CIS Microsoft 365 Foundations Benchmark: Contoso Legal LLP ========================================================== Prepared 12 October 2026 by Harbour IT. Microsoft 365 data from 12 Oct 2026. Gaps to close. Contoso Legal LLP has 9 controls not in place. Controls: 8 Pass, 9 Fail, 11 Partly, 4 Not collected GAPS TO CLOSE No guests or apps with admin roles - 1 guest with admin roles. - g#EXT#@contoso.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. MFA required for administrative roles - 1 admin not covered by MFA. - breakglass@contoso.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA003 — Block legacy authentication, CA004 — All users: Require compliant or hybrid-joined device, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - 1 admin without MFA, and 1 whose registration isn't known. - breakglass@contoso.example: Global Administrator with no MFA method registered - g#EXT#@contoso.example: Exchange Administrator: MFA registration unknown Fix: Have each listed admin register a strong method (Authenticator or a FIDO2 key), or remove the role. Break-glass accounts should use FIDO2 keys kept offline. Users can't consent to apps - Users can consent to any app. - Any user can grant any app access to their mail and files Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. Users can't register applications - Any user can register an app. - Users can register apps that nobody reviews Fix: Set "Users can register applications" to No (Entra admin center > Users > User settings) and give the Application Developer role to the people who need it. No inbox rules hiding mail - 1 suspicious inbox rule. - annabel.fraser@contoso.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. SMTP AUTH disabled - SMTP AUTH is on for the organisation. - SMTP AUTH is allowed Fix: Turn off SMTP AUTH for the organisation and enable it only on the mailboxes of devices or apps that still need it, such as scanners. It accepts passwords without MFA. No anyone links in use - 3 files and folders shared with anyone. - Campaign video.mp4 (Marketing / Documents): Anyone can edit - Brand assets (Marketing / Documents): Anyone can view, link never expires - holiday.jpg (OneDrive of annabel.fraser@contoso.example): Anyone can view Fix: Remove anyone links that are no longer needed, and set the rest to view-only with an expiry date. The Shared files report lists each one. Disks encrypted - 2 of 19 computers not encrypted. - LAPTOP-HILL07 (oliver.hill@contoso.example): Windows disk isn't encrypted - LAPTOP-MARSH (bobby.marsh@contoso.example): Windows disk isn't encrypted Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Supported operating systems - 3 of 19 Windows computers past end of support. - LAPTOP-CLARK13 (william.clark@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JOHNSON04 (jacob.johnson@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-MARSH (bobby.marsh@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - DESK-SMITH03 (megan.smith@contoso.example): Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. - DESK-WILSON12 (olivia.wilson@contoso.example): Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. - and 6 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. MICROSOFT 365 ADMIN CENTRE (FAIL) Two to four Global Administrators Verdict: Pass Requirement: Between two and four accounts hold the Global Administrator role. - 2 Global Administrators. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 What Microsoft 365 can't show: Judged from Entra ID role assignments, including through groups. Administrative accounts are cloud-only Verdict: Pass Requirement: Accounts with admin roles aren't synchronised from on-premises Active Directory. - Cloud-only tenant: no accounts are synced from on-premises AD. What Microsoft 365 can't show: Judged from Entra ID admin role holders. Sign-in to shared mailboxes is blocked Verdict: Pass Requirement: The accounts behind shared mailboxes can't be signed in to. - All 3 shared mailboxes block sign-in. What Microsoft 365 can't show: Judged from Exchange Online and Entra ID. No guests or apps with admin roles Verdict: Fail Requirement: Admin roles are held by internal people, not guests, and apps holding roles are reviewed. - 1 guest with admin roles. - g#EXT#@contoso.example: Guest holding Exchange Administrator - 1 app with privileged roles. - Some app: App holding Exchange Administrator Fix: Remove admin roles from guest accounts. If an external partner needs access, use GDAP or a member account in this tenant protected by MFA. Text to paste: 1 guest with admin roles. 1 app with privileged roles. What Microsoft 365 can't show: Judged from Entra ID role assignments. MICROSOFT ENTRA ID (FAIL) MFA required for all users Verdict: Partly Requirement: A Conditional Access policy requires multi-factor authentication for every user. - But: 4 users without MFA. - Users with an MFA method registered: 80% of 20 - Accounts covered by an enforced MFA policy: 19 of 20 - Not covered: breakglass@contoso.example - Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. - breakglass@contoso.example: Excluded from "CA002 — All users: Require MFA" Fix: Create a Conditional Access policy requiring MFA for all users and all cloud apps, or turn on Security Defaults if the tenant has no Entra ID P1. Keep exclusions to break-glass accounts. Text to paste: Enforced by CA002 — All users: Require MFA, with 1 exclusion to review. What Microsoft 365 can't show: Judged from Conditional Access and Security Defaults. MFA required for administrative roles Verdict: Fail Requirement: A Conditional Access policy requires multi-factor authentication for every admin role. - Accounts holding privileged roles: 4 - Admins with no MFA policy: 1 - Admins with no MFA method registered: 2 - 1 admin not covered by MFA. - breakglass@contoso.example: Global Administrator: excluded from CA001 — Admins: Require phishing-resistant MFA, CA002 — All users: Require MFA, CA003 — Block legacy authentication, CA004 — All users: Require compliant or hybrid-joined device, CA005 — Block sign-ins from disallowed countries, CA006 — Require MFA for Azure management, CA007 — Admins: No persistent browser, 8h sign-in frequency, CA008 — All users: 8h sign-in frequency, CA009 — Require MFA for device registration, CA010 — Insider risk: Step-up MFA, CA011 — High sign-in risk: Block - 1 admin without MFA, and 1 whose registration isn't known. - breakglass@contoso.example: Global Administrator with no MFA method registered - g#EXT#@contoso.example: Exchange Administrator: MFA registration unknown Fix: Have each listed admin register a strong method (Authenticator or a FIDO2 key), or remove the role. Break-glass accounts should use FIDO2 keys kept offline. Text to paste: 1 admin not covered by MFA. 1 admin without MFA, and 1 whose registration isn't known. What Microsoft 365 can't show: Judged from Conditional Access and Entra ID admin roles. Phishing-resistant MFA for administrators Verdict: Partly Requirement: Administrators sign in with a phishing-resistant method (passkey, FIDO2 key or Windows Hello for Business). - 2 admins without a phishing-resistant method. - annabel.fraser@contoso.example: Global Administrator; signs in with Authenticator app - breakglass@contoso.example: Global Administrator; signs in with no MFA method at all Fix: Have each listed admin register a passkey (in Microsoft Authenticator or on a security key) or Windows Hello for Business, then require the Phishing-resistant MFA authentication strength for admin roles in Conditional Access. Codes and push approvals can be relayed by a fake sign-in page; these can't. Text to paste: 2 admins without a phishing-resistant method. What Microsoft 365 can't show: Judged from the methods each admin has registered. Weak authentication methods not relied on Verdict: Partly Requirement: Text messages and voice calls aren't anyone's only second factor. - 3 people can only use a text or call as a second factor. - rhys.evans@contoso.example: Second factor is only Mobile phone (SMS or call) - sophie.taylor@contoso.example: Second factor is only Mobile phone (SMS or call) - william.allen@contoso.example: Second factor is only Mobile phone (SMS or call) Fix: Ask these people to set up the Microsoft Authenticator app (the registration campaign in the authentication methods policy prompts them at sign-in), then turn off text message and voice call sign-in, or keep them only as a backup. Texts and calls can be intercepted or moved to an attacker's SIM. Text to paste: 3 people can only use a text or call as a second factor. What Microsoft 365 can't show: Judged from Entra ID authentication methods. Legacy authentication blocked Verdict: Pass Requirement: A Conditional Access policy blocks legacy authentication. - Blocked by "CA003 — Block legacy authentication". What Microsoft 365 can't show: Judged from Conditional Access. Users can't consent to apps Verdict: Fail Requirement: User consent to applications is turned off (or limited to verified publishers and low-risk permissions). - Users can consent to any app. - Any user can grant any app access to their mail and files Fix: Set user consent to "Allow user consent for apps from verified publishers, for selected permissions" or turn it off and use the admin consent workflow. Consent phishing relies on this setting. Text to paste: Users can consent to any app. What Microsoft 365 can't show: Judged from Entra ID consent settings. Admin consent workflow on Verdict: Pass Requirement: Users can ask for an app to be approved, and admins review the request. - Users can consent to most apps themselves, so admin consent requests are off (see the user consent check). What Microsoft 365 can't show: Judged from Entra ID consent settings. Users can't register applications Verdict: Fail Requirement: Only admins can register applications. - Any user can register an app. - Users can register apps that nobody reviews Fix: Set "Users can register applications" to No (Entra admin center > Users > User settings) and give the Application Developer role to the people who need it. Text to paste: Any user can register an app. What Microsoft 365 can't show: Judged from Entra ID user settings. Non-admins can't create tenants Verdict: Not collected Requirement: Users who aren't admins can't create new tenants. - Not checked: users can't create new tenants (Microsoft didn't return this setting). What Microsoft 365 can't show: Judged from Entra ID user settings. Guest access to the directory restricted Verdict: Partly Requirement: Guests have limited access to directory objects, and only admins and the Guest Inviter role can invite. - Guests have limited access to directory objects (the default). - Anyone, including guests, can invite guests. - Guests can invite other guests Fix: Restrict guest invitations to admins and the Guest Inviter role, or at least to members, under External collaboration settings. Text to paste: Guests have limited access to directory objects (the default). Anyone, including guests, can invite guests. What Microsoft 365 can't show: Judged from Entra ID external collaboration settings. No joining the tenant by email verification Verdict: Not collected Requirement: People can't join the tenant just by verifying an email address. - Not checked: people can't join the tenant just by verifying an email address (Microsoft didn't return this setting). What Microsoft 365 can't show: Judged from Entra ID authorisation settings. Group creation limited Verdict: Pass Requirement: Only chosen people can create Microsoft 365 groups and teams. - Only admins and members of Group creators can create teams and groups. What Microsoft 365 can't show: Judged from Entra ID group settings. Risky users and sign-ins dealt with Verdict: Not collected Requirement: Entra ID Protection risk is acted on: no account left at risk, no risky sign-in left open. - Not checked: no accounts are at risk in Entra ID Protection (Risky users need Entra ID P2). - Not checked: no risky sign-ins succeeded (Sign-in risk needs Entra ID P2). What Microsoft 365 can't show: Judged from Entra ID Protection (Entra ID P2 for the full detections). Password hash sync on (hybrid) Verdict: Not collected Requirement: Where accounts sync from Active Directory, password hash sync is on so leaked credentials are detected. - Not checked: password hash sync is on (Cloud-only tenant: directory sync isn't turned on). What Microsoft 365 can't show: Judged from Entra Connect; not applicable to cloud-only tenants. EXCHANGE ONLINE (FAIL) Mailbox auditing on Verdict: Pass Requirement: Mailbox auditing is on for every user mailbox. - Mailbox auditing is on for the organisation. What Microsoft 365 can't show: Judged from Exchange Online. All forms of mail forwarding blocked Verdict: Partly Requirement: Automatic forwarding to outside addresses is blocked by policy, and no mailbox or rule forwards out. - The default outbound policy blocks automatic external forwarding. - 3 external forwards. - annabel.fraser@contoso.example: Mailbox forwarding to annabel.fraser@homemail.example (keeps a copy) - annabel.fraser@contoso.example: Inbox rule "Copy to home" forwards to annabel.fraser.home@homemail.example - oliver.hill@contoso.example: Inbox rule "Invoices to bookkeeper" forwards to bookkeeping@ledgerline.example Fix: Remove forwarding to outside addresses unless the client has a documented business reason. Forwarding is the most common way attackers keep reading a mailbox after a password reset. Text to paste: The default outbound policy blocks automatic external forwarding. 3 external forwards. What Microsoft 365 can't show: Judged from the outbound spam policy, mailbox forwarding and inbox rules. No inbox rules hiding mail Verdict: Fail Requirement: Inbox rules that delete, hide or redirect mail are found and reviewed. - 1 suspicious inbox rule. - annabel.fraser@contoso.example: ".": Moves to RSS Feeds mail mentioning invoice, payment; Rule name '.' looks deliberately blank Fix: Check each rule with the mailbox owner. Rules that delete or bury messages about payments or security alerts are a sign of a compromised account: reset the password, revoke sessions and review sign-ins. Text to paste: 1 suspicious inbox rule. What Microsoft 365 can't show: Judged from Exchange Online inbox rules. SMTP AUTH disabled Verdict: Fail Requirement: Authenticated SMTP is turned off for the organisation. - SMTP AUTH is on for the organisation. - SMTP AUTH is allowed Fix: Turn off SMTP AUTH for the organisation and enable it only on the mailboxes of devices or apps that still need it, such as scanners. It accepts passwords without MFA. Text to paste: SMTP AUTH is on for the organisation. What Microsoft 365 can't show: Judged from Exchange Online transport settings. SPF records published Verdict: Partly Requirement: Every mail domain publishes an SPF record. - 1 domain with SPF problems. - parked.example: Doesn't receive mail but has no "v=spf1 -all" record to stop spoofing Fix: Publish one SPF record per domain ending in -all (or ~all while testing), e.g. "v=spf1 include:spf.protection.outlook.com -all". Domains that never send mail should publish "v=spf1 -all". Text to paste: 1 domain with SPF problems. What Microsoft 365 can't show: Judged from public DNS. DKIM enabled Verdict: Partly Requirement: DKIM signing is on for every mail domain. - 1 mail domain without DKIM. - contoso.example: Microsoft 365 DKIM isn't set up (selector2 CNAME missing) Fix: Turn on DKIM for each domain in the Defender portal (Email authentication settings > DKIM), publishing the two selector CNAME records it shows. This applies to domains behind a mail gateway too when Microsoft 365 still sends for them (their SPF includes spf.protection.outlook.com); a gateway signs only the mail that goes out through it. Text to paste: 1 mail domain without DKIM. What Microsoft 365 can't show: Judged from Exchange Online and public DNS. DMARC published and enforced Verdict: Partly Requirement: Every domain publishes a DMARC record with a quarantine or reject policy. - 2 domains without DMARC enforcement. - contoso.example: DMARC is monitor-only (p=none); spoofed mail is still delivered - parked.example: Doesn't receive mail but has no DMARC p=reject record Fix: Publish a DMARC record with a rua= reporting address, start at p=none to see who sends as the domain, then move to p=quarantine and p=reject. Without enforcement, spoofed mail from the domain is delivered. Text to paste: 2 domains without DMARC enforcement. What Microsoft 365 can't show: Judged from public DNS. SHAREPOINT, ONEDRIVE AND TEAMS (FAIL) External sharing restricted Verdict: Partly Requirement: SharePoint and OneDrive sharing doesn't allow anyone links. - Anyone, including anonymous links. - SharePoint and OneDrive: Anyone links are allowed Fix: Change SharePoint external sharing to "New and existing guests" so every external person signs in. If the client relies on Anyone links, set them to expire and to view-only. Text to paste: Anyone, including anonymous links. What Microsoft 365 can't show: Judged from SharePoint tenant settings. No anyone links in use Verdict: Fail Requirement: No files or folders are shared with anyone who has the link. - 3 files and folders shared with anyone. - Campaign video.mp4 (Marketing / Documents): Anyone can edit - Brand assets (Marketing / Documents): Anyone can view, link never expires - holiday.jpg (OneDrive of annabel.fraser@contoso.example): Anyone can view Fix: Remove anyone links that are no longer needed, and set the rest to view-only with an expiry date. The Shared files report lists each one. Text to paste: 3 files and folders shared with anyone. What Microsoft 365 can't show: Judged from SharePoint and OneDrive sharing links. Guest users reviewed Verdict: Pass Requirement: Guest accounts are reviewed, and invitations nobody accepted are removed. - No stale guest invitations. Text to paste: Guest and external user accounts are not reviewed regularly. 1 guest account: 1 guest inactive for 90+ days or never signed in (g#EXT#@contoso.example). What Microsoft 365 can't show: Judged from Entra ID guests and their invitation state. Every group and team has an owner Verdict: Partly Requirement: Microsoft 365 groups and teams have owners who answer for their membership and content. - Unused teams and groups expire after 365 days. - 4 teams and groups without an owner. - Project Phoenix: Team, only owner is disabled (Bobby Marsh) - Marketing: Microsoft 365 group, only owner is disabled (Bobby Marsh) - Marketing: Microsoft 365 group, no owner - Provisioned: Microsoft 365 group, owned only by an app (Provisioning app) Fix: Make an active person, ideally two, an owner of each listed team or group (Teams admin center or Microsoft 365 admin center > Teams & groups). Owners approve members and guests and renew the group; without one, nobody looks after its files and conversations. The ownerless group policy (Microsoft 365 admin center > Settings > Org settings > Microsoft 365 Groups) asks members to take over when the last owner leaves. Text to paste: Unused teams and groups expire after 365 days. 4 teams and groups without an owner. What Microsoft 365 can't show: Judged from Entra ID groups. INTUNE AND DEVICES (FAIL) Devices enrolled and compliant Verdict: Partly Requirement: Company computers are managed by Intune, check in, and meet the compliance policies. - 1 of 20 joined computers not in Intune. - DESK-RECEPTION: Hybrid joined, not managed by Intune - 3 of 20 managed devices not compliant. - DESK-WILSON12 (olivia.wilson@contoso.example): Not compliant - LAPTOP-HILL07 (oliver.hill@contoso.example): Not compliant - LAPTOP-MARSH (bobby.marsh@contoso.example): Not compliant - 2 devices haven't checked in for 30+ days. - DESK-WILSON12 (olivia.wilson@contoso.example): Last check-in 38 days ago - LAPTOP-MARSH (bobby.marsh@contoso.example): Last check-in 45 days ago Fix: Enrol Entra-joined and hybrid-joined computers in Intune (automatic enrolment under Devices > Enrollment > Windows) so compliance, encryption and updates can be enforced on them. Text to paste: 1 of 20 joined computers not in Intune. 3 of 20 managed devices not compliant. 2 devices haven't checked in for 30+ days. What Microsoft 365 can't show: Judged from Intune and Entra ID. Disks encrypted Verdict: Fail Requirement: Company computers are encrypted. - 2 of 19 computers not encrypted. - LAPTOP-HILL07 (oliver.hill@contoso.example): Windows disk isn't encrypted - LAPTOP-MARSH (bobby.marsh@contoso.example): Windows disk isn't encrypted Fix: Turn on BitLocker (Windows) and FileVault (macOS) with an Intune disk encryption policy, with recovery keys escrowed to Entra ID, so a lost or stolen laptop doesn't expose the client's data. Text to paste: 2 of 19 computers not encrypted. What Microsoft 365 can't show: Judged from Intune. Supported operating systems Verdict: Fail Requirement: Windows computers run a version that still gets security updates. - 3 of 19 Windows computers past end of support. - LAPTOP-CLARK13 (william.clark@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-JOHNSON04 (jacob.johnson@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - LAPTOP-MARSH (bobby.marsh@contoso.example): Windows 10 stopped getting security updates on 14 Oct 2025. Extended Security Updates or LTSC can cover it; otherwise upgrade. - DESK-SMITH03 (megan.smith@contoso.example): Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. - DESK-WILSON12 (olivia.wilson@contoso.example): Windows 11 24H2: updates for Home and Pro end 13 Oct 2026. - and 6 more Fix: Upgrade computers on Windows 10 or an old Windows 11 release to the current Windows 11 release (Intune: Windows feature updates policy). Replace hardware that can't run Windows 11, or buy Extended Security Updates as a stopgap. Text to paste: 3 of 19 Windows computers past end of support. What Microsoft 365 can't show: Judged from the Windows versions Intune reports. ABOUT THIS EVIDENCE This is a subset of the benchmark: the recommendations Office Sentry can judge from read-only data. A Pass is evidence for that recommendation; the rest of the benchmark still needs checking in the admin centres. Requirements: CIS Microsoft 365 Foundations Benchmark, recommendations matched by title. Recommendations paraphrased from the CIS Microsoft 365 Foundations Benchmark. CIS renumbers them between versions, so match each one by its title in the version you're auditing against. Defender, Purview and Teams meeting settings Office Sentry doesn't read are left out rather than guessed. Pass and Fail are judged from Microsoft 365 settings and accounts read with read-only access; nothing was changed. Answers marked [in brackets] still need completing.