Controls / MCSB / ES-8

MCSB ES-8: Endpoint Security

9 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control ES-8 (Endpoint Security). Each is checked against your tenant, ranked by Severity, with validated remediation.

9 checksEndpoint SecurityTop Severity: High

What MCSB ES-8 covers

The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. ES-8 sits in the Endpoint Security domain. Senserva evidences it with the 9 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.

Microsoft: MCSB Endpoint SecurityMCSB overview

Ask your own AI about this control

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

The 9 checks that evidence MCSB ES-8

Click any row for why it matters and how to fix it, with a link to the full check page.

Senserva checkSeverityWhat it verifies
Intune Policy Compliance Code Integrity EnabledHighCode Integrity is not required by device compliance policy
Intune Policy Compliance Device Health Attestation RequiredHighDevice Health Attestation is not required by device compliance policy
Intune Policy Compliance Early Launch Anti Malware EnabledHighEarly Launch Anti-Malware (ELAM) is not required by device compliance policy
Intune Policy Compliance Firmware Protection EnabledHighFirmware protection is not required by device compliance policy
Intune Policy Compliance Kernel Dma Protection EnabledHighKernel DMA Protection is not required by device compliance policy
Intune Policy Compliance Memory Integrity EnabledHighMemory Integrity (HVCI) is not required by device compliance policy
Intune Policy Compliance Secure Boot RequiredHighSecure Boot is not required by device compliance policy
Intune Policy Compliance Tpm RequiredHighTPM (Trusted Platform Module) is not required by device compliance policy
Intune Policy Compliance Vbs EnabledHighVirtualization-Based Security (VBS) is not required by device compliance policy

Also evidences

The same checks provide evidence for these frameworks, so one fix counts across your obligations:

CISA SCuBANIST 800-53SOC 2CISHIPAA

Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.

Sponsored by Senserva

Siemserva by Senserva runs the checks that evidence MCSB ES-8 (Endpoint Security) across your own tenant: which tenants pass, which fail, ranked by Severity with the evidence attached.

  • 650+ Microsoft 365, Intune, Defender, and Entra ID checks in one scan
  • Findings mapped to SCuBA, CIS, NIST, HIPAA, SOC 2, and MCSB for audit-ready evidence
  • Senserva Trustworthy AI driven configuration remediation: validated, approve-before-apply fixes
  • Multi-tenant and MSP practices, with bulk tenant audits and client-ready reporting
Siemserva by Senserva
Compliance Status Report
MCSB ES-8 (Endpoint Security) across 2 tenants, ranked by Severity
23
FAILING
87
PASSING
41
OTHER FINDINGS
Estimated report, sample data for illustration
Get Going with Senserva Senserva compliance Built for IT admins, security teams, and auditors, with audit-ready evidence. Senserva is a Microsoft Intelligent Security Association member.
Microsoft 365 compliance and audit evidence
How a control becomes audit evidence, click to play

From finding to audit evidence, in two minutes. Watch page · All videos.

Reference: the compliance frameworks crosswalk, the check reference, and the audit guide.
Data notice: control mappings describe which Siemserva checks provide evidence for a control and are informational only, without warranty. They do not constitute compliance advice or certification; confirm requirements with your assessor. All use is subject to the Senserva EULA.