> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/posture-drift-alerts.md).

# Posture Drift Alerts

These alerts fire when Augmentt detects that a security posture check has drifted away from its expected configuration. Every check below is grouped by the benchmark or framework it comes from.

{% hint style="info" %}
Category and severity are uniform across this catalog: every row here is Category **Posture Drift**, and default Severity is **Medium** unless otherwise noted. A handful of checks flagged "Not seeded" below have no default severity seeded in the database — confirm the configured severity in your tenant before relying on a default.
{% endhint %}

**CISA / SCuBA — Microsoft Entra ID baseline**

| Alert                                                                                           | Severity |
| ----------------------------------------------------------------------------------------------- | -------- |
| **Block High Risk Users** `office365_posturedrift_cisa_ms_aad_2_1`                              | Medium   |
| **Block risky sign-ins** `office365_posturedrift_cisa_ms_aad_2_3`                               | Medium   |
| **Phishing-resistant MFA** `office365_posturedrift_cisa_ms_aad_3_1`                             | Medium   |
| **Authenticator login context information** `office365_posturedrift_cisa_ms_aad_3_3`            | Medium   |
| **Disable weakest 2FA authenticators** `office365_posturedrift_cisa_ms_aad_3_5`                 | Medium   |
| **Phishing-resistant MFA for highly privileged roles** `office365_posturedrift_cisa_ms_aad_3_6` | Medium   |
| **Authenticate from managed devices** `office365_posturedrift_cisa_ms_aad_3_7`                  | Medium   |
| **Register MFA from managed devices** `office365_posturedrift_cisa_ms_aad_3_8`                  | Medium   |
| **Only admins allowed to register applications** `office365_posturedrift_cisa_ms_aad_5_1`       | Medium   |
| **Configure application admin consent workflow** `office365_posturedrift_cisa_ms_aad_5_3`       | Medium   |
| **Passwords should not expire** `office365_posturedrift_cisa_ms_aad_6_1`                        | Medium   |
| **Number of Global Admins** `office365_posturedrift_cisa_ms_aad_7_1`                            | Medium   |
| **Least privilege access** `office365_posturedrift_cisa_ms_aad_7_2`                             | Medium   |
| **Hybrid Global Administrators** `office365_posturedrift_cisa_ms_aad_7_3`                       | Medium   |
| **Permanent Highly Privileged Role Assignments** `office365_posturedrift_cisa_ms_aad_7_4`       | Medium   |
| **Highly Privileged Roles Outside of PAM** `office365_posturedrift_cisa_ms_aad_7_5`             | Medium   |
| **Global Admin Role Activation** `office365_posturedrift_cisa_ms_aad_7_6`                       | Medium   |
| **Guest Access Restrictions** `office365_posturedrift_cisa_ms_aad_8_1`                          | Medium   |
| **Guest Invite Settings** `office365_posturedrift_cisa_ms_aad_8_2`                              | Medium   |

**CISA / SCuBA — Exchange Online baseline**

| Alert                                                                                | Severity                                         |
| ------------------------------------------------------------------------------------ | ------------------------------------------------ |
| **List of approved sender IP addresses.** `office365_posturedrift_cisa_ms_exo_2_1`   | Not seeded — confirm before relying on a default |
| **SPF policies** `office365_posturedrift_cisa_ms_exo_2_2`                            | Medium                                           |
| **DMARC policies for second-level domains** `office365_posturedrift_cisa_ms_exo_4_1` | Not seeded — confirm before relying on a default |
| **DMARC message rejection** `office365_posturedrift_cisa_ms_exo_4_2`                 | Medium                                           |
| **DMARC point of contact** `office365_posturedrift_cisa_ms_exo_4_3`                  | Medium                                           |
| **Disable SMTP Auth** `office365_posturedrift_cisa_ms_exo_5_1`                       | Medium                                           |
| **Contact folders sharing** `office365_posturedrift_cisa_ms_exo_6_1`                 | Medium                                           |
| **Calendar sharing** `office365_posturedrift_cisa_ms_exo_6_2`                        | Medium                                           |
| **External sender warnings** `office365_posturedrift_cisa_ms_exo_7_1`                | Medium                                           |
| **Exchange IP allow list** `office365_posturedrift_cisa_ms_exo_12_1`                 | Medium                                           |
| **Turn Off Safe Lists** `office365_posturedrift_cisa_ms_exo_12_2`                    | Medium                                           |

**Entra ID Security Config Analyzer (EIDSCA)**

| Alert                                                                                                    | Severity |
| -------------------------------------------------------------------------------------------------------- | -------- |
| **FIDO2 Security Keys** `office365_posturedrift_eidsca_af01`                                             | Medium   |
| **FIDO2 Self-Service Set Up** `office365_posturedrift_eidsca_af02`                                       | Medium   |
| **Users Can Report Suspicious Activities** `office365_posturedrift_eidsca_ag02`                          | Medium   |
| **Show Application Name in Push and Passwordless Notifications** `office365_posturedrift_eidsca_am06`    | Medium   |
| **Show Geographic Location in Push and Passwordless Notifications** `office365_posturedrift_eidsca_am09` | Medium   |
| **Guest User Access** `office365_posturedrift_eidsca_ap07`                                               | Medium   |
| **User Consent Policy for Applications** `office365_posturedrift_eidsca_ap08`                            | Medium   |
| **Risk-based Step-up Admin Consent for Risky Apps** `office365_posturedrift_eidsca_ap09`                 | Medium   |
| **Users Are Allowed To Create Apps** `office365_posturedrift_eidsca_ap10`                                | Medium   |
| **Read User Information from Directory** `office365_posturedrift_eidsca_ap14`                            | Medium   |
| **Limit Temporary Access Pass to One-Time User** `office365_posturedrift_eidsca_at02`                    | Medium   |
| **Disable Voice Call MFA** `office365_posturedrift_eidsca_av01`                                          | Medium   |
| **Block Risky Apps** `office365_posturedrift_eidsca_cp03`                                                | Medium   |
| **Reviewer App Request Notifications** `office365_posturedrift_eidsca_cr02`                              | Medium   |
| **Reviewer App Request Reminders** `office365_posturedrift_eidsca_cr03`                                  | Medium   |
| **App Request Expiry** `office365_posturedrift_eidsca_cr04`                                              | Medium   |
| **Do Not Allow Banned Passwords** `office365_posturedrift_eidsca_pr01`                                   | Medium   |
| **On-prem Password Protection** `office365_posturedrift_eidsca_pr02`                                     | Medium   |
| **Banned Password List** `office365_posturedrift_eidsca_pr03`                                            | Medium   |
| **Smart Lockout Duration** `office365_posturedrift_eidsca_pr05`                                          | Medium   |
| **Smart Lockout Threshold** `office365_posturedrift_eidsca_pr06`                                         | Medium   |

**Maester test checks**

| Alert                                                                                                 | Severity |
| ----------------------------------------------------------------------------------------------------- | -------- |
| **Require device compliance** `office365_posturedrift_mt_1001`                                        | Medium   |
| **Enforce credential configurations on apps and service principals** `office365_posturedrift_mt_1002` | Medium   |
| **Policy targetting All Apps** `office365_posturedrift_mt_1003`                                       | Medium   |
| **Policy targetting All Apps and All Users** `office365_posturedrift_mt_1004`                         | Medium   |
| **Exclude emergency/break glass account or group** `office365_posturedrift_mt_1005`                   | Medium   |
| **Require security info registration from a trusted location** `office365_posturedrift_mt_1011`       | Medium   |
| **Require new password when user risk is high** `office365_posturedrift_mt_1013`                      | Medium   |
| **Require compliant or Entra hybrid joined devices for admins** `office365_posturedrift_mt_1014`      | Medium   |
| **Block access for unknown or unsupported device platforms** `office365_posturedrift_mt_1015`         | Medium   |
| **Enforce non-persistent browser session for non-corporate devices** `office365_posturedrift_mt_1017` | Medium   |
| **Enforce sign-in frequency for non-corporate devices** `office365_posturedrift_mt_1018`              | Medium   |
| **Application enforced restrictions for unmanaged devices** `office365_posturedrift_mt_1019`          | Medium   |
| **Directory sync accounts & Conditional Access** `office365_posturedrift_mt_1020`                     | Medium   |
| **All users utilizing an Entra ID P1 license should be licensed.** `office365_posturedrift_mt_1022`   | Medium   |
| **All users utilizing an Entra ID P2 license should be licensed.** `office365_posturedrift_mt_1023`   | Medium   |
| **Hybrid user accounts with permanent high privileged roles** `office365_posturedrift_mt_1026`        | Medium   |
| **Unused privileged role assignments** `office365_posturedrift_mt_1030`                               | Medium   |
| **Privileged role on Control Plane are managed by PIM only** `office365_posturedrift_mt_1031`         | Medium   |

**Microsoft Defender for Office 365 (MDO) config checks**

| Alert                                                                                                           | Severity |
| --------------------------------------------------------------------------------------------------------------- | -------- |
| **MDO Allowed senders combined** `office365_posturedrift_mdo_allowedsenderscombined`                            | Medium   |
| **MDO Anti phishing policies** `office365_posturedrift_mdo_antiphishingpolicies`                                | Medium   |
| **MDO At pprotection** `office365_posturedrift_mdo_atpprotection`                                               | Medium   |
| **MDO Auto forwarding mode** `office365_posturedrift_mdo_autoforwardingmode`                                    | Medium   |
| **MDO Blockmail forward** `office365_posturedrift_mdo_blockmailforward`                                         | Medium   |
| **MDO Bulk spam action** `office365_posturedrift_mdo_bulkspamaction`                                            | Medium   |
| **MDO Bulk threshold** `office365_posturedrift_mdo_bulkthreshold`                                               | Medium   |
| **MDO Common attachments filter** `office365_posturedrift_mdo_commonattachmentsfilter`                          | Medium   |
| **MDO Connection filter** `office365_posturedrift_mdo_connectionfilter`                                         | Medium   |
| **MDO Enable domains to protect** `office365_posturedrift_mdo_enabledomainstoprotect`                           | Medium   |
| **MDO Enable mailbox intelligence** `office365_posturedrift_mdo_enablemailboxintelligence`                      | Medium   |
| **MDO High confidence phish action** `office365_posturedrift_mdo_highconfidencephishaction`                     | Medium   |
| **MDO High confidence spam action** `office365_posturedrift_mdo_highconfidencespamaction`                       | Medium   |
| **MDO Mailbox intelligence protection** `office365_posturedrift_mdo_mailboxintelligenceprotection`              | Medium   |
| **MDO Mailbox intelligence protection action** `office365_posturedrift_mdo_mailboxintelligenceprotectionaction` | Medium   |
| **MDO Phish threshold level** `office365_posturedrift_mdo_phishthresholdlevel`                                  | Medium   |
| **MDO Phis spam action** `office365_posturedrift_mdo_phisspamacation`                                           | Medium   |
| **MDO Quarantine retention period** `office365_posturedrift_mdo_quarantineretentionperiod`                      | Medium   |
| **MDO Recipient external limit perhour** `office365_posturedrift_mdo_recipientexternallimitperhour`             | Medium   |
| **MDO Recipient internal limit perhour** `office365_posturedrift_mdo_recipientinternallimitperhour`             | Medium   |
| **MDO Recipient limit perday** `office365_posturedrift_mdo_recipientlimitperday`                                | Medium   |
| **MDO Safe attachment policy** `office365_posturedrift_mdo_safeattachmentpolicy`                                | Medium   |
| **MDO Safe attachments** `office365_posturedrift_mdo_safeattachments`                                           | Medium   |
| **MDO Safe documents** `office365_posturedrift_mdo_safedocuments`                                               | Medium   |
| **MDO Safe links for email** `office365_posturedrift_mdo_safelinksforemail`                                     | Medium   |
| **MDO Safelinks for Office Apps** `office365_posturedrift_mdo_safelinksforofficeapps`                           | Medium   |
| **MDO Similar domains safety tips** `office365_posturedrift_mdo_similardomainssafetytips`                       | Medium   |
| **MDO Similar users safety tips** `office365_posturedrift_mdo_similaruserssafetytips`                           | Medium   |
| **MDO Spam Notifications Only For Admins** `office365_posturedrift_mdo_spam_notifications_only_for_admins`      | Medium   |
| **MDO Spam action** `office365_posturedrift_mdo_spamaction`                                                     | Medium   |
| **MDO Targeted domain protection action** `office365_posturedrift_mdo_targeteddomainprotectionaction`           | Medium   |
| **MDO Targeted user protection action** `office365_posturedrift_mdo_targeteduserprotectionaction`               | Medium   |
| **MDO Targeted users protection** `office365_posturedrift_mdo_targetedusersprotection`                          | Medium   |
| **MDO Threshold reached action** `office365_posturedrift_mdo_thresholdreachedaction`                            | Medium   |
| **MDO Unusual characters safety tips** `office365_posturedrift_mdo_unusualcharacterssafetytips`                 | Medium   |
| **MDO Zap malware** `office365_posturedrift_mdo_zapmalware`                                                     | Medium   |
| **MDO Zap phish** `office365_posturedrift_mdo_zapphish`                                                         | Medium   |
| **MDO Zap spam** `office365_posturedrift_mdo_zapspam`                                                           | Medium   |

**Augmentt CIS M365 benchmark mapping**

| Alert                                                                            | Severity |
| -------------------------------------------------------------------------------- | -------- |
| **Connection filter safe list off** `office365_posturedrift_aug_cis_m365_2_1_13` | Medium   |

**Other Microsoft 365 posture checks**

| Alert                                                                                                 | Severity                                         |
| ----------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| **Idle session timeout** `office365_posturedrift_activitybasedtimeoutpolicy`                          | Medium                                           |
| **Block Sign-in on Shared Mailboxes** `office365_posturedrift_blocksigninsharedmailboxes`             | Medium                                           |
| **Connectedapps admin consent** `office365_posturedrift_connectedappsadminconsent`                    | Medium                                           |
| **Contact settings** `office365_posturedrift_contactsettings`                                         | Medium                                           |
| **Deleted user onedrive retention** `office365_posturedrift_deleteduseronedriveretention`             | Medium                                           |
| **DKIM** `office365_posturedrift_dkim`                                                                | Medium                                           |
| **Enable exchangemodernauth** `office365_posturedrift_enableexchangemodernauth`                       | Medium                                           |
| **Entra ID Guest User Access Permissions** `office365_posturedrift_entraidguestuseraccesspermissions` | Medium                                           |
| **External Mail Tag** `office365_posturedrift_externalmailtag`                                        | Medium                                           |
| **Login portal branding** `office365_posturedrift_loginportalbranding`                                | Medium                                           |
| **Mail box audit** `office365_posturedrift_mailboxaudit`                                              | Medium                                           |
| **MFA campaign** `office365_posturedrift_mfacampaign`                                                 | Medium                                           |
| **MFA number matching** `office365_posturedrift_mfanumbermatching`                                    | Medium                                           |
| **PowerShell access for non-admins** `office365_posturedrift_powershellaccessfornonadmins`            | Not seeded — confirm before relying on a default |
| **Block Direct Send in Exchange Online** `office365_posturedrift_rejectdirectsend`                    | Medium                                           |
| **Resharing by external users** `office365_posturedrift_resharingbyexternalusers`                     | Not seeded — confirm before relying on a default |
| **Risky countries** `office365_posturedrift_riskycountries`                                           | Medium                                           |
| **Risky ips** `office365_posturedrift_riskyips`                                                       | Medium                                           |
| **Self serve password reset** `office365_posturedrift_selfservepasswordreset`                         | Medium                                           |
| **SharePoint external guest sharing** `office365_posturedrift_sharepointexternalguestsharing`         | Medium                                           |
| **Site creation for standard users** `office365_posturedrift_sitecreationforstandardusers`            | Medium                                           |
| **Teams default external options** `office365_posturedrift_teamsdefaultexternaloptions`               | Medium                                           |
| **Temporary access pass** `office365_posturedrift_temporaryaccesspass`                                | Medium                                           |
| **Unified audit log** `office365_posturedrift_unifiedauditlog`                                        | Medium                                           |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/posture-drift-alerts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.