The 167 Microsoft 365 security checks Black Cat runs

Black Cat SSPM evaluates 167 security policies against your Microsoft 365 configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect Microsoft 365 — what access Black Cat needs, and why.

Identity, MFA & sign-in (5)

Security Defaults Disabled severity: high
Guest Email OTP Not Enabled severity: medium
CA MFA Not Enforced severity: high
Weak Authentication Factors Enabled severity: medium
MFA Suspicious Activity Reporting Disabled severity: medium

Access control & privilege (62)

Guest User Permissions Not Restricted severity: high
Guest Invitation Not Restricted severity: medium
Users Can Create Security Groups severity: medium
Users Can Register Applications severity: medium
User Consent to Apps Not Restricted severity: high
Guest Group Privileges Not Restricted severity: medium
Admin Consent Requests Disabled severity: medium
Users Can Create Tenants severity: low
M365 Group Creation Not Restricted severity: medium
MSOL PowerShell Not Blocked severity: medium
Self-Service Sign Up Enabled severity: medium
Guest Access to Groups Not Restricted severity: medium
Global Admin Redundancy Missing severity: high
Excessive Global Administrators severity: medium
Global Admin Not Cloud-Only severity: high
External Users With Admin Role severity: high
Guest Users Present severity: medium
Copilot License on Guest User severity: medium
CA Block High Risk Users Missing severity: high
CA Block Risky Sign-ins Missing severity: high
CA Legacy Auth Not Blocked severity: medium
CA Session Duration Not Set severity: medium
CA Compliant Devices Not Required severity: medium
CA Device Code Flow Not Blocked severity: medium
Auth Methods Migration Incomplete severity: medium
TAP Enabled for All Users severity: high
TAP Not One-Time Use severity: high
TAP Global Policy Enabled severity: medium
TAP Maximum Lifetime Too Long severity: medium
TAP Character Length Too Short severity: medium
Password Expiration Policy Enabled severity: high
Password Lockout Threshold Too High severity: medium
Lockout Duration Too Short severity: medium
Custom Banned Passwords Not Enforced severity: medium
Password Protection On-Prem Disabled severity: medium
Password Protection Mode Audit Only severity: low
SP Using Password Credentials severity: high
SP Expired Password Credentials severity: low
SP Expired Certificate Credentials severity: low
SP Long-Lived Password Credentials severity: medium
SP Long-Lived Certificate Credentials severity: medium
SP Password Credentials Expiring Soon severity: low
SP Certificate Credentials Expiring Soon severity: low
App Using Password Credentials severity: medium
App Long-Lived Password Credentials severity: medium
App Long-Lived Certificate Credentials severity: medium
App Expired Password Credentials severity: low
App Expired Certificate Credentials severity: low
App Password Credentials Expiring Soon severity: low
App Certificate Credentials Expiring Soon severity: low
OAuth App AI With Data Scopes severity: medium
OWA Session Timeout Disabled severity: medium
Shared Mailbox Sign-In Enabled severity: high
Users Can Install Outlook Add-ins severity: high
Direct File Access on Public Computers severity: medium
WAC Viewing on Public Computers severity: medium
Mobile Device Allows Non-Provisionable severity: medium
ActiveSync Does Not Block Unmanaged Devices severity: medium
Copilot Agent Excessive Connectors severity: medium
Copilot Agent Sensitive Connector Write Access severity: high
Copilot Agent Maker Provided Credentials severity: high
Copilot Agent No User Consent Required severity: medium

Data sharing & exposure (22)

Guest Access to Group Content Not Restricted severity: medium
Organization Sharing Enabled severity: high
Default Calendar Sharing Too Permissive severity: high
Default Group Access Public severity: medium
External Forwarding on Mailbox severity: medium
Mailbox Delivers to Both Mailbox and Forward severity: medium
Forwarding SMTP to External severity: high
Forwarding Address Configured severity: low
LinkedIn Integration Enabled in OWA severity: medium
Mobile Contact Sync Enabled in OWA severity: medium
Transport Rule Redirects Externally severity: high
Transport Rule Forwards Outside Org severity: high
Remote Domain Auto-Forwarding Allowed severity: high
Default Sharing Policy Allows External severity: medium
Sharing Policy Allows External Domains severity: low
Distribution List Allows External Senders severity: medium
Distribution Group Open Join Policy severity: medium
Public Microsoft 365 Group severity: medium
Outbound Spam External Forwarding Allowed severity: medium
Copilot Agent Tenant-Wide Sharing severity: high
Copilot Agent Broad Sharing severity: medium
Copilot Agent Web Search Enabled severity: medium

Encryption, keys & secrets (9)

S/MIME Encryption Not Enforced severity: medium
S/MIME Signing Not Enforced severity: medium
S/MIME Clear Signing Not Enabled severity: low
S/MIME Cert Chain Without Root Not Included severity: low
S/MIME Cert Chain With Root Not Included severity: low
S/MIME Triple-Wrap Not Enabled severity: low
S/MIME CRL Timeout Too Long severity: low
S/MIME Encryption Algorithms Not Configured severity: low
S/MIME Buffer Encryption Not Enabled severity: low

Logging & audit (8)

Global Mailbox Auditing Disabled severity: high
Mailbox Audit Bypass Configured severity: high
Mailbox Auditing Disabled severity: medium
Shared Mailbox Sent-As Not Audited severity: low
Shared Mailbox Sent-On-Behalf Not Audited severity: low
Non-Shared Mailbox Audit Bypass severity: low
User Mailbox Auditing Disabled severity: medium
Unified Audit Log Not Enabled severity: high

Configuration hardening (50)

Self-Service Subscriptions Enabled severity: low
Risk-Based Consent Not Configured severity: high
Group Naming Convention Not Configured severity: low
Customer Lockbox Not Enabled severity: high
Copilot License Assigned severity: low
Unverified Domain severity: high
Unverified Federated Domain severity: high
SPF Record Missing severity: medium
DMARC Record Missing severity: medium
DKIM Record Missing severity: medium
Multi-Tenant App Without Verified Publisher severity: medium
SMTP Auth Not Disabled Globally severity: high
External Recipient Mail Tips Disabled severity: medium
Mail Tips Not Fully Enabled severity: low
Mailbox SMTP Auth Not Disabled severity: medium
OWA Clickjacking Protection Not Set severity: high
ActiveSync Integration Enabled for OWA severity: medium
On-Send Add-ins Enabled in OWA severity: low
No File Types Blocked in OWA severity: medium
No MIME Types Blocked in OWA severity: medium
Unknown File Types Not Blocked severity: medium
Transport Rule Includes BCC severity: medium
Transport Rule Processes External Sender severity: medium
Transport Rule Deletes Messages severity: high
Transport Rule Disabled severity: low
Remote Domain Trusted Inbound Enabled severity: medium
Remote Domain Trusted Outbound Enabled severity: medium
Remote Domain Auto-Reply Enabled severity: low
Remote Domain Delivery Reports Enabled severity: low
Remote Domain NDR Enabled severity: low
Remote Domain TNEF Enabled severity: low
Distribution List Hidden From GAL severity: low
Mailbox Move Enabled for Org Relationships severity: medium
Common Attachment Types Filter Disabled severity: high
Common Attachment Types Missing severity: high
Zero-Hour Auto Purge Disabled severity: medium
Admin Malware Notifications Disabled severity: medium
Blocked File Type Action Not Quarantine severity: low
Anti-Phishing Spoof Detection Weak severity: medium
Anti-Phishing First Contact Tip Disabled severity: low
Outbound Spam Thresholds Not Configured severity: medium
Inbound Spam Bulk Threshold Too High severity: medium
SPF Hard Fail Not Enabled severity: medium
High Confidence Spam Not Quarantined severity: low
Connection Filter Not Configured severity: low
Outbound Spam Notification Disabled severity: low
Suspicious Outbound Copy Not Enabled severity: low
Comprehensive Spam Marking Disabled severity: low
Sensitivity Labels Not Configured severity: medium
Copilot Inventory Degraded severity: medium

AI governance (6)

Copilot Agent Generative Orchestration severity: low
Copilot Agent No Authentication severity: critical
Copilot Agent Multi-Channel Exposure severity: low
Copilot Agent Unconstrained Tool Use severity: medium
Copilot Agent Unreviewed (14+ days) severity: medium
Copilot Agent High Risk Unblocked severity: high

Lifecycle & offboarding (5)

Copilot Agent No Owner severity: high
Copilot Agent Never Published (30+ days) severity: low
Copilot Agent Quarantined severity: critical
Copilot Agent Stale (90+ days inactive) severity: low
Copilot Agent Orphaned Owner severity: high

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial