MCSB IM-4: Identity Management
5 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control IM-4 (Identity Management). Each is checked against your tenant, ranked by Severity, with validated remediation.
What MCSB IM-4 covers
The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. IM-4 sits in the Identity Management domain. Senserva evidences it with the 5 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.
Ask your own AI about this control
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
The 5 checks that evidence MCSB IM-4
Click any row for why it matters and how to fix it, with a link to the full check page.
| Senserva check | Severity | What it verifies |
|---|---|---|
| Sub Foreign Group Role Assignment | High | Foreign group (outside the tenant) has a role assignment on the subscription |
| Access Guest With Roles | Medium | Guest (external) user has been assigned directory roles in the tenant. Guest accounts with roles expand the attack surface from external identities |
| Access Non Employee With Roles | Medium | Non-employee user (non-member type) has been assigned directory roles |
| User Not Enabled Guest With Roles Or License | Medium | Guest user is not enabled but has roles or licenses assigned |
| Conditional Access MFA For Guest Found | Info | A Conditional Access policy enforcing MFA for guest/external users was found |
Also evidences
The same checks provide evidence for these frameworks, so one fix counts across your obligations:
Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.