Compliance / By country / CIS Benchmark

The CIS Benchmark for Microsoft 365

The CIS Microsoft 365 Foundations Benchmark is the consensus, prescriptive hardening baseline for a Microsoft 365 tenant. Siemserva by Senserva maps 556+ Microsoft 365 and Entra ID checks to the areas CIS Benchmark emphasizes, so a scan of your tenant doubles as evidence.

Global benchmarksAll organizations556+ mapped checks

What CIS Benchmark is

The CIS Benchmarks are consensus-developed, prescriptive configuration baselines from the Center for Internet Security. The CIS Microsoft 365 Foundations Benchmark covers Entra ID, Exchange Online, SharePoint, Teams, and Defender, from multi-factor authentication and Conditional Access to auditing and mail-flow rules, at Level 1 (essential) and Level 2 (defense-in-depth). Nearly every Senserva check carries a CIS mapping, so a scan evidences the benchmark control by control.

Official reference: CIS Microsoft 365 Foundations Benchmark

How Siemserva maps to CIS Benchmark

CIS Benchmark asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:

Identity and access management (60 checks)
At Risk With High Risk User Break Glass Account Disabled User Break Glass Account Is Not Highly Privileged User Break Glass Account Last Password Change User Break Glass User Not Enabled User High Risk User
Multi-factor authentication (42 checks)
Auth User Not MFA Registered Auth Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Password Authentication Method In Use But Not Allowed By Senserva Security Manager Auth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By User Auth Require Passwordless But Its Not Used By User Auth Software Oath Authentication Method In Use But Not Allowed By User
Conditional Access (60 checks)
Conditional Access Admin Portal Missing MFA Conditional Access Break Glass Account Covered By Policy Conditional Access Group Critical Coverage Gap Conditional Access MFA Policy Bypassed Conditional Access User Critical Coverage Gap Conditional Access Block Legacy Exchange Active Sync Not Found
Privileged access (PIM) (34 checks)
PIM Alerts No MFA On Activation Alert PIM Policy Expiration Required PIM Policy Missing For User Role Ai Administrator Assigned Role Standing High Privilege Assignment PIM Alerts License Suspended
Logging and audit (43 checks)
Log Blocked Signin Bad IP Or Too Many Invalid Attempts Log Flagged For Review Log Legacy Auth Protocol Audit CA Change Audit CA Failed Conditional Access Change Audit Failed Authorization Change
Threat detection and risky sign-ins (13 checks)
Risk Detection Anomalous Token Risk Detection Leaked Credentials Risk Detection Malicious IP Address Risk Detection Offline Risk Detection State Confirmed Compromised Risk Detection Token Issuer Anomaly
Device compliance (220 checks)
Intune Device Missing KEV Patch Intune Device Vulnerability KEV Intune Policy Autopatch CVE Gap KEV Device Endpoint Detection And Response Device Has Outdated Android Operating System Device Has Outdated IOS Operating System
Applications and service principals (60 checks)
App Application Disabled By Microsoft Status Sp Critical Graph Permission Sp Risk Detection Malicious Application Sp Risk State Confirmed Compromised Sp Secret Non Expiring Sp Service Principal Disabled By Microsoft Status
Data protection (24 checks)
Purview Audit Log No Records Returned Purview Audit Log Unavailable Purview Label Mandatory Labeling Disabled Purview Label None Configured Purview Retention Label Delete Only Purview SRR Stalled Request

See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.

CIS Benchmark and Microsoft 365: common questions

Does CIS Benchmark apply to Microsoft 365?

CIS Microsoft 365 Foundations Benchmark does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.

How does Siemserva map to CIS Benchmark?

Siemserva runs 556+ Microsoft 365 and Entra ID checks across the areas CIS Benchmark emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.

Is this an official CIS Benchmark certification?

No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.

More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.

The CIS Benchmark for Microsoft 365

What CIS Benchmark is

How Siemserva maps to CIS Benchmark

Identity and access management (60 checks)

Multi-factor authentication (42 checks)

Conditional Access (60 checks)

Privileged access (PIM) (34 checks)

Logging and audit (43 checks)

Threat detection and risky sign-ins (13 checks)

Device compliance (220 checks)

Applications and service principals (60 checks)

Data protection (24 checks)

CIS Benchmark and Microsoft 365: common questions