Skip to content

Microsoft 365 access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Microsoft 365, Black Cat runs 62 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft 365 connector needs.

Checks (62)

severity: high Guest User Permissions Not Restricted fix difficulty: easy #

Restrict M365 guest user permissions to Most Restrictive in External Identities settings

  1. Navigate to Microsoft Entra Admin Center > External Identities > External Collaboration Settings
  2. Set Guest User Access Restrictions to Most Restrictive
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Guest Invitation Not Restricted fix difficulty: easy #

Restrict M365 guest invitations to only users assigned to specific admin roles

  1. Navigate to Microsoft Entra Admin Center > External Identities > External Collaboration Settings
  2. Set Guest Invite Restrictions to Only Users Assigned to Specific Admin Roles
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Users Can Create Security Groups fix difficulty: easy #

Prevent non-admin M365 users from creating security groups in Azure portals

  1. Navigate to Microsoft Entra Admin Center > Groups > General Settings
  2. Set Users Can Create Security Groups in Azure Portals to No
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Users Can Register Applications fix difficulty: easy #

Prevent non-admin M365 users from registering applications in Entra ID

  1. Navigate to Microsoft Entra Admin Center > Users > User Settings
  2. Set Users Can Register Applications to No
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high User Consent to Apps Not Restricted fix difficulty: medium #

Disable M365 user consent to apps and require admin approval for OAuth grants

  1. Navigate to Microsoft Entra Admin Center > Enterprise Applications > Consent and Permissions
  2. Set User Consent to Do Not Allow User Consent
  3. Configure an Admin Consent Workflow so users can request access
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Guest Group Privileges Not Restricted fix difficulty: easy #

Restrict M365 guest user access to limited directory properties and memberships

  1. Navigate to Microsoft Entra Admin Center > External Identities > External Collaboration Settings
  2. Set Guest User Access to Limited Access to Properties and Memberships
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Admin Consent Requests Disabled fix difficulty: easy #

Enable M365 admin consent workflow so users can request app access

  1. Navigate to Microsoft Entra Admin Center > Enterprise Applications > Admin Consent Settings
  2. Enable Users Can Request Admin Consent
  3. Configure designated admin reviewers
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Users Can Create Tenants fix difficulty: easy #

Prevent M365 users from creating new Azure AD tenants

  1. Navigate to Microsoft Entra Admin Center > Users > User Settings
  2. Set Users Can Create Tenants to No
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium M365 Group Creation Not Restricted fix difficulty: medium #

Restrict M365 group creation to a specific security group of approved users

  1. Connect to Microsoft Graph PowerShell or use Entra Admin Center
  2. Create a security group for users allowed to create M365 groups
  3. Set the GroupCreationAllowedGroupId in directory settings to that group
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium MSOL PowerShell Not Blocked fix difficulty: medium #

Block legacy MSOL PowerShell access in M365 using Conditional Access policies

  1. Navigate to Microsoft Entra Admin Center > Users > User Settings
  2. Set Restrict Access to Azure AD Administration Portal to Yes
  3. Use Conditional Access to block legacy PowerShell protocols
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Self-Service Sign Up Enabled fix difficulty: easy #

Disable guest self-service sign-up flows in M365 External Identities settings

  1. Navigate to Microsoft Entra Admin Center > External Identities > External Collaboration Settings
  2. Disable Enable Guest Self-Service Sign Up via User Flows
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Guest Access to Groups Not Restricted fix difficulty: easy #

Restrict M365 guest user access to group properties and memberships

  1. Navigate to Microsoft Entra admin center > Identity > External Identities > External collaboration settings
  2. Under Guest user access restrictions, choose the most restrictive guest access option
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Global Admin Redundancy Missing fix difficulty: easy #

Ensure at least two M365 Global Administrator accounts exist for redundancy

  1. Navigate to Microsoft Entra Admin Center > Roles and Administrators
  2. Verify at least two Global Administrator accounts exist
  3. If only one exists, assign a second trusted user the Global Admin role
  4. Ensure both use cloud-only accounts with MFA enabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Global Administrators fix difficulty: medium #

Reduce M365 Global Admin count to 2-4 accounts by demoting unnecessary admins

  1. Navigate to Microsoft Entra Admin Center > Roles and Administrators > Global Administrator
  2. Review the list of Global Admins
  3. Demote unnecessary Global Admins to more specific admin roles
  4. Keep only 2-4 Global Admin accounts

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Global Admin Not Cloud-Only fix difficulty: hard #

Replace synced M365 Global Admin accounts with cloud-only admin accounts

  1. Navigate to Microsoft Entra Admin Center > Roles and Administrators > Global Administrator
  2. Identify Global Admins that are synced from on-premises AD
  3. Create cloud-only admin accounts for these users
  4. Remove the Global Admin role from synced accounts

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high External Users With Admin Role fix difficulty: medium #

Remove admin roles from external M365 guest users and create internal accounts

  1. Navigate to Microsoft Entra Admin Center > Users > All Users
  2. Filter for external/guest users with admin roles
  3. Remove admin roles from external users
  4. Create internal accounts if admin access is required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Guest Users Present fix difficulty: medium #

Review and remove M365 guest accounts that no longer require access

  1. Navigate to Microsoft Entra Admin Center > Users > All Users
  2. Filter for guest users
  3. Review each guest user and confirm they still need access
  4. Remove guest accounts that are no longer required

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Copilot License on Guest User fix difficulty: easy #

Remove Copilot licenses from M365 guest accounts to prevent data exposure

  1. Navigate to Microsoft 365 Admin Center > Billing > Licenses
  2. Identify guest users with Copilot licenses
  3. Remove Copilot license from guest accounts
  4. Reassign to internal users if needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high CA Block High Risk Users Missing fix difficulty: medium #

Create an M365 Conditional Access policy to block high-risk users from signing in

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Create a new policy targeting All Users
  3. Set Conditions > User Risk to High
  4. Set Grant to Block Access
  5. Enable the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high CA Block Risky Sign-ins Missing fix difficulty: medium #

Create an M365 Conditional Access policy to block or require MFA for risky sign-ins

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Create a new policy targeting All Users
  3. Set Conditions > Sign-In Risk to High and Medium
  4. Set Grant to Block Access or Require MFA
  5. Enable the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium CA Legacy Auth Not Blocked fix difficulty: medium #

Create an M365 Conditional Access policy to block legacy authentication protocols

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Create a new policy targeting All Users
  3. Set Conditions > Client Apps to Exchange ActiveSync and Other Clients
  4. Set Grant to Block Access
  5. Enable the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium CA Session Duration Not Set fix difficulty: easy #

Configure M365 Conditional Access sign-in frequency to a maximum of 12 hours

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Edit or create a policy targeting All Users
  3. Set Session > Sign-In Frequency to a maximum of 12 hours
  4. Enable Persistent Browser Session as needed
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium CA Compliant Devices Not Required fix difficulty: hard #

Create an M365 Conditional Access policy to require compliant devices for all cloud apps

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Create a policy targeting All Users and All Cloud Apps
  3. Set Grant to Require Device to Be Marked as Compliant
  4. Ensure device compliance policies are configured in Intune
  5. Enable the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium CA Device Code Flow Not Blocked fix difficulty: easy #

Create an M365 Conditional Access policy to block the device code authentication flow

  1. Navigate to Microsoft Entra Admin Center > Protection > Conditional Access
  2. Create a new policy targeting All Users
  3. Set Conditions > Authentication Flows > Device Code Flow
  4. Set Grant to Block Access
  5. Enable the policy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Auth Methods Migration Incomplete fix difficulty: hard #

Complete the M365 migration from legacy MFA to the unified Authentication Methods policy

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Policies
  2. Check the migration status from legacy MFA/SSPR to Authentication Methods
  3. Complete the migration by enabling all required methods in the new policy
  4. Disable the legacy MFA policies

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high TAP Enabled for All Users fix difficulty: easy #

Restrict M365 Temporary Access Pass to specific admin groups rather than all users

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods
  2. Select Temporary Access Pass
  3. Restrict TAP to specific admin groups rather than All Users
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high TAP Not One-Time Use fix difficulty: easy #

Configure M365 Temporary Access Pass to be usable only once

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods
  2. Select Temporary Access Pass
  3. Enable the Is Usable Once setting
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium TAP Global Policy Enabled fix difficulty: easy #

Disable the M365 global TAP policy and use targeted group assignments instead

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods
  2. Select Temporary Access Pass
  3. Disable the global TAP policy and use targeted group assignments instead
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium TAP Maximum Lifetime Too Long fix difficulty: easy #

Set M365 Temporary Access Pass maximum lifetime to 1 hour or less

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods
  2. Select Temporary Access Pass
  3. Set Maximum Lifetime to 1 hour or less
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium TAP Character Length Too Short fix difficulty: easy #

Set M365 Temporary Access Pass minimum character length to at least 8 characters

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods
  2. Select Temporary Access Pass
  3. Set Minimum Character Length to at least 8 characters
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Password Expiration Policy Enabled fix difficulty: easy #

Disable M365 password expiration policy per NIST guidance and rely on MFA instead

  1. Navigate to Microsoft 365 Admin Center > Settings > Org Settings > Security & Privacy
  2. Select Password Expiration Policy
  3. Set passwords to never expire (per NIST 800-63B guidance)
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Password Lockout Threshold Too High fix difficulty: easy #

Set M365 password lockout threshold to 10 or fewer failed attempts

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Password Protection
  2. Set the lockout threshold to 10 or fewer failed attempts
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Lockout Duration Too Short fix difficulty: easy #

Set M365 password lockout duration to at least 60 seconds

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Password Protection
  2. Set the lockout duration to at least 60 seconds
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Custom Banned Passwords Not Enforced fix difficulty: easy #

Enable M365 custom banned password list enforcement to block organization-specific terms

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Password Protection
  2. Enable Enforce Custom Banned Password List
  3. Add organization-specific terms to the banned password list
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-32.1b.i HIPAA (SaaS Security) HIPAA-312.d NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Password Protection On-Prem Disabled fix difficulty: hard #

Enable M365 password protection for on-premises Windows Server Active Directory

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Password Protection
  2. Enable Password Protection for Windows Server Active Directory
  3. Deploy Azure AD Password Protection proxy agents on-premises
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Password Protection Mode Audit Only fix difficulty: easy #

Switch M365 on-premises password protection mode from Audit to Enforced

  1. Navigate to Microsoft Entra Admin Center > Protection > Authentication Methods > Password Protection
  2. Change Mode from Audit to Enforced
  3. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high SP Using Password Credentials fix difficulty: hard #

Replace M365 service principal password credentials with certificate-based authentication

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application associated with the service principal
  3. Navigate to Certificates & Secrets
  4. Add a certificate credential and remove the password credential
  5. Update the application configuration to use certificate-based auth

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low SP Expired Password Credentials fix difficulty: easy #

Delete expired password credentials from M365 service principals

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with expired secrets
  3. Navigate to Certificates & Secrets
  4. Delete the expired password credential

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low SP Expired Certificate Credentials fix difficulty: medium #

Replace expired M365 service principal certificate credentials with a new certificate

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with expired certificates
  3. Navigate to Certificates & Secrets
  4. Upload a new certificate and remove the expired one

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium SP Long-Lived Password Credentials fix difficulty: medium #

Rotate M365 service principal secrets that exceed 90 days and set shorter expiry

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with long-lived secrets
  3. Navigate to Certificates & Secrets
  4. Create a new secret with a shorter expiry (90 days recommended)
  5. Update the application and delete the long-lived secret

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium SP Long-Lived Certificate Credentials fix difficulty: medium #

Rotate M365 service principal certificates exceeding 1 year and set shorter validity

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with long-lived certificates
  3. Generate a new certificate with a shorter validity period (1 year recommended)
  4. Upload the new certificate and remove the long-lived one

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low SP Password Credentials Expiring Soon fix difficulty: medium #

Renew M365 service principal secrets expiring soon and update the application configuration

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with secrets expiring soon
  3. Navigate to Certificates & Secrets
  4. Create a new secret and update the application configuration
  5. Delete the old secret after migration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low SP Certificate Credentials Expiring Soon fix difficulty: medium #

Renew M365 service principal certificates expiring soon and update the application

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with certificates expiring soon
  3. Generate and upload a new certificate
  4. Update the application configuration and remove the old certificate

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium App Using Password Credentials fix difficulty: medium #

Replace M365 app registration password credentials with certificate-based authentication

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application using password credentials
  3. Navigate to Certificates & Secrets
  4. Add a certificate credential to replace the password
  5. Update the application to use certificate-based authentication

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium App Long-Lived Password Credentials fix difficulty: medium #

Rotate M365 app registration secrets that exceed 90 days and set shorter expiry

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with long-lived secrets
  3. Create a new secret with a shorter expiry (90 days recommended)
  4. Update the application and delete the long-lived secret

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium App Long-Lived Certificate Credentials fix difficulty: medium #

Rotate M365 app registration certificates exceeding 1 year and set shorter validity

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with long-lived certificates
  3. Generate a new certificate with a shorter validity period
  4. Upload the new certificate and remove the long-lived one

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low App Expired Password Credentials fix difficulty: easy #

Delete expired password credentials from M365 app registrations

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with expired secrets
  3. Navigate to Certificates & Secrets
  4. Delete the expired secret

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low App Expired Certificate Credentials fix difficulty: easy #

Replace expired M365 app registration certificates with a new certificate

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with expired certificates
  3. Upload a new certificate and remove the expired one

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low App Password Credentials Expiring Soon fix difficulty: medium #

Renew M365 app registration secrets expiring soon and update the application configuration

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with secrets expiring soon
  3. Create a new secret and update the application configuration
  4. Delete the old secret after confirming the new one works

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low App Certificate Credentials Expiring Soon fix difficulty: medium #

Renew M365 app registration certificates expiring soon and update the application

  1. Navigate to Microsoft Entra Admin Center > App Registrations
  2. Select the application with certificates expiring soon
  3. Generate and upload a new certificate
  4. Remove the old certificate after confirming the new one works

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium OAuth App AI With Data Scopes fix difficulty: medium #

Revoke sensitive Microsoft Graph API scopes from AI OAuth apps in Microsoft Entra

  1. Navigate to Microsoft Entra Admin Center > Enterprise Applications
  2. Search for and select the flagged AI application
  3. Navigate to Permissions and review the granted Microsoft Graph scopes
  4. Click Grant admin consent revocation or remove sensitive scope delegations
  5. Require users to re-consent with reduced scopes if the app is still needed
  6. Consider restricting user consent for high-risk scopes organisation-wide

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a4 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium OWA Session Timeout Disabled fix difficulty: easy #

Enable activity-based session timeout for M365 Outlook Web Access with a 30-minute limit

  1. Navigate to Exchange Admin Center > Recipients > Mailboxes > OWA Mailbox Policy
  2. Edit the default OWA mailbox policy
  3. Set ActivityBasedTimeout to Enabled with a 30-minute timeout
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Shared Mailbox Sign-In Enabled fix difficulty: easy #

Block direct sign-in for M365 shared mailbox accounts and enforce delegation-only access

  1. Navigate to Microsoft Entra Admin Center > Users
  2. Find the shared mailbox user account
  3. Block sign-in for the account
  4. Verify shared mailbox access works via delegation only

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Users Can Install Outlook Add-ins fix difficulty: easy #

Prevent M365 users from installing Outlook add-ins by disabling user install in OWA policy

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -UserInstallEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select UserInstallEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Direct File Access on Public Computers fix difficulty: easy #

Disable direct file access from public computers in M365 OWA mailbox policy

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -DirectFileAccessOnPublicComputersEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select DirectFileAccessOnPublicComputersEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium WAC Viewing on Public Computers fix difficulty: easy #

Disable Office document viewing on public computers in M365 OWA mailbox policy

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -WacViewingOnPublicComputersEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select WacViewingOnPublicComputersEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Mobile Device Allows Non-Provisionable fix difficulty: easy #

Configure M365 mobile device policies to block non-provisionable devices

  1. Navigate to Exchange Admin Center > Mobile > Mobile Device Mailbox Policies
  2. Edit the default mobile device policy
  3. Set Allow Non-Provisionable Devices to No
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium ActiveSync Does Not Block Unmanaged Devices fix difficulty: medium #

Configure M365 ActiveSync to block unmanaged devices from accessing Exchange

  1. Navigate to Exchange Admin Center > Mobile > Mobile Device Access
  2. Set the default access level to Block for unmanaged devices
  3. Configure device access rules for approved device types
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Copilot Agent Excessive Connectors fix difficulty: medium #

Reduce the number of connector operations below 5

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and review its connector operations
  3. Remove unnecessary connectors or reduce operations

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3

severity: high Copilot Agent Sensitive Connector Write Access fix difficulty: medium #

Remove write access to sensitive connectors or restrict to read-only

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and review connector operations
  3. Change sensitive connector operations to Knowledge (read-only) instead of Tool/TopicTool

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3

severity: high Copilot Agent Maker Provided Credentials fix difficulty: medium #

Switch from maker-provided credentials to per-user authentication

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and go to connector settings
  3. Change connection provider from Maker to User for each flagged connector

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3

severity: medium Copilot Agent No User Consent Required fix difficulty: easy #

Enable end-user consent for connector operations

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and review operations
  3. Enable requiresEndUserConsent for operations that access user data

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3

More Microsoft 365 checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial