned to specific admin roles can invite guest users**.
+
+3. Click **Save**.
-1. Under **Guest user access**, select **Guest users have limited
- access to properties and memberships of directory objects.**
+#### MS.AAD.8.3v1, instructions:
-2. Under **Guest invite settings**, select **Only users assigned to
- specific admin roles can invite guest users**.
+1. In **Azure Active Directory** select **External Identities > External collaboration settings**.
-3. Under **Collaboration restrictions**, select **Allow invitations
+2. Under **Collaboration restrictions**, select **Allow invitations
only to the specified domains (most restrictive)**.
-
+3. Select **Target domains** and enter the names of the external domains that have been authorized by the agency for guest user access.
+
+4. Click **Save**.
-4. Select **Target domains** and enter the names of the external
- domains that have been authorized by the agency for guest user
- access.
# Acknowledgements
@@ -1385,45 +828,15 @@ Dr. Mukesh Rohatgi (MITRE), Lee Szilagyi (MITRE), Nanda Katikaneni
# Appendix A: Hybrid Azure AD Guidance
The majority of this document does not focus on securing hybrid Azure AD
-environments. CISA is working on a separate document that addresses the
-unique implementation requirements of hybrid Azure AD infrastructure,
-including the on-premises components. Meanwhile, the following limited
-set of hybrid Azure AD policies that include on-premises components are
-provided:
-
-- Azure AD Password Protection SHOULD be implemented for the on-premises
- directory.
-
-
-
-- [Enforce on-premises Azure AD Password Protection for Active Directory Domain Services](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises)
-
-- [Plan and deploy on-premises Azure Active Directory Password Protection](https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy)
-
-
-
-- Password hash synchronization with the on-premises directory SHOULD be
- implemented.
-
-
-
-- [Implement password hash synchronization with Azure AD Connect sync](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization)
-
-
+environments. CISA released a separate [Hybrid Identity Solutions Architecture](https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project) document that addresses the unique implementation requirements of hybrid Azure AD infrastructure. In addition, a limited set of hybrid Azure AD policies that include on-premises components are
+provided below:
-- Service accounts created in Azure AD to support the integration of
- Azure AD Connect SHOULD be restricted to originate from the IP address
- space of the network hosting the on-premises AD. This can be
- implemented via a conditional access policy that is applied to the
- Azure AD Connect service accounts and blocks access except from a
- specific Azure AD Named Location that is configured with respective
- on-premises IP address range.
+- [On-premises Azure AD Password Protection for Active Directory Domain Services](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises) SHOULD be enforced.
-
+- [Password hash synchronization](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization) with the on-premises directory SHOULD be implemented.
-- [Using the location condition in a Conditional Access policy](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition)
+# Appendix B: Cross-tenant Access Guidance
-- [Azure AD Connect: Accounts and permissions](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions)
+Some of the conditional access policies contained in this security baseline, if implemented as described herein, will impact guest user access to a tenant. For example, the policies require users to perform MFA and originate from a managed device to gain access. These requirements are also enforced for guest users. For these policies to work effectively with guest users, both the home tenant (the one that the guest user belongs to) and the resource tenant (the target tenant) may need to configure their AAD cross-tenant access settings.
-[^1]: “Cloud-only” user accounts have no ties to the on-premises AD and
- are not federated – they are local to Azure AD only.
+[Refer to this article](https://docs.microsoft.com/en-us/azure/active-directory/external-identities/authentication-conditional-access) to gain an understanding of how MFA and device claims are passed from the home tenant to the resource tenant. [Refer to this article](https://learn.microsoft.com/en-us/azure/active-directory/external-identities/cross-tenant-access-overview) to configure the inbound and outbound cross-tenant access settings in AAD.
diff --git a/images/aad-mfa.png b/images/aad-mfa.png
index 3f641b3d7a427bb93f551c9870c5fe9f25ae6961..563533f41f6b10ed68707c303330dd96a9c1e2a9 100644
GIT binary patch
literal 46669
zcmcG#Wl&q)8$DVm6t_~`S}0JUSaB~7#fuh~;_eax#id9o?(XjHR@@1i;7)K-g5C7}
z&D=Zp%m2fjxiiU-9CEfiXP^D7XRUQ2RF!3MFv&4rym)~lFDLc&#S3Jo7cY>w(O)5s
zRD8mfLi|B;{VFT*qH2=z5b*`YQd~*=#f#cltOpZR#CHrQxo@s7Uf>S=dm|;X;8MJJ
z(YPfqC9dIRc$$g!BSW+GDSJ6J^OQb)!olYZgU79aPFnRur;3*NWNV=u)NN3WgB6G~
zi230|AP$N&)9gDG3CzRJ=2M`D#nZm0he}3;yc}