Check catalog
658 checks, every one backed by golden fixtures: 1,928 fixtures, 0 failures on the run that gated module v2.55.0.
By platform
Active Directory (211 checks)
AD ACL & Delegation (16)
- ADACL-001: Critical Object ACL Audit Critical
- ADACL-002: GenericAll Permissions on Critical Objects Critical
- ADACL-003: GenericWrite Permissions on Critical Objects High
- ADACL-004: WriteDACL Permissions on Critical Objects Critical
- ADACL-005: WriteOwner Permissions on Critical Objects Critical
- ADACL-006: ForceChangePassword Rights High
- ADACL-007: Excessive Delegation to Broad Groups Critical
- ADACL-008: OU Delegation Analysis Medium
- ADACL-009: Machine Account Quota High
- ADACL-010: Extended Rights Audit Critical
- ADACL-011: Ownership of Critical Objects High
- ADACL-012: Non-Default Domain Root Permissions High
- ADACL-013: GPO Link Permissions High
- ADACL-014: GPO Edit Permissions High
- ADACL-015: Shadow Admins Detection Critical
- ADACL-016: Attack Path Enumeration Critical
AD Certificate Services (19)
- ADCS-001: CA Server Inventory Info
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name Critical
- ADCS-003: ESC2 - Any Purpose Extended Key Usage Critical
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1 High
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2 High
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs Critical
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership Critical
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs High
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag Critical
- ADCS-010: ESC7 - Vulnerable CA ACLs Critical
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints Critical
- ADCS-012: ESC9 - No Security Extension High
- ADCS-013: ESC11 - RPC Relay Without Encryption High
- ADCS-014: ESC13 - Issuance Policy OID Group Link High
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates Medium
- ADCS-016: ESC16 - UPN SAN Misconfiguration High
- ADCS-017: EKEUwu - Extended Key Usage Abuse High
- ADCS-018: CA Auditing Configuration High
- ADCS-019: Certificate Template Enumeration Info
AD Domain & Forest Configuration (20)
- ADDOM-001: Forest Functional Level High
- ADDOM-002: Domain Functional Level High
- ADDOM-003: Schema Version Identification Medium
- ADDOM-004: Domain Controller Inventory High
- ADDOM-005: Obsolete OS on Domain Controllers Critical
- ADDOM-006: FSMO Role Holder Identification Info
- ADDOM-007: AD Replication Health High
- ADDOM-008: Tombstone Lifetime Configuration Medium
- ADDOM-009: AD Recycle Bin Status Medium
- ADDOM-010: Sites and Subnets Configuration Medium
- ADDOM-011: Site Link Configuration Low
- ADDOM-012: DNS Zone Security High
- ADDOM-013: LDAP Signing Requirements Critical
- ADDOM-014: LDAP Channel Binding High
- ADDOM-015: SMB Signing Requirements Critical
- ADDOM-016: NTLMv1 Usage Detection Critical
- ADDOM-017: NTLMv2 Enforcement High
- ADDOM-018: Null Session Enumeration High
- ADDOM-019: Print Spooler on Domain Controllers High
- ADDOM-020: DSRM Password Configuration Medium
AD Group Policy (24)
- ADGPO-001: GPO Inventory with Link Status Info
- ADGPO-002: Empty GPOs Low
- ADGPO-003: Unlinked GPOs Low
- ADGPO-004: Disabled GPOs with Content Low
- ADGPO-005: Duplicated GPOs Low
- ADGPO-006: GPOs with Broken Links Medium
- ADGPO-007: GPO Permission Inconsistencies High
- ADGPO-008: GPOs Not Applied Due to WMI Filters Medium
- ADGPO-009: GPOs with No Apply Permission Medium
- ADGPO-010: SYSVOL/AD GPO Version Mismatch Medium
- ADGPO-011: GPO Settings Security Analysis High
- ADGPO-012: cPassword/GPP Password Detection Critical
- ADGPO-013: Scripts in GPOs Analysis High
- ADGPO-014: MSI Packages in GPOs Medium
- ADGPO-015: Scheduled Tasks in GPOs High
- ADGPO-016: Registry Settings Security Review Medium
- ADGPO-017: Restricted Groups Analysis High
- ADGPO-018: Audit Policy Configuration via GPO High
- ADGPO-019: Windows Firewall Configuration via GPO Medium
- ADGPO-020: PowerShell Execution Policy via GPO Medium
- ADGPO-021: PowerShell Logging Configuration High
- ADGPO-022: AppLocker/WDAC Policy Assessment Medium
- ADGPO-023: LAPS GPO Configuration High
- ADGPO-024: GPO WMI Filter Review Low
AD Kerberos Security (11)
- ADKERB-001: Kerberoastable Accounts High
- ADKERB-002: Kerberoastable with Weak Encryption Critical
- ADKERB-003: AS-REP Roastable Accounts High
- ADKERB-004: Unconstrained Delegation - Computers Critical
- ADKERB-005: Unconstrained Delegation - Users Critical
- ADKERB-006: Constrained Delegation Analysis High
- ADKERB-007: Resource-Based Constrained Delegation High
- ADKERB-008: Protocol Transition Abuse Paths High
- ADKERB-009: Kerberos Encryption Types High
- ADKERB-010: Kerberos Ticket Lifetime Medium
- ADKERB-011: Computer SPN Audit Info
AD Logging & EDR Posture (7)
- ADLOG-001: Advanced Audit Policy Configured High
- ADLOG-002: PowerShell Script Block Logging Enabled High
- ADLOG-003: PowerShell Module Logging Enabled Medium
- ADLOG-004: Process Creation Auditing with Command Line High
- ADLOG-005: Microsoft Defender Tamper Protection Policy High
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager High
- ADLOG-007: Sysmon Deployment Indicator Medium
AD Network & Relay Preconditions (10)
- ADNET-001: LDAP Signing Required on Domain Controllers Critical
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers High
- ADNET-003: SMB Server Signing Required (Domain Policy) Critical
- ADNET-004: SMB Client Signing Required (Domain Policy) High
- ADNET-005: LLMNR Disabled by Domain Policy High
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed Medium
- ADNET-007: IPv6 mitm6 Mitigation Posture High
- ADNET-008: WPAD Auto-Discovery Disabled Medium
- ADNET-009: Print Spooler Service on Domain Controllers Critical
- ADNET-010: WebClient Service Default State on Workstations High
Attack Paths (2)
AD Privileged Account Security (30)
- ADPRIV-001: Domain Admins Enumeration Critical
- ADPRIV-002: Enterprise Admins Enumeration Critical
- ADPRIV-003: Schema Admins Enumeration High
- ADPRIV-004: Account Operators Enumeration High
- ADPRIV-005: Server Operators Enumeration High
- ADPRIV-006: Backup Operators Enumeration High
- ADPRIV-007: Print Operators Enumeration Medium
- ADPRIV-008: DnsAdmins Group Membership High
- ADPRIV-009: Nested Group Membership Analysis High
- ADPRIV-010: Privileged Users Password Never Expires Critical
- ADPRIV-011: Privileged Users Password Not Required Critical
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth Critical
- ADPRIV-013: Privileged Users Reversible Encryption Critical
- ADPRIV-014: Privileged Users DES-Only Kerberos High
- ADPRIV-015: Privileged Accounts No MFA Indicator High
- ADPRIV-016: Privileged Accounts Weak Passwords Critical
- ADPRIV-017: Privileged Accounts Old Passwords High
- ADPRIV-018: Privileged Accounts Never Logged In Medium
- ADPRIV-019: Disabled Accounts in Privileged Groups High
- ADPRIV-020: AdminSDHolder Protected Object Audit Critical
- ADPRIV-021: AdminCount Orphans Medium
- ADPRIV-022: krbtgt Password Age Critical
- ADPRIV-023: krbtgt Account Exposure Assessment Critical
- ADPRIV-024: Service Accounts in Privileged Groups High
- ADPRIV-025: Computer Accounts in Privileged Groups High
- ADPRIV-026: Privileged Users Local Logon on DCs High
- ADPRIV-027: Privileged Users RDP on DCs High
- ADPRIV-028: Users with DCSync Rights Critical
- ADPRIV-029: Protected Users Group Audit High
- ADPRIV-030: Privileged Users Not in Protected Users High
AD Password & Lockout Policies (22)
- ADPWD-001: Default Domain Password Policy High
- ADPWD-002: Fine-Grained Password Policy Enumeration Medium
- ADPWD-003: FGPP Application Analysis Medium
- ADPWD-004: Minimum Password Length High
- ADPWD-005: Password Complexity Requirement High
- ADPWD-006: Account Lockout Policy High
- ADPWD-007: Password History Enforcement Medium
- ADPWD-008: Maximum Password Age Medium
- ADPWD-009: Users with Password Never Expires High
- ADPWD-010: Users with Blank Passwords Critical
- ADPWD-011: Duplicate Password Hashes High
- ADPWD-012: Passwords in HaveIBeenPwned Database High
- ADPWD-013: Custom Dictionary Password Check Medium
- ADPWD-014: Default/Common Passwords High
- ADPWD-015: Password Last Set Age Distribution Medium
- ADPWD-016: LAPS Deployment Status High
- ADPWD-017: LAPS Password Expiration Medium
- ADPWD-018: Windows LAPS vs Legacy LAPS Low
- ADPWD-019: Azure AD Password Protection Medium
- ADPWD-020: BitLocker Recovery Keys in AD Info
- ADPWD-021: Account Lockout Threshold High
- ADPWD-022: Lockout Observation Window Medium
AD Logon Scripts & Network Shares (11)
- ADSCRIPT-001: NETLOGON Share Permissions High
- ADSCRIPT-002: SYSVOL Share Permissions High
- ADSCRIPT-003: Logon Script Inventory Info
- ADSCRIPT-004: Hardcoded Credentials in Scripts Critical
- ADSCRIPT-005: LOLBins Usage in Scripts High
- ADSCRIPT-006: Plaintext Passwords in Scripts Critical
- ADSCRIPT-007: World-Writable Script Permissions Critical
- ADSCRIPT-008: External Resource References High
- ADSCRIPT-009: Malformed Scripts Medium
- ADSCRIPT-010: UNC Paths to Non-DC Locations High
- ADSCRIPT-011: Script Content Analysis Medium
AD Stale & Obsolete Objects (11)
- ADSTALE-001: Inactive User Accounts Medium
- ADSTALE-002: Inactive Computer Accounts Medium
- ADSTALE-003: Disabled Accounts with Group Memberships Medium
- ADSTALE-004: Expired Passwords Not Disabled Medium
- ADSTALE-005: Obsolete OS Computers High
- ADSTALE-006: Unsupported OS Versions High
- ADSTALE-007: Orphaned Foreign Security Principals Medium
- ADSTALE-008: Orphaned SID History Medium
- ADSTALE-009: Abandoned OUs Low
- ADSTALE-010: Printer Objects Low
- ADSTALE-011: DNS Record Staleness Medium
Tier-0 Hygiene & Hybrid Identity Surface (7)
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit Critical
- ADTIER-002: Backup Software Service Accounts in Privileged Groups Critical
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups High
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups Critical
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups High
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU High
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group High
AD Adversary Tradecraft Indicators (10)
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL Critical
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers) High
- ADTRADE-003: Stale BitLocker Recovery Keys Medium
- ADTRADE-004: RODC Password Replication Policy Hygiene High
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation High
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals Critical
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface Critical
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership High
- ADTRADE-009: Cert Publishers Group Membership High
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure High
AD Trust Relationships (11)
- ADTRUST-001: Trust Relationships Enumeration Info
- ADTRUST-002: Trust Direction Analysis Medium
- ADTRUST-003: Trust Transitivity Analysis Medium
- ADTRUST-004: SID Filtering Status Critical
- ADTRUST-005: SID History Abuse Detection Critical
- ADTRUST-006: Selective Authentication Status High
- ADTRUST-007: Azure AD Hybrid Trust Security Medium
- ADTRUST-008: Foreign Domain Trust Enumeration Medium
- ADTRUST-009: Orphaned Trust Detection Medium
- ADTRUST-010: Trust Key Age and Rotation High
- ADTRUST-011: Trust Hierarchy Visualization Info
Google Workspace (190 checks)
Admin & User Management (25)
- ADMIN-001: Super Admin Account Inventory Critical
- ADMIN-002: Admin Role Assignments Audit High
- ADMIN-003: Delegated Admin Permissions Review Medium
- ADMIN-004: Inactive/Suspended Admin Accounts High
- ADMIN-005: User Account Inventory Medium
- ADMIN-006: Stale User Accounts Medium
- ADMIN-007: OU Structure Review Low
- ADMIN-008: Directory Sharing Settings Medium
- ADMIN-009: User Profile Visibility Low
- ADMIN-010: Groups Settings and External Membership High
- ADMIN-011: Group Creation Restrictions Medium
- ADMIN-012: Groups for Business Settings Medium
- ADMIN-013: Super Admin Count High
- ADMIN-014: Assured Controls - Access Approvals Enabled Medium
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff Medium
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled Medium
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3) Medium
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1) Low
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2) Low
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4) High
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1) Medium
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2) Medium
- ADMIN-023: Super admin count within the supported range (GWS.COMMONCONTROLS.6.2) High
- ADMIN-024: Marketplace apps limited to an allowlist (GWS.COMMONCONTROLS.11.1) High
- ADMIN-025: Multi-party approval required for sensitive admin actions (GWS.COMMONCONTROLS.17.1) Medium
Authentication & Access Controls (19)
- AUTH-001: 2SV Enforcement Critical
- AUTH-002: 2SV Enrollment Rate High
- AUTH-003: 2SV Method Strength Medium
- AUTH-004: Password Minimum Length High
- AUTH-005: Password Reuse Restriction Medium
- AUTH-006: Session Duration Medium
- AUTH-007: SSO Configuration Medium
- AUTH-008: Less Secure Apps Access High
- AUTH-009: App Passwords Policy Medium
- AUTH-010: Recovery Options Configuration High
- AUTH-011: Login Challenge Settings Medium
- AUTH-012: Super Admin 2SV Enrollment Critical
- AUTH-013: Stale Super Admin Accounts High
- AUTH-014: 2SV Enrollment Allowed Medium
- AUTH-015: 2SV Enrollment Grace Period Low
- AUTH-016: Advanced Protection Self-Enrollment Low
- AUTH-017: Super Admin Account Self-Recovery High
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2) Medium
- AUTH-019: Conflicting unmanaged accounts replaced (GWS.COMMONCONTROLS.7.1) Medium
Collaboration (25)
- COLLAB-001: Meet Recording Settings Medium
- COLLAB-002: Meet External Participant Settings Medium
- COLLAB-003: Meet Anonymous Join Settings Medium
- COLLAB-004: Chat External Communication High
- COLLAB-005: Chat History Settings Medium
- COLLAB-006: Chat Spaces External Access Medium
- COLLAB-007: Chat App Installation Settings Low
- COLLAB-008: Calendar External Sharing High
- COLLAB-009: Calendar External Invitations Medium
- COLLAB-010: Calendar Appointment Slots External Visibility Low
- COLLAB-011: Meet External Participant Labeling Low
- COLLAB-012: Meet Host Management Medium
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1) High
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1) Low
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1) High
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2) Low
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1) Low
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1) Low
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1) Low
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1) High
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2) Medium
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3) Medium
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1) Low
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1) Low
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1) Low
Device & Endpoint Management (11)
- DEVICE-001: MDM Policy Audit High
- DEVICE-002: Device Approval Requirements High
- DEVICE-003: Screen Lock Enforcement High
- DEVICE-004: Device Encryption Requirements High
- DEVICE-005: Compromised Device Blocking High
- DEVICE-006: Jailbroken/Rooted Device Policy High
- DEVICE-007: Chrome Browser Management Medium
- DEVICE-008: Chrome Extension Whitelist/Blocklist High
- DEVICE-009: Chrome OS Device Policies Medium
- DEVICE-010: Endpoint Verification Settings Medium
- DEVICE-011: Company-Owned Device Inventory Low
Drive Security & Data Protection (23)
- DRIVE-001: External Sharing Defaults High
- DRIVE-002: Link Sharing Default Settings High
- DRIVE-003: Anyone With the Link Sharing Audit High
- DRIVE-004: Shared Drive Creation Restrictions Medium
- DRIVE-005: Shared Drive Member Management Medium
- DRIVE-006: Shared Drive External Sharing High
- DRIVE-007: File Ownership Transfer Settings Medium
- DRIVE-008: Drive for Desktop Allowed/Blocked Medium
- DRIVE-009: Third-Party App Drive Access High
- DRIVE-010: Drive DLP Rules Audit Medium
- DRIVE-011: Target Audience Settings Medium
- DRIVE-012: Drive Add-ons Settings Low
- DRIVE-013: Offline Access Settings Medium
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1) High
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9) Low
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1) Medium
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8) Medium
- DRIVE-018: Shared Drive External-Sharing Exposure High
- DRIVE-019: External-sharing warning enabled (GWS.DRIVEDOCS.1.3) Medium
- DRIVE-020: Sharing with non-Google accounts disabled (GWS.DRIVEDOCS.1.4) Medium
- DRIVE-021: Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5) High
- DRIVE-022: Content distribution to outside shared drives blocked (GWS.DRIVEDOCS.1.7) Medium
- DRIVE-023: Drive for Desktop limited to authorized devices (GWS.DRIVEDOCS.5.1) High
Advanced Threat Protection (36)
- EMAIL-001: SPF Record Validation Critical
- EMAIL-002: DKIM Signing Enabled Critical
- EMAIL-003: DMARC Policy Audit Critical
- EMAIL-004: MTA-STS Policy Medium
- EMAIL-005: TLS Enforcement High
- EMAIL-006: Email Allowlist/Blocklist Review Medium
- EMAIL-007: Inbound Gateway Configuration Medium
- EMAIL-008: Email Routing Rules Audit Medium
- EMAIL-009: Auto-Forwarding Policy High
- EMAIL-010: Delegate Access Settings Medium
- EMAIL-011: POP/IMAP Access Settings High
- EMAIL-012: Spam and Phishing Filter Settings High
- EMAIL-013: Enhanced Pre-Delivery Message Scanning High
- EMAIL-014: External Recipient Warning Medium
- EMAIL-015: Attachment Safety Settings High
- EMAIL-016: Links and External Images Protection High
- EMAIL-017: Spoofing and Authentication Protection Critical
- EMAIL-018: Compliance Rules Audit Medium
- EMAIL-019: DLP Rules Configuration Medium
- EMAIL-020: Gmail Confidential Mode Low
- EMAIL-021: S/MIME Settings Low
- EMAIL-022: Mail Forwarding Rule Enumeration High
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1) Medium
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1) Medium
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1) Medium
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1) High
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1) Low
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1) Low
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1) Low
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1) Medium
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1) Medium
- EMAIL-032: Comprehensive mail storage enabled (GWS.GMAIL.17.1) Medium
- EMAIL-033: Unsafe attachments are not left in the inbox (GWS.GMAIL.5.5) High
- EMAIL-034: Spoofed and unauthenticated mail is not left in the inbox (GWS.GMAIL.7.6) High
- EMAIL-035: No domains bypass spam filtering and warnings (GWS.GMAIL.18.2) High
- EMAIL-036: Spam filter bypass not enabled for all senders (GWS.GMAIL.18.3) High
Adversary Tradecraft (7)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure Critical
- GTRADE-002: Internet-Readable Google Groups High
- GTRADE-003: Open-Join / External-Member Groups Medium
- GTRADE-004: Super-Admin Sprawl Medium
- GTRADE-005: Super-Admin-Equivalent Custom Roles Medium
- GTRADE-006: Persistent / Over-Scoped OAuth Grants High
- GTRADE-007: Admin Role Granted Through a Group High
Gemini for Workspace (12)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes Medium
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join Medium
- GWS-CLASS-003: Classroom API Data Access Restricted Medium
- GWS-CLASS-004: Classroom Roster Import Disabled Low
- GWS-CLASS-005: Classroom Student Unenrollment Restricted Low
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers Medium
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users Medium
- GWS-GEMINI-002: Gemini Alpha Features Disabled Low
- GWS-GEMINI-003: Gemini Conversation History Enabled Low
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months Low
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled Medium
- GWS-SITES-001: Sites Service Disabled Low
K12 Baseline (15)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff Medium
- GWS-K12-002: Student External Drive Sharing Restricted High
- GWS-K12-003: Students Cannot Authorize Third-Party Apps High
- GWS-K12-004: Vendor Delegated Access Review High
- GWS-K12-005: Delegated Admin Least Privilege High
- GWS-K12-006: Student Communication Boundaries High
- GWS-K12-007: Guardian Access Integrity Medium
- GWS-K12-008: Managed Student Chromebook Posture Medium
- GWS-K12-009: Departed Student Account Disposition Medium
- GWS-K12-010: Student Account Security Floor High
- GWS-K12-011: Student Auto-Forwarding Disabled Medium
- GWS-K12-012: Student Data Export (Takeout) Disabled Medium
- GWS-K12-013: Legacy Authentication Disabled For Students High
- GWS-K12-014: Vault Export And Retention Privileges Restricted High
- GWS-K12-015: Audit Logging License Coverage Medium
Logging, Alerting & Monitoring (7)
- LOG-001: Audit Log Retention Settings High
- LOG-002: Alert Center Rules Inventory High
- LOG-003: Activity Rules Coverage Analysis Medium
- LOG-004: Data Export Settings Medium
- LOG-005: Admin Email Alerts Configuration Medium
- LOG-006: Reporting API Access Low
- LOG-007: System-defined alerting rules all enabled (GWS.COMMONCONTROLS.13.1) High
OAuth & API Security (10)
- OAUTH-001: OAuth App Whitelist/Blocklist High
- OAUTH-002: Installed OAuth Apps Inventory High
- OAUTH-003: OAuth Scope Analysis Critical
- OAUTH-004: OAuth App Risk Scoring High
- OAUTH-005: Unverified App Access Policy High
- OAUTH-006: API Access Control Medium
- OAUTH-007: Marketplace App Installation Restrictions Medium
- OAUTH-008: Domain-Wide Delegation Grants Audit Critical
- OAUTH-009: Service Account Key Enumeration High
- OAUTH-010: Connected Apps With Sensitive Scopes High
Entra ID / M365 (257 checks)
AI Agent Governance (4)
Azure IAM & Resource Security (10)
- AZIAM-001: Subscription-level role assignments audit High
- AZIAM-002: Users with Azure IAM roles directly on resources Medium
- AZIAM-003: Resource group permission analysis Medium
- AZIAM-004: Azure Key Vault access policy audit High
- AZIAM-005: Storage account security settings High
- AZIAM-006: Network Security Group rules audit High
- AZIAM-007: Azure Policy compliance status Medium
- AZIAM-008: Management group structure review Info
- AZIAM-009: Custom RBAC role definitions Medium
- AZIAM-010: Resource locks configuration Medium
Consent (20)
- EIDAPP-001: Application Registration Inventory Info
- EIDAPP-002: App Registrations with High-Risk API Permissions Critical
- EIDAPP-003: App Registrations with Added Credentials High
- EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials Critical
- EIDAPP-005: Service Principals with High Privileges and Added Credentials Critical
- EIDAPP-006: Excessive Microsoft Graph Permissions High
- EIDAPP-007: App Registrations with Azure IAM Role Assignments High
- EIDAPP-008: Credential Expiration Monitoring Medium
- EIDAPP-009: Stale Application Registrations Medium
- EIDAPP-010: Multi-Tenant Application Analysis Medium
- EIDAPP-011: Consent Grants Analysis High
- EIDAPP-012: User Consent Settings Policy High
- EIDAPP-013: Admin Consent Workflow Configuration Medium
- EIDAPP-014: Application Impersonation Role Holders Critical
- EIDAPP-015: OAuth2 Permission Grants Review High
- EIDAPP-016: Managed Identity Inventory and Permissions Info
- EIDAPP-017: Service Principal Sign-In Activity Info
- EIDAPP-018: Change Tracking on App Registrations and Service Principals Medium
- EIDAPP-019: Dangling Reply URLs High
- EIDAPP-020: Group Owner Consent to Applications Blocked Medium
Entra ID Authentication Methods & MFA (18)
- EIDAUTH-001: Authentication Methods Policy Audit Info
- EIDAUTH-002: MFA Registration Status for All Users Critical
- EIDAUTH-003: MFA Method Distribution Analysis Info
- EIDAUTH-004: Users with Only SMS/Voice MFA Methods High
- EIDAUTH-005: Users with No MFA Methods Registered Critical
- EIDAUTH-006: FIDO2 Security Key Inventory and Audit Info
- EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check Critical
- EIDAUTH-008: Passwordless Authentication Readiness Medium
- EIDAUTH-009: Windows Hello for Business Configuration Medium
- EIDAUTH-010: Temporary Access Pass (TAP) Policy Audit Medium
- EIDAUTH-011: Self-Service Password Reset (SSPR) Configuration High
- EIDAUTH-012: SSPR Methods and Requirements Medium
- EIDAUTH-013: Password Protection (Banned Passwords) Configuration High
- EIDAUTH-014: Custom Banned Password List Status Medium
- EIDAUTH-015: Legacy Authentication Protocol Usage High
- EIDAUTH-016: ROPC (Resource Owner Password Credentials) Flow Enabled High
- EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection Medium
- EIDAUTH-018: Microsoft Authenticator Login Context (Application Name and Location) Medium
Entra ID Conditional Access (18)
- EIDCA-001: Full CA Policy Inventory Info
- EIDCA-002: CA Policy Coverage Gap Analysis High
- EIDCA-003: CA Policies in Report-Only Mode Medium
- EIDCA-004: CA Exclusion Group Analysis High
- EIDCA-005: Unprotected Groups in CA Exclusions High
- EIDCA-006: Break-Glass Account CA Exclusion Validation Critical
- EIDCA-007: MFA Enforcement via Conditional Access Critical
- EIDCA-008: Legacy Authentication Blocking via CA Critical
- EIDCA-009: Device Compliance Requirement in CA High
- EIDCA-010: Location-Based CA Policies Audit Medium
- EIDCA-011: Named Locations Configuration Review Medium
- EIDCA-012: Sign-In Risk-Based CA Policies High
- EIDCA-013: User Risk-Based CA Policies High
- EIDCA-014: Session Controls Audit Medium
- EIDCA-015: CA What-If Simulation for Attack Scenarios Info
- EIDCA-016: CA Policy Documentation Export Info
- EIDCA-017: High-Risk User Notification to Administrators Medium
- EIDCA-018: Managed Device Required for MFA Registration Medium
Entra ID Federation & Hybrid Identity (13)
- EIDFED-001: Federated Domain Enumeration Info
- EIDFED-002: Federation Signing Certificate Validity Period High
- EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch Critical
- EIDFED-004: Federation Trust Metadata Analysis High
- EIDFED-005: Azure AD Connect Configuration Review High
- EIDFED-006: Azure AD Connect Sync Scope Audit Medium
- EIDFED-007: Password Hash Sync Enabled Status Medium
- EIDFED-008: Pass-Through Authentication Agent Status Medium
- EIDFED-009: AD FS Server Configuration Assessment High
- EIDFED-010: AD FS Extranet Lockout Settings Medium
- EIDFED-011: Hybrid Join Configuration Medium
- EIDFED-012: Cloud-Only vs Synced Account Analysis Info
- EIDFED-013: Entra Connect Sync-Client Version Currency High
Entitlement Management (5)
- EIDGOV-001: Access-package assignment policies require approval Medium
- EIDGOV-002: Access-package assignment policies enforce access reviews Medium
- EIDGOV-003: Access-package assignments are time-bound Low
- EIDGOV-004: External access-package eligibility is controlled High
- EIDGOV-005: Access-package catalog external visibility reviewed Low
Entra ID Privileged Identity Management (14)
- EIDPIM-001: Global Administrator Enumeration Info
- EIDPIM-002: All Privileged Role Assignments Info
- EIDPIM-003: Permanent Privileged Role Assignments High
- EIDPIM-004: Privileged Role Assignments to Guest Users Critical
- EIDPIM-005: Privileged Role Assignments to Synced Accounts High
- EIDPIM-006: Privileged Users Without MFA Critical
- EIDPIM-007: Privileged Users with Weak Authentication Methods High
- EIDPIM-008: Disabled Accounts in Privileged Roles High
- EIDPIM-009: Accounts Never Signed In with Active Privileged Role Medium
- EIDPIM-010: PIM Configuration Audit High
- EIDPIM-011: PIM Eligible Role Activation History Info
- EIDPIM-012: Emergency Access Account Validation Critical
- EIDPIM-013: Separate Admin Account Enforcement High
- EIDPIM-014: Privileged Role Assignment Notification Settings Medium
EIDSCA Baseline (44)
- EIDSCA-AF01: EIDSCA AF01: Authentication Method - FIDO2 security key - State Medium
- EIDSCA-AF02: EIDSCA AF02: Authentication Method - FIDO2 security key - Allow self-service set up Low
- EIDSCA-AF03: EIDSCA AF03: Authentication Method - FIDO2 security key - Enforce attestation Medium
- EIDSCA-AF04: EIDSCA AF04: Authentication Method - FIDO2 security key - Enforce key restrictions Medium
- EIDSCA-AF05: EIDSCA AF05: Authentication Method - FIDO2 security key - Restricted Low
- EIDSCA-AF06: EIDSCA AF06: Authentication Method - FIDO2 security key - Restrict specific keys Low
- EIDSCA-AG01: EIDSCA AG01: Authentication Method - General Settings - Manage migration Medium
- EIDSCA-AG02: EIDSCA AG02: Authentication Method - General Settings - Report suspicious activity - State Medium
- EIDSCA-AG03: EIDSCA AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups Medium
- EIDSCA-AM01: EIDSCA AM01: Authentication Method - Microsoft Authenticator - State Medium
- EIDSCA-AM02: EIDSCA AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP Medium
- EIDSCA-AM03: EIDSCA AM03: Authentication Method - Microsoft Authenticator - Require number matching for push notifications High
- EIDSCA-AM04: EIDSCA AM04: Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications High
- EIDSCA-AM06: EIDSCA AM06: Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications Medium
- EIDSCA-AM07: EIDSCA AM07: Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications Medium
- EIDSCA-AM09: EIDSCA AM09: Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications Low
- EIDSCA-AM10: EIDSCA AM10: Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications Low
- EIDSCA-AP01: EIDSCA AP01: Default Authorization Settings - Enabled Self service password reset for administrators High
- EIDSCA-AP04: EIDSCA AP04: Default Authorization Settings - Guest invite restrictions High
- EIDSCA-AP05: EIDSCA AP05: Default Authorization Settings - Sign-up for email based subscription Medium
- EIDSCA-AP06: EIDSCA AP06: Default Authorization Settings - User can join the tenant by email validation Medium
- EIDSCA-AP07: EIDSCA AP07: Default Authorization Settings - Guest user access High
- EIDSCA-AP08: EIDSCA AP08: Default Authorization Settings - User consent policy assigned for applications High
- EIDSCA-AP09: EIDSCA AP09: Default Authorization Settings - Allow user consent on risk-based apps High
- EIDSCA-AP10: EIDSCA AP10: Default Authorization Settings - Default User Role Permissions - Allowed to create Apps Medium
- EIDSCA-AP14: EIDSCA AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users Low
- EIDSCA-AS04: EIDSCA AS04: Authentication Method - SMS - Use for sign-in High
- EIDSCA-AT01: EIDSCA AT01: Authentication Method - Temporary Access Pass - State Low
- EIDSCA-AT02: EIDSCA AT02: Authentication Method - Temporary Access Pass - One-time Medium
- EIDSCA-AV01: EIDSCA AV01: Authentication Method - Voice call - State Medium
- EIDSCA-CP01: EIDSCA CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data High
- EIDSCA-CP03: EIDSCA CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps High
- EIDSCA-CP04: EIDSCA CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to Medium
- EIDSCA-CR01: EIDSCA CR01: Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature Medium
- EIDSCA-CR02: EIDSCA CR02: Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests Low
- EIDSCA-CR03: EIDSCA CR03: Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire Low
- EIDSCA-CR04: EIDSCA CR04: Consent Framework - Admin Consent Request - Consent request duration (days) Low
- EIDSCA-PR01: EIDSCA PR01: Default Settings - Password Rule Settings - Password Protection - Mode Medium
- EIDSCA-PR02: EIDSCA PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory Medium
- EIDSCA-PR03: EIDSCA PR03: Default Settings - Password Rule Settings - Enforce custom list High
- EIDSCA-PR05: EIDSCA PR05: Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds Medium
- EIDSCA-PR06: EIDSCA PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold High
- EIDSCA-ST08: EIDSCA ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner Medium
- EIDSCA-ST09: EIDSCA ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content High
Entra ID Tenant Configuration (16)
- EIDTNT-001: Tenant-Wide Settings Export Info
- EIDTNT-002: User Settings Review High
- EIDTNT-003: Guest User Access Restrictions High
- EIDTNT-004: Guest Invitation Restrictions Medium
- EIDTNT-005: External Collaboration Settings High
- EIDTNT-006: Azure B2B Cross-Tenant Access Policies High
- EIDTNT-007: Security Defaults Enabled/Disabled Status Critical
- EIDTNT-008: License Inventory and Utilization Info
- EIDTNT-009: Administrative Unit Configuration Info
- EIDTNT-010: Custom Domain Configuration Info
- EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs High
- EIDTNT-012: Audit Log Retention Settings High
- EIDTNT-013: Notification Settings Audit Medium
- EIDTNT-014: User Password Expiration Disabled (Passwords Never Expire) Low
- EIDTNT-015: Privileged Partner Delegated Admin Access (GDAP) High
- EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP) Medium
Intune / Endpoint Management (23)
- INTUNE-001: Device compliance policy inventory Info
- INTUNE-002: Device compliance status overview High
- INTUNE-003: Non-compliant device enumeration High
- INTUNE-004: Configuration profile inventory Info
- INTUNE-005: Configuration profile assignment analysis Medium
- INTUNE-006: Windows Update for Business ring configuration High
- INTUNE-007: BitLocker encryption policy audit High
- INTUNE-008: Windows Defender/Antivirus policy audit Critical
- INTUNE-009: Attack Surface Reduction rules configuration High
- INTUNE-010: Endpoint Detection and Response configuration Critical
- INTUNE-011: Application protection policies (MAM) High
- INTUNE-012: Conditional launch settings Medium
- INTUNE-013: Device enrollment restrictions Medium
- INTUNE-014: Autopilot configuration Info
- INTUNE-015: Disk encryption status High
- INTUNE-016: Firewall policy configuration High
- INTUNE-017: Security baselines compliance High
- INTUNE-018: PowerShell script deployment audit Critical
- INTUNE-019: Win32 app deployment security review Medium
- INTUNE-020: Device categories and grouping Info
- INTUNE-021: Remote actions audit (wipe, retire, lock) High
- INTUNE-022: OneDrive sync restrictions Medium
- INTUNE-023: Multi-admin approval for destructive device actions Critical
Unified Audit & Logging (3)
Defender for Office 365 (3)
Advanced Threat Protection (50)
- M365EXO-001: Anti-spam policy audit High
- M365EXO-002: Anti-phishing policy audit High
- M365EXO-003: Anti-malware policy audit High
- M365EXO-004: Safe Attachments policy High
- M365EXO-005: Safe Links policy High
- M365EXO-006: DKIM/DMARC/SPF validation Critical
- M365EXO-007: Auto-forwarding policy Critical
- M365EXO-008: Transport rules inventory and analysis Medium
- M365EXO-009: Mailbox auditing enabled High
- M365EXO-010: External sender warnings Medium
- M365EXO-011: OAuth/SMTP AUTH per-mailbox audit High
- M365EXO-012: Remote domains auto-forward setting High
- M365EXO-013: Automatic forwarding to external domains disabled (MS.EXO.1.1) High
- M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1) Medium
- M365EXO-015: SPF policy published for each domain (MS.EXO.2.2) Critical
- M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1) High
- M365EXO-017: DMARC policy published for each domain (MS.EXO.4.1) Critical
- M365EXO-018: DMARC enforcement set to p=reject (MS.EXO.4.2) High
- M365EXO-019: DMARC aggregate report contact configured (MS.EXO.4.3) Medium
- M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1) High
- M365EXO-021: Contact folder sharing not open to all domains (MS.EXO.6.1) Medium
- M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2) Medium
- M365EXO-023: External sender warning implemented (MS.EXO.7.1) Medium
- M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1) High
- M365EXO-025: DLP protects PII and sensitive data types (MS.EXO.8.2) High
- M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1) High
- M365EXO-027: Attachment filter assesses true file type (MS.EXO.9.2) Medium
- M365EXO-028: Disallowed attachment file types set (MS.EXO.9.3) High
- M365EXO-029: Emails scanned for malware (MS.EXO.10.1) High
- M365EXO-030: Malware emails quarantined or dropped (MS.EXO.10.2) High
- M365EXO-031: Post-delivery malware scanning enabled (MS.EXO.10.3) High
- M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1) High
- M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2) Medium
- M365EXO-034: AI-based phishing detection in use (MS.EXO.11.3) Medium
- M365EXO-035: No IP allow list in connection filter (MS.EXO.12.1) High
- M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2) Medium
- M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1) High
- M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1) High
- M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2) Medium
- M365EXO-040: No allowed domains in anti-spam policy (MS.EXO.14.3) Medium
- M365EXO-041: URL block-list comparison enabled (MS.EXO.15.1) High
- M365EXO-042: Direct download links scanned for malware (MS.EXO.15.2) High
- M365EXO-043: User click tracking enabled (MS.EXO.15.3) Medium
- M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1) High
- M365EXO-045: Alerts routed to monitored destination (MS.EXO.16.2) Medium
- M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1) High
- M365EXO-047: Purview Audit (Premium) logging enabled (MS.EXO.17.2) Medium
- M365EXO-048: Audit log retention meets minimum (MS.EXO.17.3) Medium
- M365EXO-049: Executable attachment types blocked (MS.EXO.9.5) Medium
- M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4) High
Power Platform Security (3)
SharePoint & OneDrive Security (5)
Microsoft Teams Security (8)
- M365TEAMS-001: External access settings High
- M365TEAMS-002: Guest access settings High
- M365TEAMS-003: External meeting participant settings Medium
- M365TEAMS-004: Anonymous meeting join settings High
- M365TEAMS-005: Recording and transcription policies Medium
- M365TEAMS-006: Messaging policies (external communication) Medium
- M365TEAMS-007: App permission policies Medium
- M365TEAMS-008: File sharing settings in Teams Medium
By Zero Trust pillar
Applications & Workloads (150)
- ADMIN-017: Internal apps not auto-trusted (GWS.COMMONCONTROLS.10.3)
- ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4)
- ADMIN-021: Additional Google services without individual control restricted (GWS.COMMONCONTROLS.16.1)
- ADMIN-022: Early Access applications disabled (GWS.COMMONCONTROLS.16.2)
- ADMIN-024: Marketplace apps limited to an allowlist (GWS.COMMONCONTROLS.11.1)
- ADSCRIPT-001: NETLOGON Share Permissions
- ADSCRIPT-002: SYSVOL Share Permissions
- ADSCRIPT-003: Logon Script Inventory
- ADSCRIPT-004: Hardcoded Credentials in Scripts
- ADSCRIPT-005: LOLBins Usage in Scripts
- ADSCRIPT-006: Plaintext Passwords in Scripts
- ADSCRIPT-007: World-Writable Script Permissions
- ADSCRIPT-008: External Resource References
- ADSCRIPT-009: Malformed Scripts
- ADSCRIPT-010: UNC Paths to Non-DC Locations
- ADSCRIPT-011: Script Content Analysis
- COLLAB-001: Meet Recording Settings
- COLLAB-002: Meet External Participant Settings
- COLLAB-003: Meet Anonymous Join Settings
- COLLAB-004: Chat External Communication
- COLLAB-005: Chat History Settings
- COLLAB-006: Chat Spaces External Access
- COLLAB-007: Chat App Installation Settings
- COLLAB-008: Calendar External Sharing
- COLLAB-009: Calendar External Invitations
- COLLAB-010: Calendar Appointment Slots External Visibility
- COLLAB-011: Meet External Participant Labeling
- COLLAB-012: Meet Host Management
- EIDAPP-001: Application Registration Inventory
- EIDAPP-002: App Registrations with High-Risk API Permissions
- EIDAPP-003: App Registrations with Added Credentials
- EIDAPP-004: First-Party Microsoft Service Principals with Added Credentials
- EIDAPP-005: Service Principals with High Privileges and Added Credentials
- EIDAPP-006: Excessive Microsoft Graph Permissions
- EIDAPP-007: App Registrations with Azure IAM Role Assignments
- EIDAPP-008: Credential Expiration Monitoring
- EIDAPP-009: Stale Application Registrations
- EIDAPP-010: Multi-Tenant Application Analysis
- EIDAPP-011: Consent Grants Analysis
- EIDAPP-012: User Consent Settings Policy
- EIDAPP-013: Admin Consent Workflow Configuration
- EIDAPP-014: Application Impersonation Role Holders
- EIDAPP-015: OAuth2 Permission Grants Review
- EIDAPP-016: Managed Identity Inventory and Permissions
- EIDAPP-017: Service Principal Sign-In Activity
- EIDAPP-018: Change Tracking on App Registrations and Service Principals
- EIDAPP-019: Dangling Reply URLs
- EMAIL-001: SPF Record Validation
- EMAIL-002: DKIM Signing Enabled
- EMAIL-003: DMARC Policy Audit
- EMAIL-004: MTA-STS Policy
- EMAIL-005: TLS Enforcement
- EMAIL-006: Email Allowlist/Blocklist Review
- EMAIL-007: Inbound Gateway Configuration
- EMAIL-008: Email Routing Rules Audit
- EMAIL-009: Auto-Forwarding Policy
- EMAIL-010: Delegate Access Settings
- EMAIL-011: POP/IMAP Access Settings
- EMAIL-012: Spam and Phishing Filter Settings
- EMAIL-013: Enhanced Pre-Delivery Message Scanning
- EMAIL-014: External Recipient Warning
- EMAIL-015: Attachment Safety Settings
- EMAIL-016: Links and External Images Protection
- EMAIL-017: Spoofing and Authentication Protection
- EMAIL-018: Compliance Rules Audit
- EMAIL-019: DLP Rules Configuration
- EMAIL-020: Gmail Confidential Mode
- EMAIL-021: S/MIME Settings
- EMAIL-022: Mail Forwarding Rule Enumeration
- EMAIL-024: Gmail Security Sandbox enabled (GWS.GMAIL.16.1)
- EMAIL-028: Google Workspace Sync for Outlook disabled (GWS.GMAIL.10.1)
- EMAIL-029: Gmail spam-override sender lists reviewed (GWS.GMAIL.18.1)
- EMAIL-031: Enhanced pre-delivery message scanning enabled (GWS.GMAIL.15.1)
- GROUP-003: Groups cannot receive mail from outside the org (GWS.GROUPS.1.3)
- GWS-CLASS-001: Classroom Membership - Who Can Join Classes
- GWS-CLASS-002: Classroom Membership - Which Classes Users Can Join
- GWS-CLASS-003: Classroom API Data Access Restricted
- GWS-CLASS-004: Classroom Roster Import Disabled
- GWS-CLASS-005: Classroom Student Unenrollment Restricted
- GWS-CLASS-006: Classroom Class Creation Restricted to Verified Teachers
- GWS-GEMINI-001: Gemini App Access Restricted to Licensed Users
- GWS-GEMINI-002: Gemini Alpha Features Disabled
- GWS-GEMINI-003: Gemini Conversation History Enabled
- GWS-GEMINI-004: Gemini Conversation Retention Minimum 18 Months
- GWS-GEMINI-005: Gemini Conversation Sharing Disabled
- GWS-K12-003: Students Cannot Authorize Third-Party Apps
- GWS-K12-004: Vendor Delegated Access Review
- GWS-K12-006: Student Communication Boundaries
- GWS-SITES-001: Sites Service Disabled
- M365DEF-001: Preset security policy audit
- M365DEF-002: Alert policy inventory
- M365DEF-003: Threat intelligence configuration
- M365EXO-001: Anti-spam policy audit
- M365EXO-002: Anti-phishing policy audit
- M365EXO-003: Anti-malware policy audit
- M365EXO-004: Safe Attachments policy
- M365EXO-005: Safe Links policy
- M365EXO-006: DKIM/DMARC/SPF validation
- M365EXO-007: Auto-forwarding policy
- M365EXO-008: Transport rules inventory and analysis
- M365EXO-009: Mailbox auditing enabled
- M365EXO-010: External sender warnings
- M365EXO-011: OAuth/SMTP AUTH per-mailbox audit
- M365EXO-012: Remote domains auto-forward setting
- M365EXO-014: Approved sending IP list maintained (MS.EXO.2.1)
- M365EXO-015: SPF policy published for each domain (MS.EXO.2.2)
- M365EXO-016: DKIM enabled for all domains (MS.EXO.3.1)
- M365EXO-017: DMARC policy published for each domain (MS.EXO.4.1)
- M365EXO-018: DMARC enforcement set to p=reject (MS.EXO.4.2)
- M365EXO-019: DMARC aggregate report contact configured (MS.EXO.4.3)
- M365EXO-023: External sender warning implemented (MS.EXO.7.1)
- M365EXO-026: Email filtered by attachment file type (MS.EXO.9.1)
- M365EXO-027: Attachment filter assesses true file type (MS.EXO.9.2)
- M365EXO-028: Disallowed attachment file types set (MS.EXO.9.3)
- M365EXO-029: Emails scanned for malware (MS.EXO.10.1)
- M365EXO-030: Malware emails quarantined or dropped (MS.EXO.10.2)
- M365EXO-031: Post-delivery malware scanning enabled (MS.EXO.10.3)
- M365EXO-032: Impersonation protection checks enabled (MS.EXO.11.1)
- M365EXO-033: User safety tips/warnings displayed (MS.EXO.11.2)
- M365EXO-034: AI-based phishing detection in use (MS.EXO.11.3)
- M365EXO-035: No IP allow list in connection filter (MS.EXO.12.1)
- M365EXO-036: Connection filter safe list disabled (MS.EXO.12.2)
- M365EXO-038: Inbound spam filter enabled (MS.EXO.14.1)
- M365EXO-039: Spam routed to junk or quarantine (MS.EXO.14.2)
- M365EXO-040: No allowed domains in anti-spam policy (MS.EXO.14.3)
- M365EXO-041: URL block-list comparison enabled (MS.EXO.15.1)
- M365EXO-042: Direct download links scanned for malware (MS.EXO.15.2)
- M365EXO-043: User click tracking enabled (MS.EXO.15.3)
- M365EXO-049: Executable attachment types blocked (MS.EXO.9.5)
- M365PP-001: Environment creation restrictions
- M365PP-002: DLP policy configuration
- M365PP-003: Tenant isolation settings
- M365TEAMS-001: External access settings
- M365TEAMS-002: Guest access settings
- M365TEAMS-003: External meeting participant settings
- M365TEAMS-004: Anonymous meeting join settings
- M365TEAMS-005: Recording and transcription policies
- M365TEAMS-006: Messaging policies (external communication)
- M365TEAMS-007: App permission policies
- M365TEAMS-008: File sharing settings in Teams
- OAUTH-001: OAuth App Whitelist/Blocklist
- OAUTH-002: Installed OAuth Apps Inventory
- OAUTH-003: OAuth Scope Analysis
- OAUTH-004: OAuth App Risk Scoring
- OAUTH-005: Unverified App Access Policy
- OAUTH-006: API Access Control
- OAUTH-007: Marketplace App Installation Restrictions
- OAUTH-008: Domain-Wide Delegation Grants Audit
- OAUTH-009: Service Account Key Enumeration
- OAUTH-010: Connected Apps With Sensitive Scopes
Data (53)
- ADMIN-018: Data at-rest region configured (GWS.COMMONCONTROLS.15.1)
- ADMIN-019: Data processing restricted to storage region (GWS.COMMONCONTROLS.15.2)
- COLLAB-013: Chat external file sharing disabled (GWS.CHAT.2.1)
- COLLAB-016: Meet automatic transcription off by default (GWS.MEET.5.2)
- COLLAB-019: Meet automatic recording off by default (GWS.MEET.5.1)
- DRIVE-001: External Sharing Defaults
- DRIVE-002: Link Sharing Default Settings
- DRIVE-003: Anyone With the Link Sharing Audit
- DRIVE-004: Shared Drive Creation Restrictions
- DRIVE-005: Shared Drive Member Management
- DRIVE-006: Shared Drive External Sharing
- DRIVE-007: File Ownership Transfer Settings
- DRIVE-008: Drive for Desktop Allowed/Blocked
- DRIVE-009: Third-Party App Drive Access
- DRIVE-010: Drive DLP Rules Audit
- DRIVE-011: Target Audience Settings
- DRIVE-012: Drive Add-ons Settings
- DRIVE-013: Offline Access Settings
- DRIVE-014: Drive SDK API access disabled (GWS.DRIVEDOCS.4.1)
- DRIVE-015: Drive external-file warning enabled (GWS.DRIVEDOCS.1.9)
- DRIVE-016: Drive file security update enforced (GWS.DRIVEDOCS.3.1)
- DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8)
- DRIVE-018: Shared Drive External-Sharing Exposure
- DRIVE-019: External-sharing warning enabled (GWS.DRIVEDOCS.1.3)
- DRIVE-020: Sharing with non-Google accounts disabled (GWS.DRIVEDOCS.1.4)
- DRIVE-021: Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5)
- DRIVE-022: Content distribution to outside shared drives blocked (GWS.DRIVEDOCS.1.7)
- EMAIL-023: Per-user outbound gateways disabled (GWS.GMAIL.12.1)
- EMAIL-025: Gmail mail delegation disabled (GWS.GMAIL.1.1)
- EMAIL-027: Gmail user email/contacts import disabled (GWS.GMAIL.8.1)
- EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1)
- EMAIL-033: Unsafe attachments are not left in the inbox (GWS.GMAIL.5.5)
- EMAIL-034: Spoofed and unauthenticated mail is not left in the inbox (GWS.GMAIL.7.6)
- EMAIL-035: No domains bypass spam filtering and warnings (GWS.GMAIL.18.2)
- EMAIL-036: Spam filter bypass not enabled for all senders (GWS.GMAIL.18.3)
- GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1)
- GROUP-002: Group owners cannot add external members (GWS.GROUPS.1.2)
- GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1)
- GWS-K12-001: Student OU Sharing Not Inherited From Staff
- GWS-K12-002: Student External Drive Sharing Restricted
- GWS-K12-011: Student Auto-Forwarding Disabled
- GWS-K12-012: Student Data Export (Takeout) Disabled
- M365EXO-013: Automatic forwarding to external domains disabled (MS.EXO.1.1)
- M365EXO-021: Contact folder sharing not open to all domains (MS.EXO.6.1)
- M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2)
- M365EXO-024: Data loss prevention solution in use (MS.EXO.8.1)
- M365EXO-025: DLP protects PII and sensitive data types (MS.EXO.8.2)
- M365EXO-050: DLP restricts sharing of SSN, ITIN, and credit-card numbers (MS.EXO.8.4)
- M365SPO-001: External sharing settings
- M365SPO-002: Guest access expiration
- M365SPO-003: Default sharing link type
- M365SPO-004: Site creation restrictions
- M365SPO-005: DLP policy configuration
Devices (36)
- DEVICE-001: MDM Policy Audit
- DEVICE-002: Device Approval Requirements
- DEVICE-003: Screen Lock Enforcement
- DEVICE-004: Device Encryption Requirements
- DEVICE-005: Compromised Device Blocking
- DEVICE-006: Jailbroken/Rooted Device Policy
- DEVICE-007: Chrome Browser Management
- DEVICE-008: Chrome Extension Whitelist/Blocklist
- DEVICE-009: Chrome OS Device Policies
- DEVICE-010: Endpoint Verification Settings
- DEVICE-011: Company-Owned Device Inventory
- DRIVE-023: Drive for Desktop limited to authorized devices (GWS.DRIVEDOCS.5.1)
- GWS-K12-008: Managed Student Chromebook Posture
- INTUNE-001: Device compliance policy inventory
- INTUNE-002: Device compliance status overview
- INTUNE-003: Non-compliant device enumeration
- INTUNE-004: Configuration profile inventory
- INTUNE-005: Configuration profile assignment analysis
- INTUNE-006: Windows Update for Business ring configuration
- INTUNE-007: BitLocker encryption policy audit
- INTUNE-008: Windows Defender/Antivirus policy audit
- INTUNE-009: Attack Surface Reduction rules configuration
- INTUNE-010: Endpoint Detection and Response configuration
- INTUNE-011: Application protection policies (MAM)
- INTUNE-012: Conditional launch settings
- INTUNE-013: Device enrollment restrictions
- INTUNE-014: Autopilot configuration
- INTUNE-015: Disk encryption status
- INTUNE-016: Firewall policy configuration
- INTUNE-017: Security baselines compliance
- INTUNE-018: PowerShell script deployment audit
- INTUNE-019: Win32 app deployment security review
- INTUNE-020: Device categories and grouping
- INTUNE-021: Remote actions audit (wipe, retire, lock)
- INTUNE-022: OneDrive sync restrictions
- INTUNE-023: Multi-admin approval for destructive device actions
Governance (92)
- ADDOM-001: Forest Functional Level
- ADDOM-002: Domain Functional Level
- ADDOM-003: Schema Version Identification
- ADDOM-004: Domain Controller Inventory
- ADDOM-005: Obsolete OS on Domain Controllers
- ADDOM-006: FSMO Role Holder Identification
- ADDOM-007: AD Replication Health
- ADDOM-008: Tombstone Lifetime Configuration
- ADDOM-009: AD Recycle Bin Status
- ADDOM-010: Sites and Subnets Configuration
- ADDOM-011: Site Link Configuration
- ADDOM-012: DNS Zone Security
- ADDOM-013: LDAP Signing Requirements
- ADDOM-014: LDAP Channel Binding
- ADDOM-015: SMB Signing Requirements
- ADDOM-016: NTLMv1 Usage Detection
- ADDOM-017: NTLMv2 Enforcement
- ADDOM-018: Null Session Enumeration
- ADDOM-019: Print Spooler on Domain Controllers
- ADDOM-020: DSRM Password Configuration
- ADGPO-001: GPO Inventory with Link Status
- ADGPO-002: Empty GPOs
- ADGPO-003: Unlinked GPOs
- ADGPO-004: Disabled GPOs with Content
- ADGPO-005: Duplicated GPOs
- ADGPO-006: GPOs with Broken Links
- ADGPO-007: GPO Permission Inconsistencies
- ADGPO-008: GPOs Not Applied Due to WMI Filters
- ADGPO-009: GPOs with No Apply Permission
- ADGPO-010: SYSVOL/AD GPO Version Mismatch
- ADGPO-011: GPO Settings Security Analysis
- ADGPO-012: cPassword/GPP Password Detection
- ADGPO-013: Scripts in GPOs Analysis
- ADGPO-014: MSI Packages in GPOs
- ADGPO-015: Scheduled Tasks in GPOs
- ADGPO-016: Registry Settings Security Review
- ADGPO-017: Restricted Groups Analysis
- ADGPO-018: Audit Policy Configuration via GPO
- ADGPO-019: Windows Firewall Configuration via GPO
- ADGPO-020: PowerShell Execution Policy via GPO
- ADGPO-021: PowerShell Logging Configuration
- ADGPO-022: AppLocker/WDAC Policy Assessment
- ADGPO-023: LAPS GPO Configuration
- ADGPO-024: GPO WMI Filter Review
- ADMIN-001: Super Admin Account Inventory
- ADMIN-002: Admin Role Assignments Audit
- ADMIN-003: Delegated Admin Permissions Review
- ADMIN-004: Inactive/Suspended Admin Accounts
- ADMIN-005: User Account Inventory
- ADMIN-006: Stale User Accounts
- ADMIN-007: OU Structure Review
- ADMIN-008: Directory Sharing Settings
- ADMIN-009: User Profile Visibility
- ADMIN-010: Groups Settings and External Membership
- ADMIN-011: Group Creation Restrictions
- ADMIN-012: Groups for Business Settings
- ADMIN-013: Super Admin Count
- ADMIN-014: Assured Controls - Access Approvals Enabled
- ADMIN-015: Assured Controls - Support Access Restricted to U.S. Staff
- ADMIN-016: Assured Controls - Multi-Region Data Processing Disabled
- ADSTALE-001: Inactive User Accounts
- ADSTALE-002: Inactive Computer Accounts
- ADSTALE-003: Disabled Accounts with Group Memberships
- ADSTALE-004: Expired Passwords Not Disabled
- ADSTALE-005: Obsolete OS Computers
- ADSTALE-006: Unsupported OS Versions
- ADSTALE-007: Orphaned Foreign Security Principals
- ADSTALE-008: Orphaned SID History
- ADSTALE-009: Abandoned OUs
- ADSTALE-010: Printer Objects
- ADSTALE-011: DNS Record Staleness
- AIAGENT-003: Published Copilot agents are maintained (not dormant)
- COLLAB-017: Calendar external interoperability managed (GWS.CALENDAR.3.1)
- COLLAB-018: Calendar appointment payments disabled (GWS.CALENDAR.4.1)
- EIDGOV-001: Access-package assignment policies require approval
- EIDGOV-002: Access-package assignment policies enforce access reviews
- EIDGOV-005: Access-package catalog external visibility reviewed
- EIDTNT-001: Tenant-Wide Settings Export
- EIDTNT-002: User Settings Review
- EIDTNT-003: Guest User Access Restrictions
- EIDTNT-004: Guest Invitation Restrictions
- EIDTNT-005: External Collaboration Settings
- EIDTNT-006: Azure B2B Cross-Tenant Access Policies
- EIDTNT-007: Security Defaults Enabled/Disabled Status
- EIDTNT-008: License Inventory and Utilization
- EIDTNT-009: Administrative Unit Configuration
- EIDTNT-010: Custom Domain Configuration
- EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs
- EIDTNT-012: Audit Log Retention Settings
- EIDTNT-013: Notification Settings Audit
- EIDTNT-016: Partner Delegated Admin Grant Hygiene (Long-Lived GDAP)
- GROUP-004: Group creation restricted to administrators (GWS.GROUPS.2.1)
Identity (280)
- ADACL-001: Critical Object ACL Audit
- ADACL-002: GenericAll Permissions on Critical Objects
- ADACL-003: GenericWrite Permissions on Critical Objects
- ADACL-004: WriteDACL Permissions on Critical Objects
- ADACL-005: WriteOwner Permissions on Critical Objects
- ADACL-006: ForceChangePassword Rights
- ADACL-007: Excessive Delegation to Broad Groups
- ADACL-008: OU Delegation Analysis
- ADACL-009: Machine Account Quota
- ADACL-010: Extended Rights Audit
- ADACL-011: Ownership of Critical Objects
- ADACL-012: Non-Default Domain Root Permissions
- ADACL-013: GPO Link Permissions
- ADACL-014: GPO Edit Permissions
- ADACL-015: Shadow Admins Detection
- ADACL-016: Attack Path Enumeration
- ADCS-001: CA Server Inventory
- ADCS-002: ESC1 - Enrollee Supplies Subject Alternative Name
- ADCS-003: ESC2 - Any Purpose Extended Key Usage
- ADCS-004: ESC3 - Enrollment Agent Template Abuse Condition 1
- ADCS-005: ESC3 - Enrollment Agent Template Abuse Condition 2
- ADCS-006: ESC4 - Vulnerable Certificate Template ACLs
- ADCS-007: ESC4 - Vulnerable Certificate Template Ownership
- ADCS-008: ESC5 - Vulnerable PKI Object ACLs
- ADCS-009: ESC6 - EDITF_ATTRIBUTESUBJECTALTNAME2 Flag
- ADCS-010: ESC7 - Vulnerable CA ACLs
- ADCS-011: ESC8 - NTLM Relay to AD CS HTTP Endpoints
- ADCS-012: ESC9 - No Security Extension
- ADCS-013: ESC11 - RPC Relay Without Encryption
- ADCS-014: ESC13 - Issuance Policy OID Group Link
- ADCS-015: ESC15 - Application Policies in Schema v1 Templates
- ADCS-016: ESC16 - UPN SAN Misconfiguration
- ADCS-017: EKEUwu - Extended Key Usage Abuse
- ADCS-018: CA Auditing Configuration
- ADCS-019: Certificate Template Enumeration
- ADKERB-001: Kerberoastable Accounts
- ADKERB-002: Kerberoastable with Weak Encryption
- ADKERB-003: AS-REP Roastable Accounts
- ADKERB-004: Unconstrained Delegation - Computers
- ADKERB-005: Unconstrained Delegation - Users
- ADKERB-006: Constrained Delegation Analysis
- ADKERB-007: Resource-Based Constrained Delegation
- ADKERB-008: Protocol Transition Abuse Paths
- ADKERB-009: Kerberos Encryption Types
- ADKERB-010: Kerberos Ticket Lifetime
- ADKERB-011: Computer SPN Audit
- ADMIN-023: Super admin count within the supported range (GWS.COMMONCONTROLS.6.2)
- ADMIN-025: Multi-party approval required for sensitive admin actions (GWS.COMMONCONTROLS.17.1)
- ADPATH-001: Escalation Paths to Tier-0
- ADPATH-002: Transitive Escalation Chains to Tier-0
- ADPRIV-001: Domain Admins Enumeration
- ADPRIV-002: Enterprise Admins Enumeration
- ADPRIV-003: Schema Admins Enumeration
- ADPRIV-004: Account Operators Enumeration
- ADPRIV-005: Server Operators Enumeration
- ADPRIV-006: Backup Operators Enumeration
- ADPRIV-007: Print Operators Enumeration
- ADPRIV-008: DnsAdmins Group Membership
- ADPRIV-009: Nested Group Membership Analysis
- ADPRIV-010: Privileged Users Password Never Expires
- ADPRIV-011: Privileged Users Password Not Required
- ADPRIV-012: Privileged Users No Kerberos Pre-Auth
- ADPRIV-013: Privileged Users Reversible Encryption
- ADPRIV-014: Privileged Users DES-Only Kerberos
- ADPRIV-015: Privileged Accounts No MFA Indicator
- ADPRIV-016: Privileged Accounts Weak Passwords
- ADPRIV-017: Privileged Accounts Old Passwords
- ADPRIV-018: Privileged Accounts Never Logged In
- ADPRIV-019: Disabled Accounts in Privileged Groups
- ADPRIV-020: AdminSDHolder Protected Object Audit
- ADPRIV-021: AdminCount Orphans
- ADPRIV-022: krbtgt Password Age
- ADPRIV-023: krbtgt Account Exposure Assessment
- ADPRIV-024: Service Accounts in Privileged Groups
- ADPRIV-025: Computer Accounts in Privileged Groups
- ADPRIV-026: Privileged Users Local Logon on DCs
- ADPRIV-027: Privileged Users RDP on DCs
- ADPRIV-028: Users with DCSync Rights
- ADPRIV-029: Protected Users Group Audit
- ADPRIV-030: Privileged Users Not in Protected Users
- ADPWD-001: Default Domain Password Policy
- ADPWD-002: Fine-Grained Password Policy Enumeration
- ADPWD-003: FGPP Application Analysis
- ADPWD-004: Minimum Password Length
- ADPWD-005: Password Complexity Requirement
- ADPWD-006: Account Lockout Policy
- ADPWD-007: Password History Enforcement
- ADPWD-008: Maximum Password Age
- ADPWD-009: Users with Password Never Expires
- ADPWD-010: Users with Blank Passwords
- ADPWD-011: Duplicate Password Hashes
- ADPWD-012: Passwords in HaveIBeenPwned Database
- ADPWD-013: Custom Dictionary Password Check
- ADPWD-014: Default/Common Passwords
- ADPWD-015: Password Last Set Age Distribution
- ADPWD-016: LAPS Deployment Status
- ADPWD-017: LAPS Password Expiration
- ADPWD-018: Windows LAPS vs Legacy LAPS
- ADPWD-019: Azure AD Password Protection
- ADPWD-020: BitLocker Recovery Keys in AD
- ADPWD-021: Account Lockout Threshold
- ADPWD-022: Lockout Observation Window
- ADTIER-001: Azure AD Connect Sync Account (MSOL_) Audit
- ADTIER-002: Backup Software Service Accounts in Privileged Groups
- ADTIER-003: Hypervisor / Virtualization Service Accounts in Privileged Groups
- ADTIER-004: Configuration Management Service Accounts in Privileged Groups
- ADTIER-005: SQL / Database Service Accounts in Privileged Groups
- ADTIER-006: Tier-0 Admin Accounts Outside a Dedicated Tier-0 OU
- ADTIER-007: Service Accounts with Interactive Logon Rights via Privileged Group
- ADTRADE-005: Entra Seamless SSO Computer Account (AZUREADSSOACC$) Key Rotation
- ADTRADE-006: Shadow Credentials (msDS-KeyCredentialLink) on Privileged Principals
- ADTRADE-007: BadSuccessor dMSA Migration Escalation Surface
- ADTRADE-008: Key Admins / Enterprise Key Admins Group Membership
- ADTRADE-009: Cert Publishers Group Membership
- ADTRADE-010: group Managed Service Account (gMSA) Posture & Password Exposure
- ADTRUST-001: Trust Relationships Enumeration
- ADTRUST-002: Trust Direction Analysis
- ADTRUST-003: Trust Transitivity Analysis
- ADTRUST-004: SID Filtering Status
- ADTRUST-005: SID History Abuse Detection
- ADTRUST-006: Selective Authentication Status
- ADTRUST-007: Azure AD Hybrid Trust Security
- ADTRUST-008: Foreign Domain Trust Enumeration
- ADTRUST-009: Orphaned Trust Detection
- ADTRUST-010: Trust Key Age and Rotation
- ADTRUST-011: Trust Hierarchy Visualization
- AIAGENT-001: Copilot agents restrict who can interact (no broad access)
- AIAGENT-002: Copilot agents require authentication
- AIAGENT-004: Copilot agent access is scoped to security groups
- AUTH-001: 2SV Enforcement
- AUTH-002: 2SV Enrollment Rate
- AUTH-003: 2SV Method Strength
- AUTH-004: Password Minimum Length
- AUTH-005: Password Reuse Restriction
- AUTH-006: Session Duration
- AUTH-007: SSO Configuration
- AUTH-008: Less Secure Apps Access
- AUTH-009: App Passwords Policy
- AUTH-010: Recovery Options Configuration
- AUTH-011: Login Challenge Settings
- AUTH-012: Super Admin 2SV Enrollment
- AUTH-013: Stale Super Admin Accounts
- AUTH-014: 2SV Enrollment Allowed
- AUTH-015: 2SV Enrollment Grace Period
- AUTH-016: Advanced Protection Self-Enrollment
- AUTH-017: Super Admin Account Self-Recovery
- AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2)
- AUTH-019: Conflicting unmanaged accounts replaced (GWS.COMMONCONTROLS.7.1)
- AZIAM-001: Subscription-level role assignments audit
- AZIAM-002: Users with Azure IAM roles directly on resources
- AZIAM-003: Resource group permission analysis
- AZIAM-004: Azure Key Vault access policy audit
- AZIAM-005: Storage account security settings
- AZIAM-006: Network Security Group rules audit
- AZIAM-007: Azure Policy compliance status
- AZIAM-008: Management group structure review
- AZIAM-009: Custom RBAC role definitions
- AZIAM-010: Resource locks configuration
- COLLAB-015: Meeting join restricted to the organization (GWS.MEET.2.1)
- EIDAPP-020: Group Owner Consent to Applications Blocked
- EIDAUTH-001: Authentication Methods Policy Audit
- EIDAUTH-002: MFA Registration Status for All Users
- EIDAUTH-003: MFA Method Distribution Analysis
- EIDAUTH-004: Users with Only SMS/Voice MFA Methods
- EIDAUTH-005: Users with No MFA Methods Registered
- EIDAUTH-006: FIDO2 Security Key Inventory and Audit
- EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check
- EIDAUTH-008: Passwordless Authentication Readiness
- EIDAUTH-009: Windows Hello for Business Configuration
- EIDAUTH-010: Temporary Access Pass (TAP) Policy Audit
- EIDAUTH-011: Self-Service Password Reset (SSPR) Configuration
- EIDAUTH-012: SSPR Methods and Requirements
- EIDAUTH-013: Password Protection (Banned Passwords) Configuration
- EIDAUTH-014: Custom Banned Password List Status
- EIDAUTH-015: Legacy Authentication Protocol Usage
- EIDAUTH-016: ROPC (Resource Owner Password Credentials) Flow Enabled
- EIDAUTH-017: Per-User MFA vs Conditional Access MFA Conflict Detection
- EIDAUTH-018: Microsoft Authenticator Login Context (Application Name and Location)
- EIDCA-001: Full CA Policy Inventory
- EIDCA-002: CA Policy Coverage Gap Analysis
- EIDCA-003: CA Policies in Report-Only Mode
- EIDCA-004: CA Exclusion Group Analysis
- EIDCA-005: Unprotected Groups in CA Exclusions
- EIDCA-006: Break-Glass Account CA Exclusion Validation
- EIDCA-007: MFA Enforcement via Conditional Access
- EIDCA-008: Legacy Authentication Blocking via CA
- EIDCA-009: Device Compliance Requirement in CA
- EIDCA-010: Location-Based CA Policies Audit
- EIDCA-011: Named Locations Configuration Review
- EIDCA-012: Sign-In Risk-Based CA Policies
- EIDCA-013: User Risk-Based CA Policies
- EIDCA-014: Session Controls Audit
- EIDCA-015: CA What-If Simulation for Attack Scenarios
- EIDCA-016: CA Policy Documentation Export
- EIDCA-017: High-Risk User Notification to Administrators
- EIDCA-018: Managed Device Required for MFA Registration
- EIDFED-001: Federated Domain Enumeration
- EIDFED-002: Federation Signing Certificate Validity Period
- EIDFED-003: Federation Signing Certificate Issuer/Subject Mismatch
- EIDFED-004: Federation Trust Metadata Analysis
- EIDFED-005: Azure AD Connect Configuration Review
- EIDFED-006: Azure AD Connect Sync Scope Audit
- EIDFED-007: Password Hash Sync Enabled Status
- EIDFED-008: Pass-Through Authentication Agent Status
- EIDFED-009: AD FS Server Configuration Assessment
- EIDFED-010: AD FS Extranet Lockout Settings
- EIDFED-011: Hybrid Join Configuration
- EIDFED-012: Cloud-Only vs Synced Account Analysis
- EIDFED-013: Entra Connect Sync-Client Version Currency
- EIDGOV-003: Access-package assignments are time-bound
- EIDGOV-004: External access-package eligibility is controlled
- EIDPIM-001: Global Administrator Enumeration
- EIDPIM-002: All Privileged Role Assignments
- EIDPIM-003: Permanent Privileged Role Assignments
- EIDPIM-004: Privileged Role Assignments to Guest Users
- EIDPIM-005: Privileged Role Assignments to Synced Accounts
- EIDPIM-006: Privileged Users Without MFA
- EIDPIM-007: Privileged Users with Weak Authentication Methods
- EIDPIM-008: Disabled Accounts in Privileged Roles
- EIDPIM-009: Accounts Never Signed In with Active Privileged Role
- EIDPIM-010: PIM Configuration Audit
- EIDPIM-011: PIM Eligible Role Activation History
- EIDPIM-012: Emergency Access Account Validation
- EIDPIM-013: Separate Admin Account Enforcement
- EIDPIM-014: Privileged Role Assignment Notification Settings
- EIDSCA-AF01: EIDSCA AF01: Authentication Method - FIDO2 security key - State
- EIDSCA-AF02: EIDSCA AF02: Authentication Method - FIDO2 security key - Allow self-service set up
- EIDSCA-AF03: EIDSCA AF03: Authentication Method - FIDO2 security key - Enforce attestation
- EIDSCA-AF04: EIDSCA AF04: Authentication Method - FIDO2 security key - Enforce key restrictions
- EIDSCA-AF05: EIDSCA AF05: Authentication Method - FIDO2 security key - Restricted
- EIDSCA-AF06: EIDSCA AF06: Authentication Method - FIDO2 security key - Restrict specific keys
- EIDSCA-AG01: EIDSCA AG01: Authentication Method - General Settings - Manage migration
- EIDSCA-AG02: EIDSCA AG02: Authentication Method - General Settings - Report suspicious activity - State
- EIDSCA-AG03: EIDSCA AG03: Authentication Method - General Settings - Report suspicious activity - Included users/groups
- EIDSCA-AM01: EIDSCA AM01: Authentication Method - Microsoft Authenticator - State
- EIDSCA-AM02: EIDSCA AM02: Authentication Method - Microsoft Authenticator - Allow use of Microsoft Authenticator OTP
- EIDSCA-AM03: EIDSCA AM03: Authentication Method - Microsoft Authenticator - Require number matching for push notifications
- EIDSCA-AM04: EIDSCA AM04: Authentication Method - Microsoft Authenticator - Included users/groups of number matching for push notifications
- EIDSCA-AM06: EIDSCA AM06: Authentication Method - Microsoft Authenticator - Show application name in push and passwordless notifications
- EIDSCA-AM07: EIDSCA AM07: Authentication Method - Microsoft Authenticator - Included users/groups to show application name in push and passwordless notifications
- EIDSCA-AM09: EIDSCA AM09: Authentication Method - Microsoft Authenticator - Show geographic location in push and passwordless notifications
- EIDSCA-AM10: EIDSCA AM10: Authentication Method - Microsoft Authenticator - Included users/groups to show geographic location in push and passwordless notifications
- EIDSCA-AP01: EIDSCA AP01: Default Authorization Settings - Enabled Self service password reset for administrators
- EIDSCA-AP04: EIDSCA AP04: Default Authorization Settings - Guest invite restrictions
- EIDSCA-AP05: EIDSCA AP05: Default Authorization Settings - Sign-up for email based subscription
- EIDSCA-AP06: EIDSCA AP06: Default Authorization Settings - User can join the tenant by email validation
- EIDSCA-AP07: EIDSCA AP07: Default Authorization Settings - Guest user access
- EIDSCA-AP08: EIDSCA AP08: Default Authorization Settings - User consent policy assigned for applications
- EIDSCA-AP09: EIDSCA AP09: Default Authorization Settings - Allow user consent on risk-based apps
- EIDSCA-AP10: EIDSCA AP10: Default Authorization Settings - Default User Role Permissions - Allowed to create Apps
- EIDSCA-AP14: EIDSCA AP14: Default Authorization Settings - Default User Role Permissions - Allowed to read other users
- EIDSCA-AS04: EIDSCA AS04: Authentication Method - SMS - Use for sign-in
- EIDSCA-AT01: EIDSCA AT01: Authentication Method - Temporary Access Pass - State
- EIDSCA-AT02: EIDSCA AT02: Authentication Method - Temporary Access Pass - One-time
- EIDSCA-AV01: EIDSCA AV01: Authentication Method - Voice call - State
- EIDSCA-CP01: EIDSCA CP01: Default Settings - Consent Policy Settings - Group owner consent for apps accessing data
- EIDSCA-CP03: EIDSCA CP03: Default Settings - Consent Policy Settings - Block user consent for risky apps
- EIDSCA-CP04: EIDSCA CP04: Default Settings - Consent Policy Settings - Users can request admin consent to apps they are unable to consent to
- EIDSCA-CR01: EIDSCA CR01: Consent Framework - Admin Consent Request - Policy to enable or disable admin consent request feature
- EIDSCA-CR02: EIDSCA CR02: Consent Framework - Admin Consent Request - Reviewers will receive email notifications for requests
- EIDSCA-CR03: EIDSCA CR03: Consent Framework - Admin Consent Request - Reviewers will receive email notifications when admin consent requests are about to expire
- EIDSCA-CR04: EIDSCA CR04: Consent Framework - Admin Consent Request - Consent request duration (days)
- EIDSCA-PR01: EIDSCA PR01: Default Settings - Password Rule Settings - Password Protection - Mode
- EIDSCA-PR02: EIDSCA PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory
- EIDSCA-PR03: EIDSCA PR03: Default Settings - Password Rule Settings - Enforce custom list
- EIDSCA-PR05: EIDSCA PR05: Default Settings - Password Rule Settings - Smart Lockout - Lockout duration in seconds
- EIDSCA-PR06: EIDSCA PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold
- EIDSCA-ST08: EIDSCA ST08: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to become Group Owner
- EIDSCA-ST09: EIDSCA ST09: Default Settings - Classification and M365 Groups - M365 groups - Allow Guests to have access to groups content
- EIDTNT-014: User Password Expiration Disabled (Passwords Never Expire)
- EIDTNT-015: Privileged Partner Delegated Admin Access (GDAP)
- EMAIL-026: Gmail POP and IMAP access disabled (GWS.GMAIL.9.1)
- GTRADE-007: Admin Role Granted Through a Group
- GWS-K12-005: Delegated Admin Least Privilege
- GWS-K12-007: Guardian Access Integrity
- GWS-K12-009: Departed Student Account Disposition
- GWS-K12-010: Student Account Security Floor
- GWS-K12-013: Legacy Authentication Disabled For Students
- GWS-K12-014: Vault Export And Retention Privileges Restricted
- M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1)
Networks (10)
- ADNET-001: LDAP Signing Required on Domain Controllers
- ADNET-002: LDAP Channel Binding Enforced on Domain Controllers
- ADNET-003: SMB Server Signing Required (Domain Policy)
- ADNET-004: SMB Client Signing Required (Domain Policy)
- ADNET-005: LLMNR Disabled by Domain Policy
- ADNET-006: NetBIOS over TCP/IP Configuration Reviewed
- ADNET-007: IPv6 mitm6 Mitigation Posture
- ADNET-008: WPAD Auto-Discovery Disabled
- ADNET-009: Print Spooler Service on Domain Controllers
- ADNET-010: WebClient Service Default State on Workstations
Visibility & Analytics (37)
- ADLOG-001: Advanced Audit Policy Configured
- ADLOG-002: PowerShell Script Block Logging Enabled
- ADLOG-003: PowerShell Module Logging Enabled
- ADLOG-004: Process Creation Auditing with Command Line
- ADLOG-005: Microsoft Defender Tamper Protection Policy
- ADLOG-006: Windows Event Forwarding (WEF) Subscription Manager
- ADLOG-007: Sysmon Deployment Indicator
- ADTRADE-001: Group Policy Preferences cpassword Leftovers in SYSVOL
- ADTRADE-002: DCShadow Indicator (Rogue Configuration-Partition Servers)
- ADTRADE-003: Stale BitLocker Recovery Keys
- ADTRADE-004: RODC Password Replication Policy Hygiene
- COLLAB-014: Chat space history is on (GWS.CHAT.3.1)
- EMAIL-032: Comprehensive mail storage enabled (GWS.GMAIL.17.1)
- GROUP-006: Groups are visible in the directory (GWS.GROUPS.4.1)
- GTRADE-001: Domain-Wide Delegation Org-Takeover Exposure
- GTRADE-002: Internet-Readable Google Groups
- GTRADE-003: Open-Join / External-Member Groups
- GTRADE-004: Super-Admin Sprawl
- GTRADE-005: Super-Admin-Equivalent Custom Roles
- GTRADE-006: Persistent / Over-Scoped OAuth Grants
- GWS-K12-015: Audit Logging License Coverage
- LOG-001: Audit Log Retention Settings
- LOG-002: Alert Center Rules Inventory
- LOG-003: Activity Rules Coverage Analysis
- LOG-004: Data Export Settings
- LOG-005: Admin Email Alerts Configuration
- LOG-006: Reporting API Access
- LOG-007: System-defined alerting rules all enabled (GWS.COMMONCONTROLS.13.1)
- M365AUDIT-001: Unified Audit Log enabled
- M365AUDIT-002: Audit log retention policy
- M365AUDIT-003: Audit log search capability
- M365EXO-037: Mailbox auditing enabled organization-wide (MS.EXO.13.1)
- M365EXO-044: Required Exchange Online alerts enabled (MS.EXO.16.1)
- M365EXO-045: Alerts routed to monitored destination (MS.EXO.16.2)
- M365EXO-046: Purview Audit (Standard) logging enabled (MS.EXO.17.1)
- M365EXO-047: Purview Audit (Premium) logging enabled (MS.EXO.17.2)
- M365EXO-048: Audit log retention meets minimum (MS.EXO.17.3)
Zero analytics. Zero tracking. Zero cookies. This site makes no external requests, so there is nothing to consent to.
Guerrilla is free and open source. · Validation
Guerrilla is written and maintained by Jim Tyler. This copy lives on jimtyler.org; the project also publishes at guerrilla.army.