> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/stonly-import-secure-security-posture/posture-checks-reference.md). # Posture Checks Reference *Source guide title in Stonly: "Getting Started".* This article explains how Augmentt processes compliance, and how each check weighs towards your Posture Recommendations score. ## Posture Recommendations This section gives you an at-a-glance overview of the compliance of your Secure checks for your tenants. Augmentt has integrated Maester.dev's project to provide a wide breadth of additional security recommendations. Maester is an open-source project aimed at auditing Microsoft Security, spearheaded by a Microsoft Security Product Manager. Augmentt extends Maester's checks with multi-tenant capabilities, compliance mapping and secure-score mapping, while allowing you to implement recommendations with our configuration options and Conditional Access Policy manager. ## Admin MFA **Description:** Verifies all admin accounts' MFA requirement, including Security Defaults, Conditional Access Policies or Per-User MFA and DUO in its logic. **Why:** Requiring multi-factor authentication (MFA) for all Microsoft Entra ID accounts with privileged roles makes it harder for attackers to access accounts. If any of those accounts are compromised, critical devices and data will be open to attacks. **How it works:** * **Security Defaults** — if enabled for a tenant, the configuration status appears as Security Defaults and all users are considered Protected. Typically used by tenants without Entra ID P1 licensing; we are unable to read the MFA registration status of these tenants because the API is behind the Entra ID P1 paywall. We therefore indicate all users as Protected so you can show that your part of the work has been completed by having Security Defaults, and hence MFA, enabled. * **Legacy (Per User) MFA** — being deprecated by Microsoft. Augmentt recommends moving clients to Security Defaults or Conditional Access before Microsoft fully deprecates this feature. * **Conditional Access** — Augmentt reads all conditional access policies and identifies those applying a grant type of "Require MFA" or "Authentication Strength". The users, groups and roles are extrapolated from these policies and the related users verified for registration status. Users with MFA enforcement via Conditional Access who have completed successful registration are considered protected. * **Conditional Access & DUO** — following similar logic, Augmentt extrapolates policies with a grant type of "RequireDUOMFA". If the related users have a successful DUO registration and are not in bypassed mode, they are considered protected. DUO for Microsoft Entra ID requires a Conditional Access Policy actively enforcing DUO MFA — make sure this is in place, as its absence causes inconsistent reporting. Non-registered and bypassed users are Not protected. **Minimum Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## User MFA **Description:** Verifies all user (non-admin) accounts' MFA requirement, including Security Defaults, Conditional Access Policies or Per-User MFA in its logic. **Why:** Requiring MFA for all user accounts helps protect devices and data accessible to these users. Adding more authentication methods, such as a phone token or a badge, increases the level of protection in the event that one factor is compromised. **How it works:** identical to Admin MFA above — Security Defaults, Legacy (Per User) MFA, Conditional Access, and Conditional Access with DUO. Non-registered and bypassed users are Not protected. **Minimum Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Login Portal Branding **Description:** Verifies if Login Portal Logo and Banner are configured. **Why:** Use your organization's logo and custom color schemes to provide a consistent look-and-feel on your Microsoft Entra ID sign-in pages. This allows users to more easily identify fake logins and phishing attempts. The configurations are applied under Default Sign-In Experience: * **Compliant:** Both company logo and a custom background image were added. * **Partially Compliant:** Company logo *or* a custom background image added. * **Not Compliant:** No company logo nor a custom background image added. **Minimum Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Self Service Password Reset **Description:** Verifies if the Self Service Password Reset feature is enabled. **Why:** Enabling SSPR allows users to reset their passwords without relying on administrators, reducing helpdesk requests and minimizing downtime. It also strengthens security by allowing users to change compromised passwords quickly, reducing the likelihood of password-related phishing attacks, and enabling administrators to focus on more critical tasks. **Minimum Microsoft Licensing:** Requires Premium (P1) licensing **Secure Score impact:** Yes ## Block Legacy Authentication **Description:** Verifies if a Block Legacy Authentication protocol is applied. Augmentt locates protocols blocking Legacy Authentication Clients and extrapolates the users of the conditional access policy to determine which users are successfully blocked. The protocols can be applied via: * Organizations with Basic licensing — blocking via Security Defaults * Organizations with Microsoft Entra ID P1 or P2 licenses — blocking via Conditional Access Policy **Why:** Blocking legacy authentication makes it harder for attackers to gain access. Legacy means clients that support either Microsoft Online Sign-in Assistant or basic authentication, and do not support MFA. **Minimum Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Inactive Accounts **Description:** Identifies accounts that have not had any activity for 30 days by looking at the Microsoft Entra ID sign-in logs as well as the actual app usage of Outlook, SharePoint, OneDrive and Teams from the Microsoft App Usage Report. **Why:** Deleting or blocking accounts that haven't been used in the last 30 days, after checking with owners, helps prevent unauthorized use of inactive accounts. These accounts can be targets for attackers looking to access your data without being noticed. * **Configured:** 0 accounts identified as inactive — scores 1 point * **Not Configured:** at least 1 account identified as inactive — scores 0 points **Microsoft Licensing:** Requires Premium (P1) licensing **Secure Score impact:** No ## Teams Default External/Guest Options **Description:** Verifies if Teams is configured to allow external communication by default on three settings: * "Users can communicate with other Skype for Business and Teams users" — compliant when set to Disabled * "Users can communicate with Skype users" — compliant when set to Disabled * "Allow guest access in Teams" — compliant when set to Disabled **Why:** External collaboration through Teams can leave your organization open to security risks such as uncontrolled file sharing and sensitive data leakage. Employees should be making a conscious decision and assessing the risks when collaborating externally, rather than being the default. * **Configured:** All 3 settings are disabled by default — scores 2 points * **Partially Configured:** At least 1 setting is disabled by default — scores 1 point * **Not Configured:** None of the settings are disabled by default — scores 0 points **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## SharePoint External/Guest Sharing **Description:** Verifies if SharePoint is configured to allow external collaboration by default on three settings: * "SharePoint content can be shared with" — compliant when it is not set to "Anyone" or "Only People in your organization" * "Guests must sign in using the same account to which sharing invitations are sent" — compliant when set to Enabled * "Allow guests to share items they don't own" — compliant when set to Disabled **Why:** External collaboration through SharePoint can leave your organization open to security risks such as uncontrolled file sharing and sensitive data leakage. * **Configured:** All 3 settings compliant — scores 2 points * **Partially Configured:** At least 1 setting compliant — scores 1 point * **Not Configured:** None compliant — scores 0 points **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes Microsoft has confirmed the option "Guests must sign in using the same account to which sharing invitations are sent" has been removed from the SharePoint Admin UI as part of the legacy guest invitation flow deprecation. This configuration is still available in the API for now, which allows us to leverage it and keep the tenant secure in case the legacy flow is still active. ## Risky IP Address Policy **Description:** Verifies if a Conditional Access Policy is in place that blocks access based on IP address. **Why:** Having a risky IP address conditional access policy defined reduces the number of attacks users are exposed to. This can be done through requiring additional steps to grant access from certain IP addresses or blocking access completely. * **Configured:** A conditional access policy blocking access based on IP address exists — scores 1 point. Make sure Named Locations is set with Location Type: IP Ranges. * **Not Configured:** No such policy exists — scores 0 points **Microsoft Licensing:** Requires Premium (P1) licensing **Secure Score impact:** Yes ## Risky Country Policy **Description:** Verifies if a Conditional Access Policy is in place that blocks access based on countries. **Why:** Having a risky country conditional access policy defined reduces the number of attacks users are exposed to. This can be done through requiring additional steps to grant access from certain countries or blocking access completely. * **Configured:** Such a policy exists — scores 1 point. Make sure Named Locations is set with Location Type: Country(IP). * **Not Configured:** No such policy exists — scores 0 points **Microsoft Licensing:** Requires Premium (P1) licensing **Secure Score impact:** Yes ## Connected Apps & User Consent **Description:** Verifies if users can consent to application integrations in M365. **Why:** Users integrating applications in M365 without admin oversight can lead to vulnerabilities such as phishing and hacking. * **Configured:** Only admins can consent to applications — scores 1 point * **Not Configured:** Users can consent to applications — scores 0 points **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Safe Attachments **Description:** Verifies that Defender for Office 365 and the option to disallow infected file downloads are enabled. **Why:** Safe Attachments for SharePoint, OneDrive, and Microsoft Teams in Microsoft Defender for Office 365 provides an additional layer of protection for files that have already been scanned asynchronously by the common virus detection engine in Microsoft 365. It helps detect and block existing files that are identified as malicious in team sites and document libraries. * **Configured:** Both settings enabled * **Partially Configured:** Defender for Office 365 is enabled but not the option to disallow infected file downloads * **Not Configured:** Defender for Office 365 is disabled **Microsoft Licensing:** M365 Defender **Secure Score impact:** Yes ## External Mail Forwarding **Description:** Verifies that the outbound anti-spam policies are configured to disable automatic forwarding rules. **Why:** To restrict external auto-forwarding in Exchange Online, it's best to use outbound spam filters. Although other approaches are available, using outbound spam filters means users can still create external auto-forwarding rules but receive a mail delivery failure when the rule is used. This allows you to continue to monitor for malicious rules being created — a high-fidelity alert for account compromise — whilst preventing the impact of the attack. * **Configured:** Forwarding is disabled * **Not Configured:** Forwarding is enabled **Microsoft Licensing:** M365 Defender **Secure Score impact:** Yes **Important:** Make sure the tenant doesn't have integrations relying on email forwarding before disabling this setting. Microsoft doesn't have a recovery option, and if this setting needs to be re-enabled the forwarding rules will have to be re-created manually. ## Block Sign-in on Shared Mailboxes **Description:** Monitors for shared mailboxes that do not have logins disabled. **Why:** As shared mailboxes are typically not monitored directly by a user, it is best practice to block sign-in on shared mailbox accounts, as recommended by Microsoft and the MSP community, to avoid an attacker being able to authenticate and log in to such accounts. * **Configured:** All shared mailbox account sign-ins are blocked * **Not Configured:** One or more shared mailbox account sign-ins are not blocked **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Mailbox Auditing Default (org level) **Description:** Verifies that the Mailbox Auditing Default (org level) setting is enabled at the organization. **Why:** Available in the audit are actions performed by mailbox owners, delegates and admins, and the corresponding mailbox audit records will be available when you search for them in the mailbox audit log. * **Configured:** Mailbox auditing is enabled * **Not Configured:** Mailbox auditing is disabled **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Exchange External Sender Tag **Description:** Verifies that the native Exchange External Message setting is enabled by ensuring `Set-ExternalInOutlook -Enabled` is true. **Why:** This allows users to easily differentiate phishing messages originating from an external source. If your organization already uses mail flow rules to add text to the subject line of messages from external senders, disable those rules before enabling this feature to avoid duplication. * **Security awareness** — the tag alerts users that an email originated from an external sender and encourages caution. * **Phishing prevention** — despite SPF, DKIM and DMARC, some phishing and spam emails still slip through. The external tag helps users identify potentially harmful messages. * **Visual cue** — users can quickly recognize that the sender is not part of their organization. * **Admin tracking** — external tags assist in tracking and monitoring potentially risky emails. * **Configured:** Exchange External Sender Tag is enabled * **Not Configured:** Exchange External Sender Tag is disabled **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No After this setting is enabled, it can take 24–48 hours for users to see the External icon in supported versions of Outlook. If you revert the setting, Exchange also takes 24–48 hours to stop tagging, and any emails already tagged will not have their tags removed. ## Powershell Access for Non-Admins **Description:** Verifies that end users cannot run PowerShell against the M365 organization. **Why:** Exchange Online PowerShell enables you to manage your Exchange Online organization from the command line. By default, all accounts you create in Microsoft 365 are allowed to use it. Attackers can utilize this tool to run malicious commands and access the file system and registry, and ransomware is often distributed throughout the network via PowerShell. As part of a least-privileged access approach, non-admin users that do not require this functionality should have it disabled. * **Configured:** All non-admin users cannot execute PowerShell against the M365 organization * **Not Configured:** One or more non-admin users can **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## DKIM **Description:** Verifies that DKIM is enabled for each domain. **Why:** DKIM is one of the trio of authentication methods (SPF, DKIM and DMARC) that help prevent attackers from sending messages that look like they come from your domain. By enabling DKIM with Office 365, messages sent from Exchange Online will be cryptographically signed, allowing the receiving email system to validate that the messages were generated by an authorized server and not spoofed. * **Configured:** All domains have DKIM configured * **Not Configured:** One or more domains does not **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No The DKIM security posture validates DKIM records on domains. The presence of a CNAME record in the domain is a fundamental prerequisite for DKIM, so this posture only validates domains that fulfil the basic requirements of DKIM. ## Resharing by External Users **Description:** Verifies that resharing of files by external users is disabled. **Why:** External collaboration through SharePoint can leave your organization open to security risks such as uncontrolled file sharing and sensitive data leakage. * **Configured:** Resharing by external users is disabled * **Not Configured:** Resharing by external users is enabled **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## SharePoint Site Creation by Standard Users **Description:** Verifies if SharePoint sites can be created by standard users. **Why:** As a Global Administrator or SharePoint Administrator you can let users create and administer their own SharePoint sites. By default, users can create communication sites and Microsoft 365 group-connected team sites. Disabling site creation does not remove their ability to create Microsoft 365 groups or resources such as Microsoft Teams which rely on a group — when a Microsoft 365 group is created, a SharePoint site is also created. * **Configured:** Users cannot create SharePoint sites * **Not Configured:** Users can create SharePoint sites **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Deleted Users OneDrive Retention **Description:** Verifies that deleted users' OneDrive retention settings are extended to 1 year. **Why:** For most organizations the volume and complexity of data is increasing daily. Effectively governing this information is important for regulatory compliance, risk of security breaches, user efficiency, and litigation. Microsoft 365 retention settings from retention policies and labels always take precedence over the standard OneDrive deletion process. If a OneDrive is put on hold as part of an eDiscovery case, managers and secondary owners are emailed about the pending deletion, but the OneDrive won't be deleted until the hold is removed. * **Configured:** Deleted user's OneDrive is retained for 1 year * **Not Configured:** Retained for less than 1 year **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## MFA Number Matching **Description:** Verifies that MFA Number Matching is enabled. This requires the Microsoft Authenticator app to be enabled and used. **Why:** Number matching prevents users from approving MFA to a malicious user due to MFA fatigue. The user is presented with a number to enter in the Authenticator app when receiving MFA push notifications, ensuring the MFA request is valid. * **Configured:** Number matching is enabled * **Not Configured:** Number matching is disabled **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Idle Session Timeout **Description:** Idle session timeout automatically signs out users from Microsoft 365 web apps after a set period of inactivity. **Why use it?** * Enhanced security — reduces the risk of unauthorized access to data * Data protection — safeguards sensitive information when a device is left unattended * Compliance — helps meet regulatory requirements for session management * Mitigates risks — lowers the chance of session hijacking **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Entra ID Guest User Access Permissions **Description:** Guest user access permissions in Entra ID manage what external users can access within your organization's resources. This feature helps control the level of access granted to guests, ensuring they have the necessary permissions without compromising security. **Why use it?** * Boost security — limits guest access to protect sensitive data * Ensure compliance — meets regulatory and organizational standards * Manage access — tailors permissions to fit collaboration needs **How to be compliant.** For Guest user access, select either "Guests can see membership of all non-hidden groups" or "Guests can't see membership of any groups". For Guest user invite settings, select either "Prevent everyone, including admins, from inviting external users" or "Allow members of Global Administrators, User Administrators, and Guest Inviter roles to invite external users". **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Microsoft MFA Campaign **Description:** A registration campaign in Microsoft Entra ID enables administrators to encourage or require users to register for MFA and self-service password reset in a phased rollout, allowing a gradual transition to more secure authentication methods. **Why:** This campaign enables administrators to specify which users are prompted to register, customize the registration experience, and set a deadline for registration, ensuring users are adequately prepared and informed throughout the process. * **Compliant:** Enabled or Microsoft Managed * **Not Compliant:** Disabled **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Modern Authentication for Exchange/Outlook **Description:** Modern authentication in Exchange Online provides a variety of ways to increase security in your organization with features like conditional access and multi-factor authentication. **Why:** Basic authentication is the less secure method used by older client applications. Microsoft recommends that you turn off basic authentication for your organization. **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes ## Temporary Access Pass **Description:** Verifies that Temporary Access Pass settings are enabled, using the default settings. **Why:** A Temporary Access Pass is a time-limited passcode that can be configured for single or multiple use. Users can sign in with one to onboard other authentication methods including passwordless methods such as Microsoft Authenticator, FIDO2 or Windows Hello for Business. It also makes recovery easier when a user has lost or forgotten their strong authentication factor but needs to sign in to register new methods. **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** No ## Unified Audit Log **Description:** When auditing in the Microsoft Purview compliance portal is turned on, user and admin activity from your organization is recorded in the audit log and retained for 90 days, and up to one year depending on the license assigned to users. **Why:** Unified Audit Logs provide a centralized and comprehensive record of user and administrative activities across Microsoft 365 services, capturing thousands of operations daily. This centralized logging is crucial for security as it enables organizations to monitor, investigate and respond to potential security incidents effectively. By retaining detailed logs, organizations can conduct forensic investigations to determine the scope of a compromise, identify malicious actions, and ensure compliance with regulatory requirements. **Microsoft Licensing:** Works with Basic licensing **Secure Score impact:** Yes --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/stonly-import-secure-security-posture/posture-checks-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.