Skip to content

Microsoft 365 encryption, keys & secrets security checks

Encryption at rest and in transit, key rotation, and the API keys, tokens and credentials that outlive the people who created them.

On Microsoft 365, Black Cat runs 9 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft 365 connector needs.

Checks (9)

severity: medium S/MIME Encryption Not Enforced fix difficulty: medium #

Enforce S/MIME encryption for all outgoing M365 OWA emails

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAAlwaysEncrypt $true
  3. Verify with Get-SmimeConfig | Select OWAAlwaysEncrypt

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: medium S/MIME Signing Not Enforced fix difficulty: medium #

Enforce S/MIME signing for all outgoing M365 OWA emails

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAAlwaysSign $true
  3. Verify with Get-SmimeConfig | Select OWAAlwaysSign

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Clear Signing Not Enabled fix difficulty: easy #

Enable S/MIME clear-text signing in M365 OWA for interoperability with non-S/MIME clients

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAClearSign $true
  3. Verify with Get-SmimeConfig | Select OWAClearSign

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Cert Chain Without Root Not Included fix difficulty: easy #

Include the certificate chain without root in M365 OWA S/MIME configuration

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAIncludeCertificateChainWithoutRootCertificate $true
  3. Verify with Get-SmimeConfig

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Cert Chain With Root Not Included fix difficulty: easy #

Include the complete certificate chain including root in M365 OWA S/MIME configuration

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAIncludeCertificateChainAndRootCertificate $true
  3. Verify with Get-SmimeConfig

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Triple-Wrap Not Enabled fix difficulty: easy #

Enable S/MIME triple-wrap in M365 OWA for enhanced message security

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWATripleWrap $true
  3. Verify with Get-SmimeConfig | Select OWATripleWrap

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME CRL Timeout Too Long fix difficulty: easy #

Reduce the M365 OWA S/MIME CRL retrieval timeout to 10 seconds

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWACRLRetrievalTimeout 10000
  3. Verify with Get-SmimeConfig | Select OWACRLRetrievalTimeout

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Encryption Algorithms Not Configured fix difficulty: easy #

Set M365 OWA S/MIME encryption algorithms to AES-128 or stronger

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWAEncryptionAlgorithms 6602:128 to set AES-128 or stronger
  3. Verify with Get-SmimeConfig | Select OWAEncryptionAlgorithms

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

severity: low S/MIME Buffer Encryption Not Enabled fix difficulty: easy #

Enable S/MIME buffer encryption in M365 OWA to protect temporary data

  1. Connect to Exchange Online PowerShell
  2. Run Set-SmimeConfig -OWADisableCRLCheck $false -OWAEncryptTemporaryBuffers $true
  3. Verify with Get-SmimeConfig

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.24 SOC 2 Type II CC6.1 CIS Controls v8 CIS-03.10 NIST CSF 2.0 PR.DS-02 GDPR (SaaS Security) GDPR-32.1a HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.h DORA (SaaS Security) DORA-9.7

More Microsoft 365 checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial