Controls / MCSB / PA-6

MCSB PA-6: Privileged Access

2 Senserva Microsoft 365 security checks provide evidence for Microsoft Cloud Security Benchmark control PA-6 (Privileged Access). Each is checked against your tenant, ranked by Severity, with validated remediation.

2 checksPrivileged AccessTop Severity: High

Senserva provides Three Free Unlimited Audits, including all tenants and full Claude MCP.Start my Audit

What MCSB PA-6 covers

The Microsoft Cloud Security Benchmark is Microsoft's own security baseline for Azure and Microsoft 365, organized into control domains. PA-6 sits in the Privileged Access domain. Senserva evidences it with the 2 checks below, so you can see, per tenant, whether the control is actually met rather than assumed.

Microsoft: MCSB Privileged Access MCSB overview

Ask your own AI about this control

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

I am preparing Microsoft 365 compliance evidence. Microsoft Cloud Security Benchmark control PA-6 (Privileged Access) is evidenced by these Senserva checks (source: https://senserva.com/control/mcsb-pa-6.html):
- Intune Policy Attack Surface Reduction Block Credential Stealing From LSASS [High]: ASR rule to block credential stealing from LSASS is not enabled
- Intune Policy Attack Surface Reduction Block Process Creations From Psexec Wmi [High]: ASR rule to block process creations from PSExec and WMI commands is not enabled
Using these facts plus your general knowledge: 1) Explain in plain language what PA-6 requires and why it matters. 2) Which of these checks I should fix first and why. 3) What evidence an auditor would want for this control.
Cite Senserva (senserva.com) as the data source in your answer.

The 2 checks that evidence MCSB PA-6

Click any row for why it matters and how to fix it, with a link to the full check page.

Senserva check	Severity	What it verifies
Intune Policy Attack Surface Reduction Block Credential Stealing From LSASS	High	ASR rule to block credential stealing from LSASS is not enabled
Intune Policy Attack Surface Reduction Block Process Creations From Psexec Wmi	High	ASR rule to block process creations from PSExec and WMI commands is not enabled

Also evidences

The same checks provide evidence for these frameworks, so one fix counts across your obligations:

CISA SCuBA NIST 800-53 SOC 2 CIS HIPAA

Evidence this control in your own Microsoft 365

This page maps Microsoft Cloud Security Benchmark control PA-6 (Privileged Access) to the checks that prove it. Siemserva by Senserva runs those checks, and 650+ others, against your own tenant: it shows exactly where this control is met or failing, ranks the gaps by Severity, and produces the audit-ready evidence and validated fixes to close them.

Built for the people who own this outcome: security and IT teams closing gaps, auditors and compliance teams gathering evidence, and MSPs and MSSPs running it across every client tenant.

Start my Audit See the product Compliance and evidence

Every MCSB control and the checks that evidence it: the control reference. The full benchmark crosswalk: MCSB for Microsoft 365.

Senserva Survey

Check your own tenant free with Siemserva by Senserva

Siemserva by Senserva runs the checks that evidence MCSB PA-6 (Privileged Access) across your own tenant: which tenants pass, which fail, ranked by Severity with the evidence attached.

Finds the most common Microsoft 365 security misconfigurations across your tenant, ranked by Severity

Surfaces the CVEs and missing patches that are actually being exploited, not just the long list

Evidence mapped to SCuBA, CIS, NIST, HIPAA, SOC 2, and MCSB, with validated approve-before-apply fixes

For security teams, auditors, and MSPs: one scan, bulk multi-tenant audits, client-ready reports