Jean-Philippe George

Also contributed to

• CIS.M365.1.3.7Ensure
• CIS.M365.2.1.9(L1) Ensure that DKIM is enabled for all Exchange Online Domains
• CIS.M365.2.4.4(L1) Ensure Zero-hour auto purge for Microsoft Teams is on (Only Checks ZAP is enabled)
• CISA.MS.AAD.7.4Permanent active role assignments SHALL NOT be allowed for highly privileged roles.
• CISA.MS.AAD.7.5Provisioning users to highly privileged roles SHALL NOT occur outside of a PAM system.
• CISA.MS.AAD.7.6Activation of the Global Administrator role SHALL require approval.
• CISA.MS.AAD.7.7Eligible and Active highly privileged role assignments SHALL trigger an alert.
• CISA.MS.AAD.7.8User activation of the Global Administrator role SHALL trigger an alert.
• CISA.MS.AAD.7.9User activation of other highly privileged roles SHOULD trigger an alert.
• CISA.MS.EXO.3.1DKIM SHOULD be enabled for all domains.
• CISA.MS.EXO.4.2The DMARC message rejection option SHALL be p=reject.
• CISA.MS.EXO.9.1Emails SHALL be filtered by attachment file types.
• CISA.MS.EXO.10.1Emails SHALL be scanned for malware.
• CISA.MS.EXO.10.2Emails identified as containing malware SHALL be quarantined or dropped.
• CISA.MS.EXO.10.3Email scanning SHALL be capable of reviewing emails after delivery.
• MT.1025No external user with permanent role assignment on Control Plane.
• MT.1026No hybrid user with permanent role assignment on Control Plane.
• MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.
• MT.1028No user with mailbox and permanent role assignment on Control Plane.
• MT.1074Mailboxes should not send outbound mails using the .onmicrosoft.com domain.
• MT.1106Catalog resources must have valid roles (no stale app roles or deleted SPNs)
• MT.1107Access packages and catalogs should not reference deleted groups
• MT.1108Access packages should not have inactive or orphaned assignment policies
• MT.1109Access package approval workflows must have valid approvers
• MT.1110No catalog should contain resources without any associated access packages