The CIS Benchmark for Microsoft 365

What CIS Benchmark is

The CIS Benchmarks are consensus-developed, prescriptive configuration baselines from the Center for Internet Security. The CIS Microsoft 365 Foundations Benchmark covers Entra ID, Exchange Online, SharePoint, Teams, and Defender, from multi-factor authentication and Conditional Access to auditing and mail-flow rules, at Level 1 (essential) and Level 2 (defense-in-depth). Nearly every Senserva check carries a CIS mapping, so a scan evidences the benchmark control by control.

How Siemserva maps to CIS Benchmark

CIS Benchmark asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:

• Identity and access management (60 checks)

  At Risk With High RiskUser Break Glass Account DisabledUser Break Glass Account Is Not Highly PrivilegedUser Break Glass Account Last Password ChangeUser Break Glass User Not EnabledUser High Risk User

• Multi-factor authentication (42 checks)

  Auth User Not MFA RegisteredAuth Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Password Authentication Method In Use But Not Allowed By Senserva Security ManagerAuth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Require Passwordless But Its Not Used By UserAuth Software Oath Authentication Method In Use But Not Allowed By User

• Conditional Access (60 checks)

  Conditional Access Admin Portal Missing MFAConditional Access Break Glass Account Covered By PolicyConditional Access Group Critical Coverage GapConditional Access MFA Policy BypassedConditional Access User Critical Coverage GapConditional Access Block Legacy Exchange Active Sync Not Found

• Privileged access (PIM) (34 checks)

  PIM Alerts No MFA On Activation AlertPIM Policy Expiration RequiredPIM Policy Missing For UserRole Ai Administrator AssignedRole Standing High Privilege AssignmentPIM Alerts License Suspended

• Logging and audit (43 checks)

  Log Blocked Signin Bad IP Or Too Many Invalid AttemptsLog Flagged For ReviewLog Legacy Auth ProtocolAudit CA ChangeAudit CA Failed Conditional Access ChangeAudit Failed Authorization Change

• Threat detection and risky sign-ins (13 checks)

  Risk Detection Anomalous TokenRisk Detection Leaked CredentialsRisk Detection Malicious IP AddressRisk Detection OfflineRisk Detection State Confirmed CompromisedRisk Detection Token Issuer Anomaly

• Device compliance (220 checks)

  Intune Device Missing KEV PatchIntune Device Vulnerability KEVIntune Policy Autopatch CVE Gap KEVDevice Endpoint Detection And ResponseDevice Has Outdated Android Operating SystemDevice Has Outdated IOS Operating System

• Applications and service principals (60 checks)

  App Application Disabled By Microsoft StatusSp Critical Graph PermissionSp Risk Detection Malicious ApplicationSp Risk State Confirmed CompromisedSp Secret Non ExpiringSp Service Principal Disabled By Microsoft Status

• Data protection (24 checks)

  Purview Audit Log No Records ReturnedPurview Audit Log UnavailablePurview Label Mandatory Labeling DisabledPurview Label None ConfiguredPurview Retention Label Delete OnlyPurview SRR Stalled Request

See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.

Evidence CIS Benchmark in your own Microsoft 365

Siemserva by Senserva runs the identity, access, privileged-access, and logging checks above, and 650+ others, against your own tenant: it shows where you meet or miss each requirement, ranks the gaps by Severity, and produces audit-ready evidence and validated fixes to close them.