Microsoft 365 Monkey365

Execution

Information

Juan Garrido

Juan Garrido

silverhack@monkeytenant.onmicrosoft.com

Domain
monkeytenant.onmicrosoft.com
TenantId
384486fb-160a-4ea1-a95e-e0a6fd7c1517
Tenant Name
Monkey365
Role(s)
Global Administrator
Execution info

Ruleset details

Ruleset
CIS Microsoft 365 Foundations 1.5.0
Ruleset Description
This ruleset contains a collection of rules for Microsoft 365 based on CIS benchmark. These rules perform static analysis on Microsoft 365 artifacts within Exchange Online, SharePoint Online, Microsoft Teams or OneDrive, among others, and are used as a mechanism to evaluate the configuration of these Microsoft 365 workloads. Rules are also divided into categories and subcategories according to the rule's type. These rules are designed to determine whether controls within a standard are being adhered to. This will ensures that Microsoft 365 tenant will meet the industry standards.
Number of rules
49
Executed Rules
39
Scan Date
11/07/2023 20:51:55
Monkey Version
0.91.2-beta

Issues by service

Issues by severity

Dashboard Table

Resources

Services Resources Rules Findings
card_img

Microsoft Entra ID Identity

 		5 5 3
card_img

Identity Protection

 		1 8 2
card_img

Conditional Access

 		3 1 1
card_img

General

 		1 7 2
card_img

Exchange Online

 		1 15 7
card_img

SharePoint Online

 		1 6 5
card_img

Microsoft Forms

 		1 1 0
card_img

Microsoft Teams

 		1 2 2
card_img

Security and Compliance

 		7 3 2
card_img

Microsoft OneDrive

 		1 1 1
Monkey365 Dashboard
card_img

Monkey365 findings

card_img

azure ad identity

Description:

Enable multi-factor authentication for all user credentials who have write access to Azure resources. These include roles like:

  • Service Co-Administrators

  • Subscription Owners

  • Contributors

Rationale:

Multi-factor authentication requires an individual to present a minimum of two separate forms of authentication before access is granted. Multi-factor authentication provides additional assurance that the individual attempting to gain access is who they claim to be. With multi-factor authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.

Impact:

Users would require two forms of authentication before any action is granted. Also, this requires an overhead for managing dual forms of authentication.

Remediation:

Follow Microsoft Azure documentation and setup multi-factor authentication in your environment.

Secure user sign-in events with Microsoft Entra ID Multi-Factor Authentication

References:

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-identity-management#im-4-use-strong-authentication-controls-for-all-azure-active-directory-based-access
https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.1

  • Microsoft Entra ID Identity checked: 5
  • Microsoft Entra ID Identity flagged: 2
Details
Description:

The total number of Global Administrators was higher than recommended. A tenancy should have more than two but fewer than five Global Administrators. Having an excessive number of Global Administrators has an increased risk that one of those accounts will be successfully breached by an external attacker.

Rationale:

If there is only one global tenant administrator, he or she can perform malicious activity without the possibility of being discovered by another admin. If there are numerous global tenant administrators, the more likely it is that one of their accounts will be successfully breached by an external attacker.

Impact:

The potential impact associated with ensuring compliance with this requirement is dependent upon the current number of global administrators configured in the tenant. If there is only one global administrator in a tenant, an additional global administrator will need to be identified and configured. If there are more than four global administrators, a review of role requirements for current global administrators will be required to identify which of the users require global administrator access.

References:

https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-admin-roles-secure
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.3

  • Microsoft Entra ID Identity checked: 5
  • Microsoft Entra ID Identity flagged: 1
Details
Description:

Microsoft Entra ID Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Organizations should remove permanent members from privileged Office 365 roles and instead make them eligible, through a JIT activation workflow.

Rationale:

Organizations want to minimize the number of people who have access to secure information or resources, because that reduces the chance of a malicious actor getting that access, or an authorized user inadvertently impacting a sensitive resource. However, users still need to carry out privileged operations in Microsoft Entra ID and Office 365. Organizations can give users just-in-time (JIT) privileged access to roles. There is a need for oversight for what those users are doing with their administrator privileges. PIM helps to mitigate the risk of excessive, unnecessary, or misused access rights.

Impact:

Implementation of Just in Time privileged access is likely to necessitate changes to administrator routine. Administrators will only be granted access to administrative roles when required. When administrators request role activation, they will need to document the reason for requiring role access, anticipated time required to have the access, and to reauthenticate to enable role access.

Remediation:

To configure sensitive Microsoft Entra ID roles for Privileged Identity Management Role activation, use the following steps:

From Azure Entra portal

  1. Sign in to the Azure Entra portal as a global administrator.

  2. In the Azure Entra portal, click Identity and Governance and search for and click on Privileged Identity Management.

  3. Under Manage click on Microsoft Entra ID Roles.

  4. Under Manage click on Roles.

  5. Inspect the following sensitive roles. For each of the members that have an ASSIGNMENT TYPE of Permanent, click on the ... and choose Make eligible:

  • Application Administrator

  • Authentication Administrator

  • Billing Administrator

  • Cloud Application Administrator

  • Cloud Device Administrator

  • Compliance Administrator

  • Customer LockBox Access Approver

  • Device Administrators

  • Exchange Administrators

  • Global Administrators

  • HelpDesk Administrator

  • Information Protection Administrator

  • Intune Service Administrator

  • Kaizala Administrator

  • License Administrator

  • Password Administrator

  • PowerBI Service Administrator

  • Privileged Authentication Administrator

  • Privileged Role Administrator

  • Security Administrator

  • SharePoint Service Administrator

  • Skype for Business Administrator

  • Teams Service Administrator

  • User Administrator

References:

https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-activate-role

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.10

  • Microsoft Entra ID Identity checked: 19
  • Microsoft Entra ID Identity flagged: 14
Details
Ensure that multi-factor authentication is enabled for all privileged users
UPN Object Type User Type Role isBuiltIn MFA enabled
LidiaH@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
NestorW@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
AllanD@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
admin@monkeytenant.onmicrosoft.com User Member Global Administrator Enabled Disabled
MeganB@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
provisioninguser0@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
silverhack@monkeytenant.onmicrosoft.com User Member Global Administrator Enabled Disabled
dromero@monkeytenant.onmicrosoft.com User Member Global Administrator Enabled Disabled
provisioninguser4@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
provisioninguser2@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
IsaiahL@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
provisioninguser3@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
provisioninguser1@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
ms-serviceaccount@monkeytenant.OnMicrosoft.com User Member Global Administrator Enabled Disabled
julia@monkeytenant.onmicrosoft.com User Member Global Reader Enabled Disabled
NotSet NotSet NotSet Global Reader Enabled NotSet
Excessive number of Global Administrators
User Principal Name Object Type User Type MFA enabled actions
LidiaH@monkeytenant.OnMicrosoft.com User Member Disabled
NestorW@monkeytenant.OnMicrosoft.com User Member Disabled
AllanD@monkeytenant.OnMicrosoft.com User Member Disabled
admin@monkeytenant.onmicrosoft.com User Member Disabled
MeganB@monkeytenant.OnMicrosoft.com User Member Disabled
provisioninguser0@monkeytenant.OnMicrosoft.com User Member Disabled
silverhack@monkeytenant.onmicrosoft.com User Member Disabled
dromero@monkeytenant.onmicrosoft.com User Member Disabled
provisioninguser4@monkeytenant.OnMicrosoft.com User Member Disabled
provisioninguser2@monkeytenant.OnMicrosoft.com User Member Disabled
IsaiahL@monkeytenant.OnMicrosoft.com User Member Disabled
provisioninguser3@monkeytenant.OnMicrosoft.com User Member Disabled
provisioninguser1@monkeytenant.OnMicrosoft.com User Member Disabled
ms-serviceaccount@monkeytenant.OnMicrosoft.com User Member Disabled
Use Just In Time privileged access to High Privileged roles
Principal Name Display Name Object Type Role Name State actions
NestorW@monkeytenant.OnMicrosoft.com Nestor Wilke User Global Administrator Active
dromero@monkeytenant.onmicrosoft.com Daniel Romero User Global Administrator Active
MeganB@monkeytenant.OnMicrosoft.com Megan Bowen User Global Administrator Active
LidiaH@monkeytenant.OnMicrosoft.com Lidia Holloway User Global Administrator Active
provisioninguser4@monkeytenant.OnMicrosoft.com Johanna Lorenz User Global Administrator Active
provisioninguser3@monkeytenant.OnMicrosoft.com Christie Cline User Global Administrator Active
AllanD@monkeytenant.OnMicrosoft.com Allan Deyoung User Global Administrator Active
admin@monkeytenant.onmicrosoft.com MOD Administrator User Global Administrator Active
silverhack@monkeytenant.onmicrosoft.com Juan Garrido User Global Administrator Active
provisioninguser1@monkeytenant.OnMicrosoft.com Pradeep Gupta User Global Administrator Active
ms-serviceaccount@monkeytenant.OnMicrosoft.com Microsoft Service Account User Global Administrator Active
IsaiahL@monkeytenant.OnMicrosoft.com Isaiah Langer User Global Administrator Active
provisioninguser2@monkeytenant.OnMicrosoft.com Alex Wilber User Global Administrator Active
provisioninguser0@monkeytenant.OnMicrosoft.com Lynne Robbins User Global Administrator Active
card_img

identity protection

Description:

Enabling self-service password reset allows users to reset their own passwords in Microsoft Entra ID. When your users sign in to Microsoft 365, they will be prompted to enter additional contact information that will help them reset their password in the future. If combined registration is enabled additional information, outside of multi-factor, will not be needed. As of August 2020 combined registration is enabled by default.

Rationale:

Users will no longer need to engage the helpdesk for password resets, and the password reset mechanism will automatically block common, easily guessable passwords.

Impact:

The impact associated with this setting is that users will be required to provide additional contact information to enroll in self-service password reset. Additionally, minor user education may be required for users that are used to calling a help desk for assistance with password resets. As of August of 2020 combined registration is automatic for new tenants therefor users will not need to register for password reset separately from multi-factor authentication.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.4

  • Identity Protection checked: 1
  • Identity Protection flagged: 0
Description:

Microsoft Entra ID Identity Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.

Rationale:

Turning on the sign-in risk policy ensures that suspicious sign-ins are challenged for multi-factor authentication.

Impact:

When the policy triggers, the user will need MFA to access the account. In the case of a user who hasn't registered MFA on their account, they would be blocked from accessing their account. It is therefore recommended that the MFA registration policy be configured for all users who are a part of the Sign-in Risk policy.

Remediation:
From Microsoft Entra ID Portal

  1. Log in to https://aad.portal.azure.com as a Global Administrator.

  2. Select Security.

  3. Select Identity Protection.

  4. Select Sign-in risk policy.

  5. Set the following conditions within the policy.

  • Under Users or workload identities choose All users

  • Under Sign-in risk set the appropriate level.

  • Under Access select Allow access then in the right pane select Require multi-factor authentication.

  1. Click Done

  2. In Enforce Policy set On.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.8

  • Identity Protection checked: 9
  • Identity Protection flagged: 1
Details
Description:

Microsoft Entra ID Identity Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.

Rationale:

Turning on the sign-in risk policy ensures that suspicious sign-ins are challenged for multi-factor authentication.

Impact:

When the policy triggers, the user will need MFA to access the account. In the case of a user who hasn't registered MFA on their account, they would be blocked from accessing their account. It is therefore recommended that the MFA registration policy be configured for all users who are a part of the Sign-in Risk policy.

Remediation:
From Microsoft Entra ID Portal

  1. Log in to https://aad.portal.azure.com as a Global Administrator.

  2. Select Security.

  3. Select Identity Protection.

  4. Select Sign-in risk policy.

  5. Set the following conditions within the policy.

  • Under Users or workload identities choose All users

  • Under Sign-in risk set the appropriate level.

  • Under Access select Allow access then in the right pane select Require multi-factor authentication.

  1. Click Done

  2. In Enforce Policy set On.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.8

  • Identity Protection checked: 9
  • Identity Protection flagged: 0
Description:

Microsoft Entra ID Identity Protection user risk policies detect the probability that a user account has been compromised.

Rationale:

With the user risk policy turned on, Microsoft Entra ID detects the probability that a user account has been compromised. As an administrator, you can configure a user risk conditional access policy to automatically respond to a specific user risk level. For example, you can block access to your resources or require a password change to get a user account back into a clean state.

Impact:

When the policy triggers, access to the account will either be blocked or the user would be required to use multi-factor authentication and change their password. Users who haven't registered MFA on their account will be blocked from accessing it. If account access is blocked, an admin would need to recover the account. It is therefore recommended that the MFA registration policy be configured for all users who are a part of the User Risk policy.

Remediation:
From Microsoft Entra ID Portal

  1. Log in to https://aad.portal.azure.com as a Global Administrator.

  2. Select Security.

  3. Select Identity Protection.

  4. Select User risk policy.

  5. Set the following conditions within the policy.

  • Under Users or workload identities choose All users

  • Under User risk set the appropriate level.

  • Under Access select Allow access then in the right pane select Require password change.

  1. Click Done

  2. In Enforce Policy set On.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.9

  • Identity Protection checked: 9
  • Identity Protection flagged: 0
Description:

The option for the user to Stay signed in or the Keep me signed in option will prompt a user after a successful login, when the user selects this option a persistent refresh token is created. Typically this lasts for 90 days and does not prompt for sign-in or Multi-Factor.

Rationale:

Allowing users to select this option presents risk, especially in the even that the user signs into their account on a publicly accessible computer/web browser. In this case anyone with access to the profile said users utilized would have access to their account when directing the web browser to office.com.

Impact:

Once you have changed this setting users will no longer be prompted upon sign-in with the message Stay signed in?. This may mean users will be forced to sign in more frequently. Important: some features of SharePoint Online and Office 2010 have a dependency on users remaining signed in. If you hide this option, users may get additional and unexpected sign in prompts.

Remediation:
From Azure Portal

  1. Go to Microsoft Entra ID

  2. Scroll down and select Company branding under Manage followed by the appropriate policy.

  • If no policy exists you will need to create one.

  1. Scroll to the bottom of the newly opened pane and ensure Show option to remain signed in is set to No.

  2. Click Save.

References:

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/customize-branding

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.16

  • Identity Protection checked: 39
  • Identity Protection flagged: 1
Details
Description:

Review the password expiration policy, to ensure that user passwords in Office 365 are not set to expire.

Rationale:

NIST has updated their password policy recommendations to not arbitrarily require users to change their passwords after a specific amount of time, unless there is evidence that the password is compromised or the user forgot it. They suggest this even for single factor (Password Only) use cases, with a reasoning that forcing arbitrary password changes on users actually make the passwords less secure. Other recommendations within this Benchmark suggest the use of MFA authentication for at least critical accounts (at minimum), which makes password expiration even less useful as well as password protection for Microsoft Entra ID.

Impact:

The primary impact associated with this change is ensuring that users understand the process for making or requesting a password change when required.

Remediation:
To set Office 365 Passwords to Expire, use the Microsoft 365 Admin Center

  1. Expand Settings then select the Org Settings subcategory.

  2. Click on Security & privacy.

  3. Select Password expiration policy.

  4. If the Set user passwords to expire after a number of days box is checked, uncheck it.

  5. Click Save.

References:

https://docs.microsoft.com/en-us/microsoft-365/admin/misc/password-policy-recommendations?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.4

  • Identity Protection checked: 1
  • Identity Protection flagged: 0
Ensure Microsoft Entra ID Identity Protection sign-in risk policy is configured for all users
odata.type objectType objectId deletionTimestamp displayName keyCredentials policyType policyDetail policyIdentifier tenantDefaultPolicy
Microsoft.DirectoryServices.Policy Policy 59347dc8-cf1a-4e6a-89bb-ab249a97b17c NotSet Sign-In Risk Policy 1 @{AuthenticationPolicies=} NotSet 1
Ensure the option to stay signed in is disabled
PolicyName Status
Hide Keep Me Signed-In option Disabled
card_img

conditional access

Description:

Use Conditional Access to block legacy authentication protocols in Office 365.

Rationale:

Legacy authentication protocols do not support multi-factor authentication. These protocols are often used by attackers because of this deficiency. Blocking legacy authentication makes it harder for attackers to gain access.

Impact:

Enablig this setting will prevent users from connecting with older versions of Office, ActiveSync or using protocols like IMAP, POP or SMTP and may require upgrades to older versions of Office, and use of mobile mail clients that support modern authentication.

There is also an increased cost, as Conditional Access policies require Microsoft Entra ID Premium. Similarly, MFA may require additional overhead to maintain. There is also a potential scenario in which the multi-factor authentication method can be lost, and administrative users are no longer able to log in. For this scenario, there should be an emergency access account. Please see References for creating this.

Remediation:
From Azure Console

  1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID

  2. Scroll down in the menu on the left, and select Security

  3. Select on the left side Conditional Access

  4. Click the + New policy

References:

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa
https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/troubleshoot-conditional-access-what-if
https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access
https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.6

  • Conditional Access checked: 3
  • Conditional Access flagged: 3
Details
Ensure that a Conditional Access Policy exists to block legacy authentication
Name Status Exchange ActiveSync Apply Condition Exchange V2 ActiveSync Mobile Desktop Other Clients V2 Apply Condition actions
Exchange Online Requires Compliant Device Disabled Disabled Disabled Disabled Disabled Disabled Disabled
Office 365 App Control Disabled Disabled Disabled Disabled Disabled Disabled Disabled
MFA All Disabled Disabled Disabled Disabled Disabled Disabled Disabled
card_img

general

Description:

Security defaults in Microsoft Entra ID (Microsoft Entra ID) make it easier to be secure and help protect your organization. Security defaults contain preconfigured security settings for common attacks.

Microsoft is making security defaults available to everyone. The goal is to ensure that all organizations have a basic level of security-enabled at no extra cost. The use of security defaults however will prohibit custom settings which are being set with more advanced settings.

Rationale:

Security defaults provide secure default settings that we manage on behalf of organizations to keep customers safe until they are ready to manage their own identity security settings.

For example doing the following:

  • Requiring all users and admins to register for MFA.

  • Challenging users with MFA - mostly when they show up on a new device or app, but more often for critical roles and tasks.

  • Disabling authentication from legacy authentication clients, which can’t do MFA.

Impact:

The potential impact associated with disabling of Security Defaults is dependent upon the security controls implemented in the environment. It is likely that most organizations disabling Security Defaults plan to implement equivalent controls to replace Security Defaults.

It may be necessary to check settings in other Microsoft products, such as Azure, to ensure settings and functionality are as expected when disabling security defaults for MS365.

Remediation:
From Azure Console

  1. Sign in to the Azure portal as a security administrator, Conditional Access administrator, or global administrator.

  2. Browse to Microsoft Entra ID > Properties.

  3. Select Manage security defaults.

  4. Set the Enable security defaults toggle to No.

  5. Select Save.

References:

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions
http://www.rebeladmin.com/2019/04/step-step-guide-restrict-azure-ad-administration-portal/
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults
https://techcommunity.microsoft.com/t5/azure-active-directory-identity/introducing-security-defaults/ba-p/1061414

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.11

  • General checked: 1
  • General flagged: 0
Description:

Consider to disable integration with LinkedIn as a measure to help prevent phishing scams.

References:

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-assigning-users-and-groups
https://ezcloudinfo.com/2019/01/22/configure-access-panel-in-azure-active-directory/

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.1.14

  • General checked: 1
  • General flagged: 1
Details
Description:

Consider to disable in the Azure directory from registering applications and from signing in to applications without an administrator approval. Once this feature is disabled, an administrator will be required to consent to any new application a user needs to use.

Rationale:

It is recommended to let administrator register custom-developed applications. This ensures that the application undergoes a security review before exposing active directory data to it.

Impact:

This might create additional requests that administrators need to fulfill quite often.

Remediation:
From Azure Console

  1. Go to Microsoft Entra ID

  2. Go to Users

  3. Go to User settings

  4. Set Users can register applications to No

References:

https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/methods-for-assigning-users-and-groups
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added
https://ezcloudinfo.com/2019/01/22/configure-access-panel-in-azure-active-directory/
https://blogs.msdn.microsoft.com/exchangedev/2014/06/05/managing-user-consent-for-applications-using-office-365-apis/
https://nicksnettravels.builttoroam.com/post/2017/01/24/Admin-Consent-for-Permissions-in-Azure-Active-Directory.aspx
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added#who-has-permission-to-add-applications-to-my-azure-ad-instance
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-governance-strategy#gs-1-define-asset-management-and-data-protection-strategy
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-1-protect-and-limit-highly-privileged-users
https://docs.microsoft.com/en-us/azure/security/benchmarks/security-controls-v2-privileged-access#pa-2-restrict-administrative-access-to-business-critical-systems

Compliance:

CIS Microsoft 365 Foundations 1.5.0 2.7

  • General checked: 1
  • General flagged: 1
Details
Ensure that LinkedIn contact synchronization is disabled
Display Name: Monkey365
User can register apps: Enabled
Linkedin Sync enabled: 0
Require administrators to register third-party applications
Object Id: 384486fb-160a-4ea1-a95e-e0a6fd7c1517
Display Name: Monkey365
Users can register apps: Enabled
card_img

exchange online

Description:

Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third party SAML identity providers. When you enable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use modern authentication to log in to Microsoft 365 mailboxes. When you disable modern authentication in Exchange Online, Outlook 2016 and Outlook 2013 use basic authentication to log in to Microsoft 365 mailboxes.When users initially configure certain email clients, like Outlook 2013 and Outlook 2016, they may be required to authenticate using enhanced authentication mechanisms, such as multifactor authentication. Other Outlook clients that are available in Microsoft 365 (for example, Outlook Mobile and Outlook for Mac 2016) always use modern authentication to log in to Microsoft 365 mailboxes.

Rationale:

Strong authentication controls, such as the use of multifactor authentication, may be circumvented if basic authentication is used by Exchange Online email clients such as Outlook 2016 and Outlook 2013. Enabling modern authentication for Exchange Online ensures strong authentication mechanisms are used when establishing sessions between email clients and Exchange Online.

Impact:

Users of older email clients, such as Outlook 2013 and Outlook 2016, will no longer be able to authenticate to Exchange using Basic Authentication, which will necessitate migration to modern authentication practices.

Remediation:
To disable basic authentication, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Set-OrganizationConfig -OAuth2ClientProfileEnabled $True
References:

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/enable-or-disable-modern-authentication-in-exchange-online

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.2

  • Exchange Online checked: 1
  • Exchange Online flagged: 0
Description:

Consider to enable the Customer Lockbox feature. It requires Microsoft to get your approval for any datacenter operation that grants a Microsoft support engineer or other employee direct access to any of your data. For example, in some cases a Microsoft support engineer might need access to your Microsoft 365 content in order to help troubleshoot and fix an issue for you. Customer lockbox requests also have an expiration time, and content access is removed after the support engineer has fixed the issue.

Rationale:

Enabling this feature protects your data against data spillage and exfiltration.

Impact:

The impact associated with this setting is a requirement to grant Microsoft access to the tenant environment prior to a Microsoft engineer accessing the environment for support or troubleshooting.

Remediation:
To enable the Customer Lockbox feature, use the Microsoft 365 Admin Portal

  1. Browse to the Microsoft 365 admin center.

  2. Expand Settings and then select Org Settings.

  3. Choose Security & privacy in the right pane.

  4. Click Customer Lockbox.

  5. Check the the box Require approval for all data access requests.

  6. Click Save changes.

To set the Customer Lockbox feature to enabled, use the Microsoft Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Set-OrganizationConfig -CustomerLockBoxEnabled $true
References:

https://docs.microsoft.com/en-us/microsoft-365/compliance/customer-lockbox-requests?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.1

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Description:

The Common Attachment Types Filter lets a user block known and custom malicious file types from being attached to emails.

Rationale:

Blocking known malicious file types can help prevent malware-infested files from infecting a host.

Impact:

Blocking common malicious file types should not cause an impact in modern computing environments.

Remediation:
To enable the Common Attachment Types Filter, use the Microsoft 365 Admin Portal

  1. Click Security to open the Security portal.

  2. Navigate to Threat management, then Policy, and select Anti-malware.

  3. Edit the Default profile, then click Edit protection settings at the bottom of the window.

  4. Select Enable the common attachments filter.

  5. Click Save.

To enable the Common Attachment Types Filter, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Set-MalwareFilterPolicy -Identity Default -EnableFileFilter $true
References:

https://docs.microsoft.com/en-us/powershell/module/exchange/antispam-antimalware/Get-MalwareFilterPolicy?view=exchange-ps
https://docs.microsoft.com/en-us/office365/SecurityCompliance/configure-anti-malware-policies#use-remote-powershell-to-configure-anti-malware-policies
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-malware-protection?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.1

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Description:

Organisations should set Exchange Online Spam Policies to copy emails and notify someone when a sender in your tenant has been blocked for sending spam emails.

Rationale:

A blocked account is a good indication that the account in question has been breached and an attacker is using it to send spam emails to other people.

Impact:

Notification of users that have been blocked should not cause an impact to the user.

Remediation:
To set the Exchange Online Spam Policies correctly, use the Microsoft 365 Admin Center

  1. Click Security to open the Security portal.

  2. Navigate to Threat management, then Policy, and select Anti-spam.

  3. Click Anti-spam outbound policy.

  4. Select Edit policy then expand Notification.

  5. Check Send a copy of outbound messages that exceed these limits to these users and groups, then select +Add people, and enter the desired email addresses.

  6. Check Notify specific people if senders are blocked, then select +Add people, and enter the desired email addresses.

  7. Click Save.

To set the Exchange Online Spam Policies correctly, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
$BccEmailAddress = @("<INSERT-EMAIL>")

$NotifyEmailAddress = @("<INSERT-EMAIL>")

Set-HostedOutboundSpamFilterPolicy -Identity Default -

BccSuspiciousOutboundAdditionalRecipients $BccEmailAddress -

BccSuspiciousOutboundMail $true -NotifyOutboundSpam $true -

NotifyOutboundSpamRecipients $NotifyEmailAddress
References:

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-the-outbound-spam-policy?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.2

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Description:

Consider to set Exchange Online mail transport rules to not forward email to domains outside of your organization.

Rationale:

Attackers often create these rules to exfiltrate data from your tenancy.

Impact:

Care should be taken before implementation to ensure there is no business need for case-by-case auto-forwarding. Disabling auto-forwarding to remote domains will affect all users and in an organization.

Remediation:
To alter the mail transport rules so they do not forward email to external domains, use the Microsoft 365 Admin Center

  1. Select Exchange.

  2. Select Mail Flow and Rules.

  3. For each rule that forwards email to external domains, select the rule and click the Delete icon.

To perform remediation you may also use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Remove-TransportRule {RuleName}
  1. To verify this worked you may re-run the audit command as follows:
                   
Get-TransportRule | Where-Object {$null -ne $_.RedirectMessageTo} | ft Name,RedirectMessageTo
References:

https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mail-flow-rules/mail-flow-rule-procedures?view=exchserver-2019

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.3

  • Exchange Online checked: 4
  • Exchange Online flagged: 0
Description:

Consider to disable automatic forwarding to prevent users from auto-forwarding mail through Outlook and Outlook on the Web.

Rationale:

In the event that an attacker gains control of an end-user account they could create rules to ex-filtrate data from your environment.

Impact:

Care should be taken before implementation to ensure there is no business need for case-by-case auto-forwarding. Disabling auto-forwarding to remote domains will affect all users and in an organization.

Remediation:
To perform remediation you may use the Exchange Online PowerShell Module:

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Set-RemoteDomain Default -AutoForwardEnabled $false
  1. To verify this worked you may re-run the audit command as follows:
                   
Get-RemoteDomain Default | fl AllowedOOFType, AutoForwardEnabled
References:

https://docs.microsoft.com/en-gb/azure/app-service/app-service-web-tutorial-connect-msi

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.3

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Description:

Consider to set Exchange Online mail transport rules so they do not whitelist any specific domains.

Rationale:

Whitelisting domains in transport rules bypasses regular malware and phishing scanning, which can enable an attacker to launch attacks against your users from a safe haven domain.

Impact:

Care should be taken before implementation to ensure there is no business need for case-by-case whitelisting. Removing all whitelisted domains could affect incoming mail flow to an organization although modern systems sending legitimate mail should have no issue with this.

Remediation:
To alter the mail transport rules so they do not whitelist any specific domains, use the Microsoft 365 Admin Center

  1. Select Exchange.

  2. Select Mail Flow and Rules.

  3. For each rule that whitelists specific domains, select the rule and click the Delete icon.

To remove mail transport rules you may also use the Exchange Online PowerShell

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Remove-TransportRule {RuleName}
  1. To verify this worked you may re-run the audit command as follows:
                   
Get-TransportRule | Where-Object {($_.setscl -eq -1 -and $null -ne $_.SenderDomainIs)} | ft Name,SenderDomainIs
References:

https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.4

  • Exchange Online checked: 4
  • Exchange Online flagged: 0
Description:

By default, Microsoft 365 includes built-in features that help protect your users from phishing attacks. Set up anti-phishing polices to increase this protection, for example by refining settings to better detect and prevent impersonation and spoofing attacks. The default policy applies to all users within the organization, and is a single view where you can fine-tune anti-phishing protection. Custom policies can be created and configured for specific users, groups or domains within the organization and will take precedence over the default policy for the scoped users.

Rationale:

Protects users from phishing attacks (like impersonation and spoofing), and uses safety tips to warn users about potentially harmful messages.

Impact:

Turning on Anti-Phishing should not cause an impact, messages will be displayed when applicable.

Remediation:
To set the anti-phishing policy, use the Microsoft 365 Admin Center

  1. Select Security.

  2. Expand Threat Managementthen select Policy.

  3. Select Anti-phishing.

  4. Click Create to create an anti-phishing policy.

To create an anti-phishing policy, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
New-AntiPhishPolicy -Name "Microsoft 365 AntiPhish Policy"
References:

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/set-up-anti-phishing-policies?view=o365-worldwide
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-mdo-anti-phishing-policies?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.6

  • Exchange Online checked: 1
  • Exchange Online flagged: 0
Description:

Consider to setup the Exchange Online Protection malware filter to notify administrators if internal senders are blocked for sending malware.

Rationale:

This setting alerts administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise, that would need to be investigated.

Impact:

Notification of account with potential issues should not cause an impact to the user.

Remediation:
To enable notifications for internal users sending malware, use the Microsoft 365 Admin Center

  1. Select Security.

  2. Expand Threat Managementthen select Policy.

  3. Select Anti-Malware.

  4. Change the setting Notify administrator about undelivered messages from internal senders to Always On and enter the email address of the administrator who should be notified under Administrator email address.

To check the setting from PowerShell, use the Exchange Online Module for PowerShell

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
set-MalwareFilterPolicy -Identity '{Identity Name}' -EnableInternalSenderAdminNotifications $True -InternalSenderAdminAddress {admin@domain1.com}
References:

https://docs.microsoft.com/en-us/office365/servicedescriptions/exchange-online-protection-service-description/anti-spam-and-anti-malware-protection-eop

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.10

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Description:

Consider to enable MailTips, which is designed to assist end users with identifying strange patterns to emails they send.

Rationale:

Setting up MailTips gives a visual aid to users when they send emails to large groups of recipients or send emails to recipients not within the tenant.

Remediation:
To enable MailTips, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-ExchangeOnline

  2. Run the following PowerShell command:

                   
Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold '25'
References:

https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips

Compliance:

CIS Microsoft 365 Foundations 1.5.0 4.11

  • Exchange Online checked: 1
  • Exchange Online flagged: 0
Description:

Consider to restrict storage providers that are integrated with Outlook on the Web.

Rationale:

By default additional storage providers are allowed in Outlook on the Web (such as Box, Dropbox, Facebook, Google Drive, OneDrive Personal, etc.). This could lead to information leakage and additional risk of infection from organizational non-trusted storage providers. Restricting this will inherently reduce risk as it will narrow opportunities for infection and data leakage.

Impact:

Impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

Remediation:
To disable external storage providers, use the Exchange Online PowerShell Module

  1. Connect to Exchange Online using Connect-EXOPSSession

  2. Run the following PowerShell command:

                   
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AdditionalStorageProvidersAvailable $false
  1. Run the following Powershell command to verify that the value is now False:
                   
Get-OwaMailboxPolicy | Format-Table Name, AdditionalStorageProvidersAvailable
References:

https://docs.microsoft.com/en-us/powershell/module/exchange/client-access/set-owamailboxpolicy?view=exchange-ps

Compliance:

CIS Microsoft 365 Foundations 1.5.0 6.4

  • Exchange Online checked: 1
  • Exchange Online flagged: 1
Details
Ensure the customer lockbox feature is enabled
Name Guest Enabled Customer LockBox actions
monkeytenant.onmicrosoft.com Enabled Disabled
Ensure the Common Attachment Types Filter is enabled
Policy Name Is Enabled Enable File Filter Filetypes actions
Default Enabled Disabled ace,apk,app,appx,ani,arj,bat,cab,cmd,com,deb,dex,dll,docm,elf,exe,hta,img,iso,jar,jnlp,kext,lha,lib,library,lnk,lzh,macho,msc,msi,msix,msp,mst,pif,ppa,ppam,reg,rev,scf,scr,sct,sys,uif,vb,vbe,vbs,vxd,wsc,wsf,wsh,xll,xz,z
Ensure Exchange Online Spam Policies are set correctly
Name BCC Nofity Notify Outbound Spam actions
Default Disabled Disabled
Ensure automatic forwarding options are disabled
Policy Name Organization Automatic Forward actions
Default monkeytenant.onmicrosoft.com Enabled
Ensure notifications for internal users sending malware is Enabled For Administrators
Name Enabled Internal Senders Admin Notify Internal Senders Admin Address actions
Default Enabled Disabled NotSet
Ensure external storage providers available in Outlook on the Web are restricted
Name Organization Conditional Access Policy Additional Storage Providers actions
OwaMailboxPolicy-Default monkeytenant.onmicrosoft.com Off Enabled
card_img

sharepoint online

Description:

Modern authentication in Microsoft 365 enables authentication features like multifactor authentication (MFA) using smart cards, certificate-based authentication (CBA), and third party SAML identity provider.

Rationale:

Strong authentication controls, such as the use of multifactor authentication, may be circumvented if basic authentication is used by SharePoint applications. Requiring modern authentication for SharePoint applications ensures strong authentication mechanisms are used when establishing sessions between these applications, SharePoint, and connecting users.

Impact:

Implementation of modern authentication for SharePoint will require users to authenticate to SharePoint using modern authentication. This may cause a minor impact to typical user behavior.

Remediation:
To set SharePoint settings, use the Microsoft 365 Admin Center

  1. Under Admin centers select SharePoint.

  2. Expand Policies then select Access Control.

  3. Select Apps that don't use modern authentication.

  4. Select the radio button for Block.

  5. Click Save

To set Apps that don't use modern authentication is set to Block, use the SharePoint Online PowerShell Module:

  1. Connect to SharePoint Online using Connect-SPOService -Url https://tenant-admin.sharepoint.com replacing tenant with your value.

  2. Run the following SharePoint Online PowerShell command:

                   
Set-SPOTenant -LegacyAuthProtocolsEnabled $false
References:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication
https://stealthbits.com/blog/how-to-harden-you-sharepoint-online-environment-by-disabling-legacy-authentication/

Compliance:

CIS Microsoft 365 Foundations 1.5.0 1.3

  • SharePoint Online checked: 1
  • SharePoint Online flagged: 1
Details
Description:

Office 365 ATP for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected, that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.

Rationale:

Defender for Office 365 for SharePoint, OneDrive, and Microsoft Teams protects your organization from inadvertently sharing malicious files. When an infected file is detected, that file is blocked so that no one can open, copy, move, or share it until further actions are taken by the organization's security team.

Impact:

The only potential impact associated with implementation of this setting is potential inconvenience associated with the small percentage of false positive detections that may occur.

Remediation:
To set O365 SharePoint to disallow download of infected files, use Powershell:

  1. Connect using Connect-SPOService, you will need to enter the URL for your Sharepoint Online admin page https://*-admin.sharepoint.com as well as a Global Admin account.

  2. Run the following Powershell command to set the value to True

                   
Set-SPOTenant –DisallowInfectedFileDownload $true
  1. After several minutes run the following to verify the value for DisallowInfectedFileDownload has been set to True.
                   
Get-SPOTenant | Select-Object DisallowInfectedFileDownload
References:

https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/turn-on-atp-for-spo-odb-and-teams
https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/virus-detection-in-spo?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 2.5

  • SharePoint Online checked: 1
  • SharePoint Online flagged: 1
Details
Description:

SharePoint gives users the ability to share files, folder, and site collections. Internal users can share with external collaborators, who with the right permissions, could share those to another external party.

Rationale:

Sharing and collaboration are key; however, file, folder, or site collection owners should have the authority over what external users get shared with to prevent unauthorized disclosures of information.

Impact:

Impact associated with this change is highly dependent upon current practices. If users do not regularly share with external parties, then minimal impact is likely. However, if users do regularly share with guests/externally, minimum impacts could occur as those external users will be unable to 're-share' content.

Remediation:
To set SharePoint sharing settings, use the Microsoft 365 Admin Center

  1. Under Admin centers select SharePoint.

  2. Expand Policies then select Sharing.

  3. Expand More external sharing settings, uncheck Allow guests to share items they don't own.

  4. Click Save

To Set Prevent external users from sharing files, folders, and sites that they don’t own, use the SharePoint Online PowerShell Module:

  1. Connect to SharePoint Online service using Connect-SPOService.

  2. Run the following SharePoint Online PowerShell command:

                   
Set-SPOTenant -PreventExternalUsersFromResharing $True
References:

https://docs.microsoft.com/en-us/sharepoint/external-sharing-overview
https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.6

  • SharePoint Online checked: 1
  • SharePoint Online flagged: 1
Details
Description:

Consider to control sharing of documents to external domains by either blocking domains or only allowing sharing with specific named domains.

Rationale:

Attackers will often attempt to expose sensitive information to external entities through sharing, and restricting the domains that your users can share documents with will reduce that surface area.

Impact:

Enabling this feature will prevent users from sharing documents with domains outside of the organization unless allowed.

Remediation:
To configure document sharing restrictions, use the Microsoft 365 Admin Center

  1. Log in as an SharePoint Administrator

  2. Navigate to Microsoft 365 administration portal, Click on Admin Centers and then SharePoint.

  3. Expand Policies then click Sharing.

  4. Expand More external sharing settings and check Limit external sharing by domain..

  5. Select Add domains to add a list of approved domains.

  6. Click Save at the bottom of the page.

To configure document sharing restrictions, you can also use SharePoint Online PowerShell

  1. Connect to SharePoint Online using Connect-SPOService

  2. Run the following PowerShell command:

                   
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "domain1.com domain2.com"
References:

https://docs.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off
https://docs.microsoft.com/en-us/microsoft-365/solutions/microsoft-365-limit-sharing?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 6.1

  • SharePoint Online checked: 1
  • SharePoint Online flagged: 1
Details
Ensure modern authentication for SharePoint applications is required
Root Site Sharing Capability Conditional Access Policy Legacy Auth Enabled actions
https://m365x98947200.sharepoint.com/ 2 0 Enabled
Ensure Office 365 SharePoint infected files are disallowed for download
Root Site Sharing Capability Conditional Access Policy Disallow Infected File Download actions
https://m365x98947200.sharepoint.com/ 2 0 Disabled
Ensure that external users cannot share files, folders, and sites they do not own
Allow Editing Link Track Users Conditional Access Policy Prevent External Users From Resharing actions
Enabled Disabled 0 Disabled
Ensure document sharing is being controlled by domains with whitelist or blacklist
Allow Editing Link Track Users Conditional Access Policy Sharing Domain Restriction Mode actions
Enabled Disabled 0 0
card_img

microsoft forms

Description:

Microsoft Forms can be used for phishing attacks by asking personal or sensitive information and collecting the results. Microsoft 365 has built-in protection that will proactively scan for phishing attempt in forms such personal information request.

Rationale:

Enabling internal phishing protection for Microsoft Forms will prevent attackers using forms for phishing attacks by asking personal or other sensitive information and URLs.

Impact:

If potential phishing was detected, the form will be temporarily blocked and cannot be distributed and response collection will not happen until it is unblocked by the administrator or keywords were removed by the creator.

Remediation:
To set Microsoft Forms settings use the Microsoft 365 Admin Center

  1. Expand Settings then select Org settings.

  2. Under Services select Microsoft Forms.

  3. Select the checkbox for Add internal phishing protection.

  4. Click Save

References:

https://support.microsoft.com/en-us/office/administrator-settings-for-microsoft-forms-48161c55-fbae-4f37-8951-9e3befc0248b
https://support.microsoft.com/en-us/office/review-and-unblock-forms-or-users-detected-and-blocked-for-potential-phishing-879a90d7-6ef9-4145-933a-fb53a430bced

Compliance:

CIS Microsoft 365 Foundations 1.5.0 2.10

  • Microsoft Forms checked: 1
  • Microsoft Forms flagged: 0
card_img

microsoft teams

Description:

Disable the ability of your users to communicate via Skype or Teams with users outside your organization.

Rationale:

You should not allow your users to communicate with Skype or Teams users outside your organization. While there are legitimate, productivity-improving scenarios for this, it also represents a potential security threat because those external users will be able to interact with your users over Skype for Business or Teams. Attackers may be able to pretend to be someone your user knows and then send malicious links or attachments, resulting in an account breach or leaked information.

Impact:

Impact associated with this change is highly dependent upon current practices in the tenant. If users do not regularly communicate with external parties using Skype or Teams channels, then minimal impact is likely. However, if users do regularly utilize Teams and Skype for client communication, potentially significant impacts could occur, and users should be contacts, and if necessary, alternate mechanisms to continue this communication should be identified prior to disabling external access to Teams and Skype.

Remediation:
To disable Skype forBusiness and Teams access with external users, use the Microsoft 365 Admin Center

  1. Under Admin Centers choose Teams.

  2. Expand Org Wide Settings then select External Access.

  3. Set Users can communicate with Skype for Business and Teams users to Off.

  4. Set Skype for Business users can communicate with Skype users to Off.

References:

https://docs.microsoft.com/en-us/microsoftteams/teams-skype-interop
https://docs.microsoft.com/en-us/skypeforbusiness/set-up-skype-for-business-online/allow-users-to-contact-external-skype-for-business-users

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.3

  • Microsoft Teams checked: 1
  • Microsoft Teams flagged: 1
Details
Description:

Microsoft Teams enables collaboration via file sharing. This file sharing is conducted within Teams, using SharePoint Online, by default; however, third-party cloud services are allowed as well.

Rationale:

Ensuring that only authorized cloud storage providers are accessible from Teams will help to dissuade the use of non-approved storage providers.

Impact:

Impact associated with this change is highly dependent upon current practices in the tenant. If users do not use other storage providers, then minimal impact is likely. However, if users do regularly utilize providers outside of the tenant this will affect their ability to continue to do so.

Remediation:
To Set external file sharing in Teams, use the Microsoft 365 Admin Center:

  1. Under Admin Centers choose Teams.

  2. Expand Org Wide Settings select Teams settings.

  3. Set each cloud storage service under Files to On if it is authorized.

To verify external file sharing in Teams you may also utilize Powershell. Ensure that the Skype for business online, Windows Powershell module and Microsoft Teams module are both installed.

  1. Install the Powershell module for teams. Skype module will need downloaded from Microsoft
                   
Install-Module MicrosoftTeams -Scope CurrentUser

Import-Module SkypeOnlineConnector
  1. Connect to your tenant as a Global Administrator, methods will differ based on whether 2FA is enabled. See the following article for more information:

https://docs.microsoft.com/en-us/office365/enterprise/powershell/manage-skype-for-business-online-with-office-365-powershell

  1. Run the following command to verify which cloud storage providers are enabled for Teams
                   
Get-CsTeamsClientConfiguration | select allow*
  1. Run the following Powershell command to disable external providers that are not authorized. (the example disables ShareFile, GoogleDrive, Box, and DropBox)
                   
Set-CsTeamsClientConfiguration -AllowGoogleDrive $false `

-AllowShareFile $false `

-AllowBox $false `

-AllowDropBox $false `

-AllowEgnyte $false
  1. You may verify this worked by running the following Powershell command again.
                   
Get-CsTeamsClientConfiguration | select allow*
References:

https://docs.microsoft.com/en-us/powershell/module/skype/set-csteamsclientconfiguration?view=skype-ps

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.7

  • Microsoft Teams checked: 1
  • Microsoft Teams flagged: 1
Details
Ensure external domains are not allowed in Skype or Teams
Identity Allow Public Users Allow Federated Users actions
Global Enabled Enabled
Ensure external file sharing in Teams is enabled for only approved cloud storage services
Identity Allow Public Users Allow Federated Users actions
Global NotSet NotSet
card_img

security and compliance

Description:

Enabling Data Loss Prevention (DLP) policies allows Exchange Online and SharePoint Online content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.

References:

https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.4

  • Security and Compliance checked: 7
  • Security and Compliance flagged: 0
Description:

Enabling Data Loss Prevention (DLP) policies for Microsoft Teams, blocks sensitive content when shared in teams or channels. Content to be scanned for specific types of data like social security numbers, credit card numbers, or passwords.

Rationale:

Enabling DLP policies alerts users and administrators that specific types of data should not be exposed, helping to protect the data from accidental exposure.

Impact:

Enabling a Teams DLP policy will allow sensitive data in Teams channels or chat messages to be detected or blocked.

References:

https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-microsoft-teams?view=o365-worldwide

Compliance:

CIS Microsoft 365 Foundations 1.5.0 3.5

  • Security and Compliance checked: 7
  • Security and Compliance flagged: 1
Details
Description:

When audit log search in the Microsoft 365 Security & Compliance Center is enabled, user and admin activity from your organization is recorded in the audit log and retained for 90 days. However, your organization might be using a third-party security information and event management (SIEM) application to access your auditing data. In that case, a global admin can turn off audit log search in Microsoft 365.

Rationale:

Enabling Microsoft 365 audit log search helps Office 365 back office teams to investigate activities for regular security operational or forensic purposes

Remediation:
To enable Microsoft 365 audit log search, use the Microsoft 365 Admin Center

  1. Log in as an Global Administrator

  2. Navigate to Office 365 security & compliance center.

  3. In the Security & Compliance Center, expand Search then select Audit log search.

  4. Click Start recording user and admin activities next to the information warning at the top.

  5. Click Yes on the dialog box to confirm.

To enable Microsoft 365 audit log search, use the Exchange Online PowerShell Module

  1. Run Microsoft Exchange Online PowerShell Module.

  2. Connect using Connect-EXOPSSession.

  3. Run the following PowerShell command:

                   
Set-AdminAuditLogConfig -AdminAutidLogEnabled $true -UnifiedAuditLogIngestionEnabled $true
References:

https://docs.microsoft.com/en-us/office365/securitycompliance/turn-audit-log-search-on-or-off

Compliance:

CIS Microsoft 365 Foundations 1.5.0 5.1

  • Security and Compliance checked: 1
  • Security and Compliance flagged: 1
Details
Ensure DLP policies are enabled for Microsoft Teams
Feature Status actions
Enabled DLP Policies For Teams DoesNotExists
Ensure Microsoft 365 audit log search is Enabled
Audit Log Unified ingestion Mailbox auditing actions
Enabled Disabled NotSet
card_img

microsoft onedrive

Description:

Consider to prevent company data from OneDrive for Business from being synchronized to non-corporate managed devices.

Rationale:

Unmanaged devices pose a risk, since their security cannot be verified. Allowing users to sync data to these devices, takes that data out of the control of the organization. This increases the risk of the data either being intentionally or accidentally leaked

Impact:

Enabling this feature will prevent users from using the OneDrive for Business Sync client on devices that are not joined to the domains that were defined.

Remediation:
To block the sync client on unmanaged devices, use the Microsoft 365 Admin Center

  1. Navigate to Microsoft 365 administration portal, Click on All Admin Centers and then OneDrive.

  2. Click Sync.

  3. Ensure that Allow syncing only on PCs joined to specific domains is checked.

  4. Use the Get-ADDomain PowerShell command to obtain the GUID from each domain in your environment and add them to the box below.

  5. Click Save

References:

https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenantsyncclientrestriction?view=sharepoint-ps

Compliance:

CIS Microsoft 365 Foundations 1.5.0 6.2

  • Microsoft OneDrive checked: 1
  • Microsoft OneDrive flagged: 1
Details
Block OneDrive for Business sync from unmanaged devices
Conditional Access Policy Disable Personal List Creation Prevent Infected File Download Restrict Access From Unmanaged Devices actions
0 Disabled Disabled Disabled