metadata.json

{
  "framework": "cis",
  "benchmark": "CIS Microsoft 365 Foundations",
  "slug": "microsoft-365-foundations",
  "version": "v6.0.0",
  "release_date": "2025-03-18",
  "platform": "m365",
  "source_url": "https://www.cisecurity.org/benchmark/microsoft_365",
  "controls": [
    {
      "control_id": "1.1.1",
      "title": "Ensure Administrative accounts are cloud-only",
      "description": "Administrative accounts should not be synced from on-premises Active Directory.",
      "severity": "critical",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.roles.cloud_only_admins",
      "policy_file": "1.1.1_admin_cloud_only.rego",
      "requires_permissions": ["User.Read.All", "RoleManagement.Read.Directory"],
      "notes": null
    },
    {
      "control_id": "1.1.2",
      "title": "Ensure two emergency access accounts have been defined",
      "description": "Emergency access accounts provide access when normal administrative accounts are unavailable.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Organizational policy; requires human designation of accounts"
    },
    {
      "control_id": "1.1.3",
      "title": "Ensure that between two and four global admins are designated",
      "description": "Maintain between 2-4 global administrators to ensure operational continuity while minimizing attack surface.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.roles.privileged_roles",
      "policy_file": "1.1.3_global_admin_count.rego",
      "requires_permissions": ["RoleManagement.Read.Directory", "User.Read.All"],
      "notes": null
    },
    {
      "control_id": "1.1.4",
      "title": "Ensure administrative accounts use licenses with a reduced application footprint",
      "description": "Administrative accounts should have minimal license assignments.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Need to check user license assignments"
    },
    {
      "control_id": "1.2.1",
      "title": "Ensure that only organizationally managed/approved public groups exist",
      "description": "Public groups should be reviewed and managed by the organization.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.groups.groups",
      "policy_file": "1.2.1_no_unmanaged_public_groups.rego",
      "requires_permissions": ["Group.Read.All"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "1.2.2",
      "title": "Ensure sign-in to shared mailboxes is blocked",
      "description": "Shared mailboxes should not allow direct sign-in.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "exchange.mailbox.mailboxes",
      "policy_file": null,
      "requires_permissions": ["Exchange.Manage"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "1.3.1",
      "title": "Ensure the 'Password expiration policy' is set to 'Set passwords to never expire (recommended)'",
      "description": "Configure password policies to never expire when MFA is enabled.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.domains.password_policy",
      "policy_file": "1.3.1_password_expiration.rego",
      "requires_permissions": ["Domain.Read.All"],
      "notes": null
    },
    {
      "control_id": "1.3.2",
      "title": "Ensure 'Idle session timeout' is set to '3 hours (or less)' for unmanaged devices",
      "description": "Configure idle session timeout for unmanaged devices.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires CA policy coverage verification"
    },
    {
      "control_id": "1.3.3",
      "title": "Ensure 'External sharing' of calendars is not available",
      "description": "Disable external calendar sharing.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "exchange.organization.sharing_policy",
      "policy_file": null,
      "requires_permissions": ["Exchange.Manage"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "1.3.4",
      "title": "Ensure 'User owned apps and services' is restricted",
      "description": "Restrict user ability to consent to apps and services.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.applications.apps_and_services_settings",
      "policy_file": "1.3.4_user_owned_apps_restricted.rego",
      "requires_permissions": ["OrgSettings-AppsAndServices.Read.All"],
      "notes": null
    },
    {
      "control_id": "1.3.5",
      "title": "Ensure internal phishing protection for Forms is enabled",
      "description": "Enable internal phishing protection in Microsoft Forms.",
      "severity": "medium",
      "service": "Forms",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.applications.forms_settings",
      "policy_file": "1.3.5_forms_internal_phishing_protection.rego",
      "requires_permissions": ["OrgSettings-Forms.Read.All"],
      "notes": null
    },
    {
      "control_id": "1.3.6",
      "title": "Ensure the customer lockbox feature is enabled",
      "description": "Enable Customer Lockbox for Microsoft support access.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": null,
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "1.3.7",
      "title": "Ensure 'third-party storage services' are restricted in 'Microsoft 365 on the web'",
      "description": "Restrict third-party storage providers in Office web apps.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "exchange.organization.owa_mailbox_policy",
      "policy_file": null,
      "requires_permissions": ["Exchange.Manage"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "1.3.8",
      "title": "Ensure that Sways cannot be shared with people outside of your organization",
      "description": "Restrict external sharing of Sway content.",
      "severity": "medium",
      "service": "Sway",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "No API available for Sway settings"
    },
    {
      "control_id": "1.3.9",
      "title": "Ensure shared bookings pages are restricted to select users",
      "description": "Restrict who can create and manage shared bookings pages.",
      "severity": "medium",
      "service": "Bookings",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Need Bookings API collector"
    },
    {
      "control_id": "2.1.1",
      "title": "Ensure Safe Links for Office Applications is Enabled",
      "description": "Enable Safe Links to protect users from malicious URLs.",
      "severity": "high",
      "service": "Defender",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.safe_links_policy",
      "policy_file": "2.1.1_SafeLinks_OfficeApplications_Enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.2",
      "title": "Ensure the Common Attachment Types Filter is enabled",
      "description": "Block common malicious attachment types.",
      "severity": "high",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.malware_filter_policy",
      "policy_file": "2.1.2_Common_AttachmentTypes_Filter_Enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.3",
      "title": "Ensure notifications for internal users sending malware is Enabled",
      "description": "Notify administrators when internal users send malware.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.malware_filter_policy",
      "policy_file": "2.1.3_Notifications_InternalUsers_sendingMalware_Enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.4",
      "title": "Ensure Safe Attachments policy is enabled",
      "description": "Enable Safe Attachments to scan attachments for malware.",
      "severity": "high",
      "service": "Defender",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.safe_attachment_policy",
      "policy_file": "2.1.4_Safe_AttachementsPolicy_Enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.5",
      "title": "Ensure Safe Attachments for SharePoint, OneDrive, and Microsoft Teams is Enabled",
      "description": "Enable ATP protection for files in SharePoint, OneDrive, and Teams.",
      "severity": "high",
      "service": "Defender",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.atp_policy_o365",
      "policy_file": "2.1.5_Safe_Attachments_SharePoint_OneDrive_MSTeams_Enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.6",
      "title": "Ensure Exchange Online Spam Policies are set to notify administrators",
      "description": "Configure spam policies to notify administrators.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.hosted_outbound_spam_filter",
      "policy_file": "2.1.6_Exchange_OnlineSpam_Policies_Notify_Administrators.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.7",
      "title": "Ensure that an anti-phishing policy has been created",
      "description": "Create and configure anti-phishing policies.",
      "severity": "high",
      "service": "Defender",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.anti_phish_policy",
      "policy_file": "2.1.7_AntiPhishing_Policy_is_created.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.8",
      "title": "Ensure that SPF records are published for all Exchange Domains",
      "description": "Publish SPF records to prevent email spoofing.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.dns.dns_security_records",
      "policy_file": "2.1.8_SPF_records_published.rego",
      "requires_permissions": ["Domain.Read.All"],
      "notes": "DNS lookup for SPF TXT records"
    },
    {
      "control_id": "2.1.9",
      "title": "Ensure that DKIM is enabled for all Exchange Online Domains",
      "description": "Enable DKIM signing for email authentication.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.authentication.dkim_signing_config",
      "policy_file": "2.1.9_DKIM_is_enabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.10",
      "title": "Ensure DMARC Records for all Exchange Online domains are published",
      "description": "Publish DMARC records for email authentication.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.dns.dns_security_records",
      "policy_file": "2.1.10_DMARC_records_published.rego",
      "requires_permissions": ["Domain.Read.All"],
      "notes": "DNS lookup for DMARC TXT records"
    },
    {
      "control_id": "2.1.11",
      "title": "Ensure comprehensive attachment filtering is applied",
      "description": "Configure comprehensive attachment type filtering.",
      "severity": "medium",
      "service": "Defender",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.malware_filter_policy",
      "policy_file": "2.1.11_Comprehensive_Attachment_Filtering_Applied.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.12",
      "title": "Ensure the connection filter IP allow list is not used",
      "description": "Do not whitelist IPs in connection filter.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.hosted_connection_filter",
      "policy_file": "2.1.12_ConnectionFilter_IPAllowList_not_used.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.13",
      "title": "Ensure the connection filter safe list is off",
      "description": "Disable connection filter safe list.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.hosted_connection_filter",
      "policy_file": "2.1.13_Connection_Filter_SafeList_Off.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.14",
      "title": "Ensure inbound anti-spam policies do not contain allowed domains",
      "description": "Do not whitelist domains in anti-spam policies.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.hosted_content_filter",
      "policy_file": "2.1.14_Inbound_AntiSpam_Policies_DoNot_AllowedDomains.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.1.15",
      "title": "Ensure outbound anti-spam message limits are in place",
      "description": "Configure outbound spam message limits.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.hosted_outbound_spam_filter",
      "policy_file": "2.1.15_Outbound_AntiSpam_MessageLimits_InPlace.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "2.2.1",
      "title": "Ensure emergency access account activity is monitored",
      "description": "Monitor emergency access account sign-ins and usage.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Organizational policy; requires defining which accounts to monitor"
    },
    {
      "control_id": "2.4.1",
      "title": "Ensure Priority account protection is enabled and configured",
      "description": "Enable and configure priority account protection.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Need Priority Account Protection collector"
    },
    {
      "control_id": "2.4.2",
      "title": "Ensure Priority accounts have 'Strict protection' presets applied",
      "description": "Apply strict protection presets to priority accounts.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Need Priority Account Protection collector"
    },
    {
      "control_id": "2.4.3",
      "title": "Ensure Microsoft Defender for Cloud Apps is enabled and configured",
      "description": "Enable and configure Microsoft Defender for Cloud Apps.",
      "severity": "medium",
      "service": "Defender",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "MCAS configuration requires portal verification"
    },
    {
      "control_id": "2.4.4",
      "title": "Ensure Zero-hour auto purge for Microsoft Teams is on",
      "description": "Enable ZAP for Teams to remove malicious content.",
      "severity": "medium",
      "service": "Defender",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.protection.teams_protection_policy",
      "policy_file": "2.4.4_Zero_hour_AutoPurge_MSTeams_is_On.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "3.1.1",
      "title": "Ensure Microsoft 365 audit log search is Enabled",
      "description": "Enable unified audit log search.",
      "severity": "high",
      "service": "Compliance",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": null,
      "requires_permissions": ["Exchange.Manage"],
      "notes": "Check AuditDisabled = False"
    },
    {
      "control_id": "3.2.1",
      "title": "Ensure DLP policies are enabled",
      "description": "Enable Data Loss Prevention policies.",
      "severity": "high",
      "service": "Compliance",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "IPPSSession requires certificate auth"
    },
    {
      "control_id": "3.2.2",
      "title": "Ensure DLP policies are enabled for Microsoft Teams",
      "description": "Enable DLP policies for Teams.",
      "severity": "high",
      "service": "Compliance",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "IPPSSession requires certificate auth"
    },
    {
      "control_id": "3.3.1",
      "title": "Ensure Information Protection sensitivity label policies are published",
      "description": "Publish sensitivity label policies.",
      "severity": "high",
      "service": "Compliance",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "IPPSSession requires certificate auth"
    },
    {
      "control_id": "4.1",
      "title": "Ensure devices without a compliance policy are marked 'not compliant'",
      "description": "Mark devices without compliance policy as non-compliant.",
      "severity": "medium",
      "service": "Intune",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.device_management_settings",
      "policy_file": "4.1_mark_unmanaged_devices_not_compliant.rego",
      "requires_permissions": ["DeviceManagementConfiguration.Read.All"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "4.2",
      "title": "Ensure device enrollment for personally owned devices is blocked by default",
      "description": "Block personal device enrollment by default.",
      "severity": "medium",
      "service": "Intune",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.enrollment_restrictions",
      "policy_file": "4.2_block_personal_device_enrollment.rego",
      "requires_permissions": ["DeviceManagementConfiguration.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.1.2.1",
      "title": "Ensure 'Per-user MFA' is disabled",
      "description": "Disable per-user MFA in favor of Conditional Access.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Automated",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Only available in beta API; not stable"
    },
    {
      "control_id": "5.1.2.2",
      "title": "Ensure third party integrated applications are not allowed",
      "description": "Block third-party application registration.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.2.2_block_third_party_integrated_apps.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check allowedToCreateApps"
    },
    {
      "control_id": "5.1.2.3",
      "title": "Ensure 'Restrict non-admin users from creating tenants' is set to 'Yes'",
      "description": "Prevent non-admin users from creating tenants.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.2.3_restrict_tenant_creation.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check allowedToCreateTenants"
    },
    {
      "control_id": "5.1.2.4",
      "title": "Ensure access to the Entra admin center is restricted",
      "description": "Restrict access to Entra admin center.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Only available via internal Azure API"
    },
    {
      "control_id": "5.1.2.5",
      "title": "Ensure the option to remain signed in is hidden",
      "description": "Hide the 'Stay signed in' option.",
      "severity": "low",
      "service": "EntraID",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Setting not exposed via Graph API"
    },
    {
      "control_id": "5.1.2.6",
      "title": "Ensure 'LinkedIn account connections' is disabled",
      "description": "Disable LinkedIn account connections.",
      "severity": "low",
      "service": "EntraID",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Only available via internal Azure API"
    },
    {
      "control_id": "5.1.3.1",
      "title": "Ensure a dynamic group for guest users is created",
      "description": "Create a dynamic group to manage guest users.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.groups.groups",
      "policy_file": "5.1.3.1_dynamic_guest_group_exists.rego",
      "requires_permissions": ["Group.Read.All"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "5.1.3.2",
      "title": "Ensure users cannot create security groups",
      "description": "Prevent users from creating security groups.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.3.2_block_security_group_creation.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check allowedToCreateSecurityGroups"
    },
    {
      "control_id": "5.1.4.1",
      "title": "Ensure the ability to join devices to Entra is restricted",
      "description": "Restrict device join to authorized users.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.device_registration_policy",
      "policy_file": "5.1.4.1_restrict_device_join.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.1.4.2",
      "title": "Ensure the maximum number of devices per user is limited",
      "description": "Limit devices a user can register.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.device_registration_policy",
      "policy_file": "5.1.4.2_limit_device_registration_quota.rego",
      "requires_permissions": ["Policy.Read.DeviceConfiguration"],
      "notes": "CIS v6.0.0 requires userDeviceQuota to be set to 20 or less. A value of 0 is treated as unlimited and is non-compliant."
    },
    {
      "control_id": "5.1.4.3",
      "title": "Ensure the GA role is not added as a local administrator during Entra join",
      "description": "Do not add Global Admin as local admin on joined devices.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.device_registration_policy",
      "policy_file": "5.1.4.3_ga_not_local_admin_on_join.rego",
      "requires_permissions": ["Policy.Read.DeviceConfiguration"],
      "notes": "Uses azureADJoin.localAdministratorsConfiguration.enableGlobalAdmins from /policies/deviceRegistrationPolicy (beta). Field may be absent on older tenants; policy returns non-compliant with an explanatory message in that case."
    },
    {
      "control_id": "5.1.4.4",
      "title": "Ensure local administrator assignment is limited during Entra join",
      "description": "Limit local administrator assignment on joined devices.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.devices.device_registration_policy",
      "policy_file": "5.1.4.4_limit_local_admin_on_join.rego",
      "requires_permissions": ["Policy.Read.DeviceConfiguration"],
      "notes": "Uses azureADJoin.localAdministratorsConfiguration.registeringUsers from /policies/deviceRegistrationPolicy (beta). Compliant when value is notAllowed."
    },
    {
      "control_id": "5.1.4.5",
      "title": "Ensure Local Administrator Password Solution is enabled",
      "description": "Enable LAPS for local admin password management.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Need LAPS configuration collector"
    },
    {
      "control_id": "5.1.4.6",
      "title": "Ensure users are restricted from recovering BitLocker keys",
      "description": "Restrict BitLocker key recovery to admins.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.4.6_restrict_bitlocker_key_recovery.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check allowedToReadBitlockerKeysForOwnedDevice"
    },
    {
      "control_id": "5.1.5.1",
      "title": "Ensure user consent to apps accessing company data on their behalf is not allowed",
      "description": "Block user consent to apps.",
      "severity": "high",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.5.1_block_user_app_consent.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.1.5.2",
      "title": "Ensure the admin consent workflow is enabled",
      "description": "Enable admin consent workflow for apps.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.admin_consent_request_policy",
      "policy_file": "5.1.5.2_admin_consent_workflow_enabled.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.1.6.1",
      "title": "Ensure that collaboration invitations are sent to allowed domains only",
      "description": "Restrict B2B invitations to allowed domains.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.b2b_policy",
      "policy_file": "5.1.6.1_restrict_collaboration_invite_domains.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.1.6.2",
      "title": "Ensure that guest user access is restricted",
      "description": "Restrict guest user access permissions.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.6.2_restrict_guest_user_access.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check guestUserRoleId"
    },
    {
      "control_id": "5.1.6.3",
      "title": "Ensure guest user invitations are limited to the Guest Inviter role",
      "description": "Limit who can invite guest users.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.policies.authorization_policy",
      "policy_file": "5.1.6.3_limit_guest_invitations.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check allowInvitesFrom"
    },
    {
      "control_id": "5.1.8.1",
      "title": "Ensure that password hash sync is enabled for hybrid deployments",
      "description": "Enable password hash sync for hybrid identity.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Requires on-premises AD Connect verification"
    },
    {
      "control_id": "5.2.2.1",
      "title": "Ensure multifactor authentication is enabled for all users in administrative roles",
      "description": "Require MFA for all administrative roles.",
      "severity": "critical",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires verification of all 15 admin roles"
    },
    {
      "control_id": "5.2.2.2",
      "title": "Ensure multifactor authentication is enabled for all users",
      "description": "Require MFA for all users.",
      "severity": "critical",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires verification of exclusions"
    },
    {
      "control_id": "5.2.2.3",
      "title": "Enable Conditional Access policies to block legacy authentication",
      "description": "Block legacy authentication protocols.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.conditional_access.legacy_auth_block",
      "policy_file": "5.2.2.3_block_legacy_auth.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.2.4",
      "title": "Ensure Sign-in frequency is enabled and browser sessions are not persistent for Administrative users",
      "description": "Configure sign-in frequency for administrators.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires admin role verification"
    },
    {
      "control_id": "5.2.2.5",
      "title": "Ensure 'Phishing-resistant MFA strength' is required for Administrators",
      "description": "Require phishing-resistant MFA for administrators.",
      "severity": "high",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires admin role verification"
    },
    {
      "control_id": "5.2.2.6",
      "title": "Enable Identity Protection user risk policies",
      "description": "Enable user risk policies in Identity Protection.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.7",
      "title": "Enable Identity Protection sign-in risk policies",
      "description": "Enable sign-in risk policies in Identity Protection.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.8",
      "title": "Ensure 'sign-in risk' is blocked for medium and high risk",
      "description": "Block sign-ins with medium or high risk.",
      "severity": "high",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.9",
      "title": "Ensure a managed device is required for authentication",
      "description": "Require managed devices for authentication.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.10",
      "title": "Ensure a managed device is required to register security information",
      "description": "Require managed device for security info registration.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.11",
      "title": "Ensure sign-in frequency for Intune Enrollment is set to 'Every time'",
      "description": "Require authentication for every Intune enrollment.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.2.12",
      "title": "Ensure the device code sign-in flow is blocked",
      "description": "Block device code authentication flow.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "deferred",
      "data_collector_id": "entra.conditional_access.policies",
      "policy_file": null,
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Requires policy coverage verification"
    },
    {
      "control_id": "5.2.3.1",
      "title": "Ensure Microsoft Authenticator is configured to protect against MFA fatigue",
      "description": "Configure Authenticator to prevent MFA fatigue attacks.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.mfa_fatigue_protection",
      "policy_file": "5.2.3.1_mfa_fatigue_protection.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.3.2",
      "title": "Ensure custom banned passwords lists are used",
      "description": "Configure custom banned password list.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.password_protection",
      "policy_file": "5.2.3.2_custom_banned_passwords_enabled.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.3.3",
      "title": "Ensure password protection is enabled for on-prem Active Directory",
      "description": "Enable password protection for on-premises AD.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.password_protection",
      "policy_file": "5.2.3.3_enable_on_prem_password_protection.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.3.4",
      "title": "Ensure all member users are 'MFA capable'",
      "description": "Ensure all users have registered MFA methods.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.mfa_registration_report",
      "policy_file": "5.2.3.4_all_members_mfa_capable.rego",
      "requires_permissions": ["AuditLog.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.3.5",
      "title": "Ensure weak authentication methods are disabled",
      "description": "Disable SMS and voice authentication methods.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.authentication_methods",
      "policy_file": "5.2.3.5_disable_weak_auth_methods.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": "Check SMS/Voice disabled"
    },
    {
      "control_id": "5.2.3.6",
      "title": "Ensure system-preferred multifactor authentication is enabled",
      "description": "Enable system-preferred MFA.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.authentication_methods",
      "policy_file": "5.2.3.6_enable_system_preferred_mfa.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.3.7",
      "title": "Ensure the email OTP authentication method is disabled",
      "description": "Disable email OTP authentication.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.authentication.authentication_methods",
      "policy_file": "5.2.3.7_disable_email_otp.rego",
      "requires_permissions": ["Policy.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.2.4.1",
      "title": "Ensure 'Self service password reset enabled' is set to 'All'",
      "description": "Enable SSPR for all users.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "SSPR settings not exposed via Graph API"
    },
    {
      "control_id": "5.3.1",
      "title": "Ensure 'Privileged Identity Management' is used to manage roles",
      "description": "Use PIM for privileged role management.",
      "severity": "high",
      "service": "EntraID",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.governance.pim_role_policies",
      "policy_file": "5.3.1_pim_enabled.rego",
      "requires_permissions": ["RoleManagement.Read.Directory"],
      "notes": null
    },
    {
      "control_id": "5.3.2",
      "title": "Ensure 'Access reviews' for Guest Users are configured",
      "description": "Configure access reviews for guest users.",
      "severity": "medium",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.governance.access_reviews",
      "policy_file": "5.3.2_guest_access_reviews_configured.rego",
      "requires_permissions": ["AccessReview.Read.All"],
      "notes": null
    },
    {
      "control_id": "5.3.3",
      "title": "Ensure 'Access reviews' for privileged roles are configured",
      "description": "Configure access reviews for privileged roles.",
      "severity": "high",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.governance.access_reviews",
      "policy_file": "5.3.3_privileged_role_access_reviews_configured.rego",
      "requires_permissions": ["AccessReview.Read.All"],
      "notes": "Combined with pim_role_policies"
    },
    {
      "control_id": "5.3.4",
      "title": "Ensure approval is required for Global Administrator role activation",
      "description": "Require approval for Global Admin role activation.",
      "severity": "critical",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.governance.pim_role_policies",
      "policy_file": "5.3.4_ga_activation_requires_approval.rego",
      "requires_permissions": ["RoleManagement.Read.Directory"],
      "notes": null
    },
    {
      "control_id": "5.3.5",
      "title": "Ensure approval is required for Privileged Role Administrator activation",
      "description": "Require approval for Privileged Role Admin activation.",
      "severity": "critical",
      "service": "EntraID",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "entra.governance.pim_role_policies",
      "policy_file": "5.3.5_pra_activation_requires_approval.rego",
      "requires_permissions": ["RoleManagement.Read.Directory"],
      "notes": null
    },
    {
      "control_id": "6.1.1",
      "title": "Ensure 'AuditDisabled' organizationally is set to 'False'",
      "description": "Ensure organization-wide auditing is enabled.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": "6.1.1_audit_disabled.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.1.2",
      "title": "Ensure mailbox audit actions are configured",
      "description": "Configure comprehensive mailbox audit actions.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.mailbox.mailbox_audit_actions",
      "policy_file": "6.1.2_mailbox_audit_actions.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.1.3",
      "title": "Ensure 'AuditBypassEnabled' is not enabled on mailboxes",
      "description": "Ensure no mailboxes bypass auditing.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.mailbox.mailbox_audit",
      "policy_file": "6.1.3_audit_bypass.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.2.1",
      "title": "Ensure all forms of mail forwarding are blocked and/or disabled",
      "description": "Block all forms of mail forwarding.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.transport.transport_rules",
      "policy_file": "6.2.1_mail_forwarding_blocked.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.2.2",
      "title": "Ensure mail transport rules do not whitelist specific domains",
      "description": "Do not whitelist domains in transport rules.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.transport.transport_rules",
      "policy_file": "6.2.2_transport_whitelist.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.2.3",
      "title": "Ensure email from external senders is identified",
      "description": "Identify emails from external senders.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.transport.external_in_outlook",
      "policy_file": "6.2.3_external_sender_tagging.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.3.1",
      "title": "Ensure users installing Outlook add-ins is not allowed",
      "description": "Block user installation of Outlook add-ins.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.mailbox.role_assignment_policy",
      "policy_file": "6.3.1_outlook_addins.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.5.1",
      "title": "Ensure modern authentication for Exchange Online is enabled",
      "description": "Enable modern authentication for Exchange.",
      "severity": "high",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": "6.5.1_modern_auth.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": "Check OAuth2ClientProfileEnabled"
    },
    {
      "control_id": "6.5.2",
      "title": "Ensure MailTips are enabled for end users",
      "description": "Enable MailTips for users.",
      "severity": "low",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": "6.5.2_mailtips.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.5.3",
      "title": "Ensure additional storage providers are restricted in Outlook on the web",
      "description": "Restrict storage providers in OWA.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.owa_mailbox_policy",
      "policy_file": "6.5.3_storage_providers.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.5.4",
      "title": "Ensure SMTP AUTH is disabled",
      "description": "Disable SMTP AUTH for the organization.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.transport_config",
      "policy_file": "6.5.4_smtp_auth.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "6.5.5",
      "title": "Ensure Direct Send submissions are rejected",
      "description": "Reject Direct Send submissions.",
      "severity": "medium",
      "service": "Exchange",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "ready",
      "data_collector_id": "exchange.organization.organization_config",
      "policy_file": "6.5.5_direct_send.rego",
      "requires_permissions": ["Exchange.Manage"],
      "notes": null
    },
    {
      "control_id": "7.2.1",
      "title": "Ensure modern authentication for SharePoint applications is required",
      "description": "Require modern auth for SharePoint.",
      "severity": "high",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.2",
      "title": "Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled",
      "description": "Enable B2B integration for SharePoint.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.3",
      "title": "Ensure external content sharing is restricted",
      "description": "Restrict external sharing of content.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.4",
      "title": "Ensure OneDrive content sharing is restricted",
      "description": "Restrict OneDrive content sharing.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.5",
      "title": "Ensure that SharePoint guest users cannot share items they don't own",
      "description": "Restrict guest resharing permissions.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.6",
      "title": "Ensure SharePoint external sharing is restricted",
      "description": "Restrict SharePoint external sharing.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.7",
      "title": "Ensure link sharing is restricted in SharePoint and OneDrive",
      "description": "Restrict link sharing settings.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.8",
      "title": "Ensure external sharing is restricted by security group",
      "description": "Restrict external sharing to security group members.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError; CIS says Manual but can be automated"
    },
    {
      "control_id": "7.2.9",
      "title": "Ensure guest access to a site or OneDrive will expire automatically",
      "description": "Configure automatic guest access expiration.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.10",
      "title": "Ensure reauthentication with verification code is restricted",
      "description": "Restrict verification code reauthentication.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.2.11",
      "title": "Ensure the SharePoint default sharing link permission is set",
      "description": "Configure default sharing link permissions.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.3.1",
      "title": "Ensure Office 365 SharePoint infected files are disallowed for download",
      "description": "Block download of infected files.",
      "severity": "high",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_tenant",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector raises NotImplementedError"
    },
    {
      "control_id": "7.3.2",
      "title": "Ensure OneDrive sync is restricted for unmanaged devices",
      "description": "Restrict OneDrive sync to managed devices.",
      "severity": "medium",
      "service": "SharePoint",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "not_started",
      "data_collector_id": "sharepoint.spo_sync_client_restriction",
      "policy_file": null,
      "requires_permissions": ["SharePoint.Admin"],
      "notes": "Collector exists but control logic not defined"
    },
    {
      "control_id": "8.1.1",
      "title": "Ensure external file sharing in Teams is enabled for only approved cloud storage services",
      "description": "Restrict Teams file sharing to approved services.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.1.2",
      "title": "Ensure users can't send emails to a channel email address",
      "description": "Disable sending emails to channel addresses.",
      "severity": "low",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.2.1",
      "title": "Ensure external domains are restricted in the Teams admin center",
      "description": "Restrict external domain communication.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.2.2",
      "title": "Ensure communication with unmanaged Teams users is disabled",
      "description": "Block communication with unmanaged Teams.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.2.3",
      "title": "Ensure external Teams users cannot initiate conversations",
      "description": "Prevent external users from starting conversations.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.2.4",
      "title": "Ensure the organization cannot communicate with accounts in trial Teams tenants",
      "description": "Block communication with trial tenant accounts.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.4.1",
      "title": "Ensure app permission policies are configured",
      "description": "Configure Teams app permission policies.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "manual",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "CIS marks as Manual; also affected by ACM migration"
    },
    {
      "control_id": "8.5.1",
      "title": "Ensure anonymous users can't join a meeting",
      "description": "Block anonymous users from joining meetings.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.2",
      "title": "Ensure anonymous users and dial-in callers can't start a meeting",
      "description": "Prevent anonymous users from starting meetings.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.3",
      "title": "Ensure only people in my org can bypass the lobby",
      "description": "Restrict lobby bypass to organization members.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.4",
      "title": "Ensure users dialing in can't bypass the lobby",
      "description": "Dial-in users must wait in lobby.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.5",
      "title": "Ensure meeting chat does not allow anonymous users",
      "description": "Block anonymous users from meeting chat.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.6",
      "title": "Ensure only organizers and co-organizers can present",
      "description": "Restrict presenting to organizers.",
      "severity": "low",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.7",
      "title": "Ensure external participants can't give or request control",
      "description": "Block external control in meetings.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.8",
      "title": "Ensure external meeting chat is off",
      "description": "Disable external meeting chat.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.5.9",
      "title": "Ensure meeting recording is off by default",
      "description": "Disable default meeting recording.",
      "severity": "medium",
      "service": "Teams",
      "level": "L2",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "8.6.1",
      "title": "Ensure users can report security concerns in Teams",
      "description": "Enable security concern reporting in Teams.",
      "severity": "medium",
      "service": "Teams",
      "level": "L1",
      "is_manual": false,
      "benchmark_audit_type": "Automated",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Teams module AccessTokens auth not working"
    },
    {
      "control_id": "9.1.1",
      "title": "Ensure guest user access is restricted",
      "description": "Restrict guest access in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.2",
      "title": "Ensure external user invitations are restricted",
      "description": "Restrict external invitations in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.3",
      "title": "Ensure guest access to content is restricted",
      "description": "Restrict guest content access in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.4",
      "title": "Ensure 'Publish to web' is restricted",
      "description": "Restrict publish to web in Fabric.",
      "severity": "high",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.5",
      "title": "Ensure 'Interact with and share R and Python' visuals is 'Disabled'",
      "description": "Disable R and Python visual sharing.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L2",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.6",
      "title": "Ensure 'Allow users to apply sensitivity labels for content' is 'Enabled'",
      "description": "Enable sensitivity labels in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.7",
      "title": "Ensure shareable links are restricted",
      "description": "Restrict shareable links in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.8",
      "title": "Ensure enabling of external data sharing is restricted",
      "description": "Restrict external data sharing in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.9",
      "title": "Ensure 'Block ResourceKey Authentication' is 'Enabled'",
      "description": "Block ResourceKey authentication in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.10",
      "title": "Ensure access to APIs by service principals is restricted",
      "description": "Restrict service principal API access in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.11",
      "title": "Ensure service principals cannot create and use profiles",
      "description": "Restrict service principal profiles in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    },
    {
      "control_id": "9.1.12",
      "title": "Ensure service principals ability to create workspaces, connections and deployment pipelines is restricted",
      "description": "Restrict service principal workspace creation in Fabric.",
      "severity": "medium",
      "service": "Fabric",
      "level": "L1",
      "is_manual": true,
      "benchmark_audit_type": "Manual",
      "automation_status": "blocked",
      "data_collector_id": null,
      "policy_file": null,
      "requires_permissions": null,
      "notes": "Fabric API auth untested; CIS says Manual but can be automated"
    }
  ]
}