{"id":19260346,"url":"https://github.com/mitre/microsoft-365-foundations-cis-baseline","last_synced_at":"2026-03-07T23:01:47.105Z","repository":{"id":252172357,"uuid":"835372946","full_name":"mitre/microsoft-365-foundations-cis-baseline","owner":"mitre","description":"InSpec profile to validate an M365 account to the standards of the CIS Microsoft 365 Foundations Benchmark.","archived":false,"fork":false,"pushed_at":"2025-12-14T21:01:31.000Z","size":498,"stargazers_count":10,"open_issues_count":3,"forks_count":1,"subscribers_count":19,"default_branch":"main","last_synced_at":"2025-12-17T09:29:31.486Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mitre.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE.md","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-07-29T17:43:25.000Z","updated_at":"2025-12-14T21:01:35.000Z","dependencies_parsed_at":"2024-11-09T19:20:13.611Z","dependency_job_id":"96f4ff6d-be66-4279-a5f1-1014a32041dd","html_url":"https://github.com/mitre/microsoft-365-foundations-cis-baseline","commit_stats":null,"previous_names":["mitre/microsoft-365-foundations-cis-baseline"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/mitre/microsoft-365-foundations-cis-baseline","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fmicrosoft-365-foundations-cis-baseline","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fmicrosoft-365-foundations-cis-baseline/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fmicrosoft-365-foundations-cis-baseline/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fmicrosoft-365-foundations-cis-baseline/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mitre","download_url":"https://codeload.github.com/mitre/microsoft-365-foundations-cis-baseline/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mitre%2Fmicrosoft-365-foundations-cis-baseline/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30236043,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-07T19:01:10.287Z","status":"ssl_error","status_checked_at":"2026-03-07T18:59:58.103Z","response_time":53,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T19:20:05.658Z","updated_at":"2026-03-07T23:01:47.086Z","avatar_url":"https://github.com/mitre.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Microsoft 365 Foundation CIS Benchmark\nThis InSpec Profile was created to facilitate testing and auditing of `CIS Microsoft 365 Benchmark`\ninfrastructure and applications when validating compliancy with [Center for Internet Security (CIS) Benchmark](https://www.cisecurity.org/cis-benchmarks)\nrequirements.\n \n- Profile Version: **3.1.2**\n- Benchmark Date: **2024-04-29**\n- Benchmark Version: **3.1.0**\n \n \nThis profile was developed to reduce the time it takes to perform a security check based upon the\nCIS Guidance from the Center for Internet Security (CIS).\n \nThe CIS Microsoft 365 Foundation CIS Profile uses the [InSpec](https://github.com/inspec/inspec)\nopen-source compliance validation language to support automation of the required compliance, security\nand policy testing for Assessment and Authorization (A\u0026A) and Authority to Operate (ATO) decisions\nand Continuous Authority to Operate (cATO) processes.\n\nThe Microsoft 365 CIS Benchmark includes security requirements for a Microsoft 365 environment.\n \nTable of Contents\n=================\n* [CIS Benchmark  Information](#benchmark-information)\n* [Requirements](#requirements)\n* [Getting Started](#getting-started)\n    * [Intended Usage](#intended-usage)\n    * [Tailoring to Your Environment](#tailoring-to-your-environment)\n    * [Testing the Profile Controls](#testing-the-profile-controls)\n* [Running the Profile](#running-the-profile)\n    * [Directly from Github](#directly-from-github)\n    * [Different Run Options](#different-run-options)\n* [Using Heimdall for Viewing Test Results](#using-heimdall-for-viewing-test-results)\n* [Check Overview](#check-overview)\n \n## Benchmark Information\nThe Center for Internet Security, Inc. (CIS®) create and maintains a set of Critical Security Controls (CIS Controls) for applications, computer systems and networks.\n\nThe original benchmark document that serves as the basis for this automated testing profile can be found at the [CIS Workbench](https://workbench.cisecurity.org) website.\n \n[top](#table-of-contents)\n\n## Requirements\n### Microsoft 365 Credentials\nYour Microsoft 365 admin may need to be contacted to obtain some of these credentials. The following credentials are needed, as highlighted by the [train-pwsh](https://github.com/mitre/train-pwsh) documentation:\n- client_id (id of client)\n- tenant_id (id of tenant)\n- client_secret (secret key for client)\n- certificate_path (path on machine where authentication certificate is stored)\n- certificate_password (password for certificate)\n- organization (organization domain)\n- sharepoint_admin_url (sharepoint url for admin)\n- pwsh_path (path on machine where the PowerShell executable is stored)\n\nSome details to create credentials if you are a Microsoft 365 admin:\n- Create an application registration within your account, which will provide you with the appropriate credentials to login such as Client ID and Tenant ID. You will need to create a Client Secret/Certificate as well. The following link provides more detail on how to setup an application registration: [Application_Registration_Steps](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app?tabs=certificate)\n\n\n### Ensure the Following Permissions on your Application Registration Account\n  Request your Microsoft 365 admin for these permissions to Microsoft 365 modules or enable these permissions if you are the admin:\n  - Microsoft Graph\n    - SecurityEvents.Read.All\n    - User.Read\n    - UserAuthenticationMethod.Read.All\n    - AuditLog.Read.All,\n    - Policy.Read.All\n  - Office 365 Exchange Online\n    - Exchange.ManageAsApp\n  - SharePoint\n    - Sites.FullControl.All\n\n### Required software and steps needed on the InSpec Runner\n- git\n- [PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell?view=powershell-7.4)\n- [InSpec](https://www.chef.io/products/chef-inspec/)\n- [train-pwsh](https://github.com/mitre/train-pwsh)\n- [inspec-pwsh](https://github.com/mitre/inspec-pwsh)\n\nInspec, train-pwsh, inspec-pwsh are already included as gems in this profile and should not need separate downloads. The profile just needs to be ran with bundle exec to ensure the gems are loaded.  \n\nIt is also important to follow/understand the documentation for train-pwsh and inspec-pwsh that is linked above for this profile to run correctly. For context, the train-pwsh is the transport that is used to maintain a persistent connection with various PowerShell sessions. Meanwhile, inspec-pwsh is a resource pack that is used to connect controls using different modules to its corresponding session group (e.g. session for exchange, teams, exchange/graph, etc.). The documentation for inspec-pwsh has more detail about the resource pack. \n\nAdditionally, for train-pwsh, the organization field will also need to be defined as a environment variable named `ORGANIZATION` as it is used in a profile. The train-pwsh documentation has more detail on how to create this environment variable. Additionally, it is important to note that train-pwsh is not being invoked using code in this profile, so the config.json file approach needs to be followed for train to run correctly. The documentation for train-pwsh goes into more detail on how to create the config.json and  populate its contents with your Microsoft 365 credentials that are used by this profile. \n\n### PowerShell Module Installation\nEnsure access and install the following PowerShell modules. The controls also have the module installation code when running the PowerShell queries for redundancy purposes:\n- [Microsoft.Graph](https://learn.microsoft.com/en-us/powershell/microsoftgraph/installation?view=graph-powershell-1.0#installation)\n- [ExchangeOnlineManagement](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell?view=exchange-ps)\n- [PnP.PowerShell](https://learn.microsoft.com/en-us/powershell/sharepoint/sharepoint-pnp/sharepoint-pnp-cmdlets)\n- [MicrosoftTeams](https://learn.microsoft.com/en-us/microsoftteams/teams-powershell-install)\n\n### Test O365 Example\n\nUpon obtaining the right permissions/credentials and downloading the correct modules/software, test that these permissions work by running the o365_example_baseline profile available at the following link: [O365 Profile](https://github.com/mitre/o365_example_baseline). If the o365 profile runs correctly, then this profile should be able to ran correctly. The o365_example_baseline profile contains a subset of controls from this profile, and also leverages `train-pwsh` and `inspec-pwsh`. It should serve as a good test to ensure that `train-pwsh` and `inspec-pwsh` are working properly. \n\nMore details on how to use `train-pwsh` and `inspec-pwsh` are detailed below:\n\n- [train-pwsh](https://github.com/mitre/train-pwsh)\n- [inspec-pwsh](https://github.com/mitre/inspec-pwsh)\n\n## Getting Started  \n### InSpec (CINC Auditor) setup\nFor maximum flexibility/accessibility, CINC Auditor (`cinc-auditor`) is the executable program that should be used to run this testing profile.\n\nCINC Auditor is the open-source packaged binary version of Chef InSpec,\ncompiled by the CINC (CINC Is Not Chef) project in coordination with Chef using Chef's always-open-source InSpec source code. CINC Auditor and InSpec are built from the same source code and function identically, but CINC Auditor requires no license to use (which means it also does not come with any expectation of support from Chef).\n\nFor more information see [CINC Home](https://cinc.sh/)\n \nIt is intended and recommended that CINC Auditor and this profile executed from a __\"runner\"__ host\n(such as a DevOps orchestration server, an administrative management system, or a developer's workstation/laptop)\nagainst the target. This can be any Unix/Linux/MacOS or Windows runner host, with access to the Internet.\n \n\u003e [!TIP]\n\u003e **For the best security of the runner, always install on the runner the latest version of CINC Auditor and any other supporting language components.**\n \nTo install CINC Auditor on a UNIX/Linux/MacOS platform use the following command:\n```bash\ncurl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor\n```\n \nTo install CINC Auditor on a Windows platform (PowerShell) use the following command:\n```powershell\n. { iwr -useb https://omnitruck.cinc.sh/install.ps1 } | iex; install -project cinc-auditor\n```\n \nTo confirm successful install of CINC Auditor:\n```\ncinc-auditor -v\n```\n \nLatest versions and other installation options are available at [CINC Auditor](https://cinc.sh/start/auditor/)'s website.\n \n[top](#table-of-contents)\n### Intended Usage\n1. The latest `released` version of the profile is intended for use in A\u0026A testing, as well as\n    providing formal results to Authorizing Officials and Identity and Access Management (IAM)s.\n    Please use the `released` versions of the profile in these types of workflows.\n \n2. The `main` branch is a development branch that will become the next release of the profile.\n    The `main` branch is intended for use in _developing and testing_ merge requests for the next\n    release of the profile, and _is not intended_ be used for formal and ongoing testing on systems.\n \n[top](#table-of-contents)\n### Tailoring to Your Environment\nThis profile uses InSpec Inputs to provide flexibility during testing. Inputs allow for\ncustomizing the behavior of Chef InSpec profiles.\n \nInSpec Inputs are defined in the `inspec.yml` file. The `inputs` configured in this\nfile are **profile definitions and defaults for the profile** extracted from the profile\nguidances and contain metadata that describe the profile, and shouldn't be modified.\n \nInSpec provides several methods for customizing profile behaviors at run-time that does not require\nmodifying the `inspec.yml` file itself (see [Using Customized Inputs](#using-customized-inputs)).\n \nThe following inputs are permitted to be configured in an inputs `.yml` file (often named inputs.yml)\nfor the profile to run correctly on a specific environment, while still complying with the security\nguidance document intent. This is important to prevent confusion when test results are passed downstream\nto different stakeholders under the *security guidance name used by this profile repository*\n \nFor changes beyond the inputs cited in this section, users can create an *organizationally-named overlay repository*.\nFor more information on developing overlays, reference the [MITRE SAF Training](https://mitre-saf-training.netlify.app/courses/beginner/10.html)\n \n#### Example of tailoring Inputs *While Still Complying* with the security guidance document for the profile:\n \n```yaml\n#Controls using this input:\n#1.3.1\n- name: org_domain\n  sensitive: true\n  description: 'Domain for organization'\n  type: String\n  required: true\n\n#Controls using this input:\n#2.1.6\n- name: notify_outbound_spam_recipients\n  sensitive: true\n  description: 'Email address to notify administrator for Exchange Online Spam Policies'\n  type: Array\n  required: true\n\n#Controls using this input:\n#2.1.6\n- name: bcc_suspicious_outbound_additional_recipients\n  sensitive: true\n  description: 'BCC email address to notify additional recipients for Exchange Online Spam Policies'\n  type: Array\n  required: true\n\n#Controls using this input:\n#2.1.8\n- name: spf_domains\n  sensitive: true\n  description: 'Array of domains needed to check for SPF record'\n  type: Array\n  required: true\n\n#Controls using this input:\n#2.1.10\n- name: dmarc_domains\n  sensitive: true\n  description: 'Array of DMARC records to check'\n  type: Array\n  required: true\n\n#Controls using this input:\n#2.1.10\n- name: reporting_mail_address\n  sensitive: true\n  description: 'Reporting mail address needed for DMARC check'\n  type: String\n  required: true\n\n#Controls using this input:\n#3.2.2\n- name: permitted_exceptions_teams_locations\n  sensitive: true\n  description: 'Permitted exceptions for teams locations'\n  type: Array\n  required: true\n\n#Controls using this input:\n#6.2.1\n- name: internal_domains_transport_rule\n  sensitive: true\n  description: 'Domains internal to the organization to be checked'\n  type: Array\n  required: true\n\n#Controls using this input:\n#6.2.3\n- name: email_addresses_bypass_external_tagging\n  sensitive: true\n  description: 'Email address list that are allowed to bypass external tagging'\n  type: Array\n  required: true\n\n#Controls using this input:\n#6.5.2\n- name: mailtipslargeaudiencethreshold_value\n  sensitive: true\n  description: 'MailTipsLargeAudienceThreshold value to check for in MailTips setting'\n  required: true\n\n#Controls using this input:\n#6.5.2\n- name: authorized_domains_teams_admin_center\n  sensitive: true\n  description: 'List of authorized domains for AllowedDomains option in Teams Admin Center'\n  type: Array\n  required: true\n\n#Controls using this input:\n#8.6.1\n- name: reporting_email_addresses_for_malicious_messages\n  sensitive: true\n  description: 'Email addresses to check to report malicious messages in Teams and Defender'\n  type: Array\n  required: true\n\n#Controls using this input:\n#7.2.6\n- name: domains_trusted_by_organization\n  sensitive: true\n  description: 'Domains that are trusted by organization in SharePoint'\n  type: Array\n  required: true\n\n#Controls using this input:\n#7.2.9\n- name: external_user_expiry_in_days_spo_threshold\n  sensitive: true\n  description: 'Threshold in days to check for external user expiry in SharePoint'\n  value: 30\n  required: true\n\n#Controls using this input:\n#7.2.10\n- name: email_attestation_re_auth_days_spo_threshold\n  sensitive: true\n  description: 'Threshold in days to check for email attestation auth in SharePoint'\n  value: 15\n  required: true\n\n#Controls using this input:\n#7.3.2\n- name: trusted_domains_guids\n  sensitive: true\n  description: 'Domain GUIDs trusted from the on premises environment'\n  type: Array\n  required: true\n```\n \n\u003e [!NOTE]\n\u003eInputs are variables that are referenced by control(s) in the profile that implement them.\n They are declared (defined) and given a default value in the `inspec.yml` file.\n \n#### Using Customized Inputs\nCustomized inputs may be used at the CLI by providing an input file or a flag at execution time.\n \n1. Using the `--input` flag\n \n    Example: `[inspec or cinc-auditor] exec \u003cmy-profile.tar.gz\u003e --input disable_slow_controls=true`\n \n2. Using the `--input-file` flag.\n   \n    Example: `[inspec or cinc-auditor] exec \u003cmy-profile.tar.gz\u003e --input-file=\u003cmy_inputs_file.yml\u003e`\n \n\u003e[!TIP]\n\u003e For additional information about `input` file examples reference the [MITRE SAF Training](https://mitre.github.io/saf-training/courses/beginner/06.html#input-file-example)\n \nChef InSpec Resources:\n- [InSpec Profile Documentation](https://docs.chef.io/inspec/profiles/).\n- [InSpec Inputs](https://docs.chef.io/inspec/profiles/inputs/).\n- [inspec.yml](https://docs.chef.io/inspec/profiles/inspec_yml/).\n \n \n[top](#table-of-contents)\n### Testing the Profile Controls\nThe Gemfile provided contains all the necessary ruby dependencies for checking the profile controls.\n#### Requirements\nAll action are conducted using `ruby` (gemstone/programming language). Currently `inspec`\ncommands have been tested with ruby version 3.1.2. A higher version of ruby is not guaranteed to\nprovide the expected results. Any modern distribution of Ruby comes with Bundler preinstalled by default.\n \nInstall ruby based on the OS being used, see [Installing Ruby](https://www.ruby-lang.org/en/documentation/installation/)\n \nAfter installing `ruby` install the necessary dependencies by invoking the bundler command\n(must be in the same directory where the Gemfile is located):\n```bash\nbundle install\n```\n \n#### Testing Commands\n \nLinting and validating controls:\n```bash\n  bundle exec rake [inspec or cinc-auditor]:check # Validate the InSpec Profile\n  bundle exec rake lint                            # Run RuboCop Linter\n  bundle exec rake lint:auto_correct       # Autocorrect RuboCop offenses (only when it's safe)\n  bundle exec rake pre_commit_checks  # Pre-commit checks\n```\n \nEnsure the controls are ready to be committed into the repo:\n```bash\n  bundle exec rake pre_commit_checks\n```\n \n \n[top](#table-of-contents)\n## Running the Profile\n**Note**: Replace the profile's directory name - e.g. - `\u003cProfile\u003e` with `.` if currently in the profile's root directory.\n**Note 2**: The `\u003cName of Dictionary Storing Pwsh Options\u003e` will be `pwsh-options` if exactly following train-pwsh documentation.\n```sh\nbundle exec cinc-auditor exec \u003cProfile\u003e -t pwsh://\u003cName of Dictionary Storing Pwsh Options\u003e --controls=\u003ccontrol_id\u003e --enhanced-outcomes --input-file=inputs.yml\n```\n\n#### Execute a Single Control and save results as JSON \n```sh\nbundle exec cinc-auditor exec \u003cProfile\u003e -t pwsh://\u003cName of Dictionary Storing Pwsh Options\u003e\u003e --controls=\u003ccontrol_id\u003e --enhanced-outcomes --input-file=inputs.yml --reporter json:results.json\n```\n\n#### Execute All Controls in the Profile \n```sh\nbundle exec cinc-auditor exec \u003cProfile\u003e -t pwsh://\u003cName of Dictionary Storing Pwsh Options\u003e\u003e --enhanced-outcomes --input-file=inputs.yml\n```\n\n#### Execute all the Controls in the Profile and save results as JSON \n```sh\nbundle exec cinc-auditor exec \u003cProfile\u003e -t pwsh://\u003cName of Dictionary Storing Pwsh Options\u003e\u003e --enhanced-outcomes --input-file=inputs.yml --reporter json:results.json\n```\n[top](#table-of-contents)\n\n## Different Run Options\n \n[Full exec options](https://docs.chef.io/inspec/cli/#options-3)\n \n[top](#table-of-contents)\n\n## Using Heimdall for Viewing Test Results\nThe JSON results output file can be loaded into **[Heimdall-Lite](https://heimdall-lite.mitre.org/)**\nor **[Heimdall-Server](https://github.com/mitre/heimdall2)** for a user-interactive, graphical view of the profile scan results.\n \nHeimdall-Lite is a `browser only` viewer that allows you to easily view your results directly and locally rendered in your browser.\nHeimdall-Server is configured with a `data-services backend` allowing for data persistency to a database (PostgreSQL).\nFor more detail on feature capabilities see [Heimdall Features](https://github.com/mitre/heimdall2?tab=readme-ov-file#features)\n \nHeimdall can **_export your results into a DISA Checklist (CKL) file_** for easily uploading into eMass using the `Heimdall Export` function.\n \nDepending on your environment restrictions, the [SAF CLI](https://saf-cli.mitre.org) can be used to run a local docker instance\nof Heimdall-Lite via the `saf view:heimdall` command.\n \nAdditionally both Heimdall applications can be deployed via docker, kubernetes, or the installation packages.\n## Check Overview\n\n### Microsoft 365 Services\n\nThis profile evaluates the Microsoft 365 CIS Benchmark compliance of the following Microsoft 365 administrative centers by evaluating their setting configurations:\n\n- Microsoft 365 Admin Center\n- Microsoft 365 Defender\n- Microsoft Purview\n- Microsoft Entra Admin Center\n- Microsoft Exchange Admin Center\n- Microsoft SharePoint Admin Center\n- Microsoft Fabric\n\n### Control and Automation Status\n\nNot all controls in the CIS Benchmark are capable of automated assessment. The table below marks which controls are automated and which ones are manual.\n\n| Control   | Automation Status |\n|-----------|-------------------|\n| 1.1.1     | Manual            |\n| 1.1.2     | Manual            |\n| 1.1.3     | Automated         |\n| 1.1.4     | Manual            |\n| 1.2.1     | Automated         |\n| 1.2.2     | Automated         |\n| 1.3.1     | Automated         |\n| 1.3.2     | Manual            |\n| 1.3.3     | Automated         |\n| 1.3.4     | Manual            |\n| 1.3.5     | Manual            |\n| 1.3.6     | Automated         |\n| 1.3.7     | Manual            |\n| 1.3.8     | Manual            |\n| 2.1.1     | Automated         |\n| 2.1.2     | Automated         |\n| 2.1.3     | Automated         |\n| 2.1.4     | Automated         |\n| 2.1.5     | Automated         |\n| 2.1.6     | Automated         |\n| 2.1.7     | Automated         |\n| 2.1.8     | Automated         |\n| 2.1.9     | Automated         |\n| 2.1.10    | Automated         |\n| 2.1.11    | Manual            |\n| 2.1.12    | Manual            |\n| 2.1.13    | Manual            |\n| 2.1.14    | Automated         |\n| 2.3.1     | Manual            |\n| 2.3.2     | Manual            |\n| 2.4.1     | Manual            |\n| 2.4.2     | Manual            |\n| 2.4.3     | Manual            |\n| 2.4.4     | Automated         |\n| 3.1.1     | Automated         |\n| 3.1.2     | Manual            |\n| 3.2.1     | Manual            |\n| 3.2.2     | Automated         |\n| 3.3.1     | Manual            |\n| 5.1.1.1   | Automated         |\n| 5.1.2.1   | Manual            |\n| 5.1.2.2   | Automated         |\n| 5.1.2.3   | Automated         |\n| 5.1.2.4   | Manual            |\n| 5.1.2.5   | Manual            |\n| 5.1.2.6   | Manual            |\n| 5.1.3.1   | Automated         |\n| 5.1.5.1   | Manual            |\n| 5.1.5.2   | Automated         |\n| 5.1.5.3   | Manual            |\n| 5.1.6.1   | Manual            |\n| 5.1.8.1   | Automated         |\n| 5.2.2.1   | Manual            |\n| 5.2.2.2   | Manual            |\n| 5.2.2.3   | Automated         |\n| 5.2.2.4   | Manual            |\n| 5.2.2.5   | Manual            |\n| 5.2.2.6   | Manual            |\n| 5.2.2.7   | Manual            |\n| 5.2.2.8   | Manual            |\n| 5.2.3.1   | Manual            |\n| 5.2.3.2   | Manual            |\n| 5.2.3.3   | Manual            |\n| 5.2.3.4   | Automated         |\n| 5.2.4.1   | Manual            |\n| 5.2.4.2   | Manual            |\n| 5.2.6.1   | Manual            |\n| 5.3.1     | Manual            |\n| 5.3.2     | Manual            |\n| 5.3.3     | Manual            |\n| 6.1.1     | Automated         |\n| 6.1.2     | Automated         |\n| 6.1.3     | Automated         |\n| 6.1.4     | Automated         |\n| 6.2.1     | Automated         |\n| 6.2.2     | Automated         |\n| 6.2.3     | Automated         |\n| 6.3.1     | Automated         |\n| 6.4.1     | Manual            |\n| 6.5.1     | Automated         |\n| 6.5.2     | Automated         |\n| 6.5.3     | Automated         |\n| 7.2.1     | Automated         |\n| 7.2.2     | Automated         |\n| 7.2.3     | Automated         |\n| 7.2.4     | Automated         |\n| 7.2.5     | Automated         |\n| 7.2.6     | Automated         |\n| 7.2.7     | Automated         |\n| 7.2.8     | Manual            |\n| 7.2.9     | Automated         |\n| 7.2.10    | Automated         |\n| 7.3.1     | Automated         |\n| 7.3.2     | Automated         |\n| 7.3.3     | Manual            |\n| 7.3.4     | Automated         |\n| 8.1.1     | Automated         |\n| 8.1.2     | Automated         |\n| 8.2.1     | Automated         |\n| 8.4.1     | Manual            |\n| 8.5.1     | Automated         |\n| 8.5.2     | Automated         |\n| 8.5.3     | Automated         |\n| 8.5.4     | Automated         |\n| 8.5.5     | Automated         |\n| 8.5.6     | Automated         |\n| 8.5.7     | Automated         |\n| 8.5.8     | Automated         |\n| 8.6.1     | Automated         |\n| 9.1.1     | Manual            |\n| 9.1.2     | Manual            |\n| 9.1.3     | Manual            |\n| 9.1.4     | Manual            |\n| 9.1.5     | Manual            |\n| 9.1.6     | Manual            |\n| 9.1.7     | Manual            |\n| 9.1.8     | Manual            |\n| 9.1.9     | Manual            |\n\nFor any controls marked as 'Manual', please refer to the following following at [SAF-CLI](https://saf-cli.mitre.org/) on how to apply manual attestations to the output of an automated assessment. The following [link](https://vmware.github.io/dod-compliance-and-automation/docs/automation-tools/safcli/) that references the SAF-CLI is also useful.\n\n[top](#table-of-contents)\n\n## Authors\n[Center for Internet Security (CIS)](https://www.cisecurity.org/)\n \n[MITRE Security Automation Framework Team](https://saf.mitre.org)\n \n## NOTICE\n \n© 2018-2025 The MITRE Corporation.\n \nApproved for Public Release; Distribution Unlimited. Case Number 18-3678.\n \n## NOTICE\n \nMITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.\n \n## NOTICE  \n \nThis software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.  \n \nNo other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.\n \nFor further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA  22102-7539, (703) 983-6000.\n \n## NOTICE\n[CIS Benchmarks are published by Center for Internet Security](https://www.cisecurity.org/cis-benchmarks)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fmicrosoft-365-foundations-cis-baseline","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmitre%2Fmicrosoft-365-foundations-cis-baseline","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmitre%2Fmicrosoft-365-foundations-cis-baseline/lists"}