MCSB AM-2: Asset Management
14 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control AM-2 (Asset Management). Each is checked against your tenant, ranked by Severity, with validated remediation.
Senserva provides Three Free Unlimited Audits, including all tenants and full Claude MCP.Start my Audit
What MCSB AM-2 covers
The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. AM-2 sits in the Asset Management domain. Senserva evidences it with the 14 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.
Ask your own AI about this control
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
The 14 checks that evidence MCSB AM-2
Click any row for why it matters and how to fix it, with a link to the full check page.
| Senserva check | Severity | What it verifies |
|---|---|---|
| License Missing Licenses Required For Highly Privileged Account | High | Highly privileged account (e.g., Global Admin) is missing licenses required by the security baseline. These accounts need maximum protection features enabled |
| Missing User Optional License Match | High | User is missing optional (recommended) licenses defined in the security baseline |
| Sub Past Due | High | Azure subscription is in "Past Due" state. Payment issues may disrupt service |
| Sub Spending Limit Off | High | Azure subscription spending limit is off. No cost cap in place |
| Sub Warned | High | Azure subscription is in "Warned" state |
| License Missing Licenses Required For Privileged Account | Medium | Privileged account is missing licenses required by the security baseline (e.g., Entra ID P1/P2 for Conditional Access and PIM) |
| License Organization Subscribed To Required SKU Missing | Medium | A required license SKU or service plan defined in the security baseline is not present in the tenant |
| License SKU Suspended | Medium | SKU subscription is suspended. Security features provided by this license are inactive for all assigned users |
| Sub Deleted | Medium | Azure subscription is deleted. Resources permanently removed |
| Sub Disabled | Medium | Azure subscription is disabled. Resources are inaccessible |
| Sub Spending Limit Current Period Off | Medium | Azure subscription spending limit is off for the current billing period |
| License Organization Subscribed To Optional SKU Missing | Low | An optional (recommended) license SKU or service plan is not present in the tenant |
| Group Empty | Info | Group has zero members across users, nested groups, and service principals |
| License Tracked Licenses Found | Info | Tracked license SKUs found in the tenant. Reports which monitored licenses are present |
Also evidences
The same checks provide evidence for these frameworks, so one fix counts across your obligations:
Evidence this control in your own Microsoft 365
This page maps Microsoft Cloud Security Benchmark control AM-2 (Asset Management) to the checks that prove it. Siemserva by Senserva runs those checks, and 650+ others, against your own tenant: it shows exactly where this control is met or failing, ranks the gaps by Severity, and produces the audit-ready evidence and validated fixes to close them.
Built for the people who own this outcome: security and IT teams closing gaps, auditors and compliance teams gathering evidence, and MSPs and MSSPs running it across every client tenant.
Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.